,,ib ,union ,cal5d> ,no4 #abg #aah? ,,congress #a/ ,session ,h4 ,r4 #cbhf ,report ,no4 #aah-afj1 ,"p ,i ,,9 ,,! ,,h\se ,,( ,,repres5tatives ,may #ae1 #bjbc,mr4 ,gre5 ( ,t5nessee 7= himself1 ,mr4 ,g>b>9o1 & ,mr4 ,swalwell7 introduc$ ! foll[+ bill2 :i* 0 ref]r$ to ! ,committee on ,homel& ,security1 & 9 addition to ! ,committee on ,ov]sight & ,acc\ntability1 = a p]iod to be subsequ5tly det]m9$ by ! ,speak]1 9 ea* case = consid]ation ( su* provisions z fall )9 ! jurisdiction ( ! committee conc]n$ ,july #bg1 #bjbc;,additional sponsor3 ,mr4 ,la,lota ,july #bg1 #bjbc,report$ f ! ,committee on ,homel& ,security ) an amendment,strike out all aft] ! enact+ clause & ins]t ! "p pr9t$ 9 italic ,july #bg1 #bjbc;,committee on ,ov]sight & ,acc\ntability dis*>g$2 committ$ to ! ,committee ( ! ,:ole ,h\se on ! ,/ate ( ! ,union & ord]$ to be printed,for text ( introduc$ bill1 see copy ( bill z introduc$ on ,may #ae1 #bjbc ,a ,,bill ,to am5d ! ,homel& ,security ,act ( #bjjb to e/abli% ! duties ( ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy reg>d+ op5 s\rce s(tw>e security1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,secur+ ,op5 ,s\rce ,s(tw>e ,act ( #bjbc4 #b4 ,op5 s\rce s(tw>e security duties 7a7 ,9 g5]al ,title ,,xxii ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fej et seq47 is am5d$-- 7#a7 9 section #bbjj 7#f ,u4,s4,c4 #fej7-- 7,a7 by r$esignat+ p>agraphs 7#bb7 ?r\gh 7#bh7 z p>agraphs 7#be7 ?r\gh 7#ca71 respectively2 & 7,b7 by ins]t+ aft] p>agraph 7#ba7 ! foll[+ new p>agraphs3 7#bb7 ,op5 s\rce s(tw>e ,! t]m op5 s\rce s(tw>e means s(tw>e = :i* ! human-readable s\rce code is made available to ! public = use1 /udy1 re-use1 modification1 enhancem5t1 & re-di/ribution4 7#bc7 ,op5 s\rce s(tw>e community ,! t]m op5 s\rce s(tw>e community means ! community ( individuals1 f\ndations1 nonpr(it organizations1 corporations1 & o!r entities t-- 7,a7 develop1 contribute to1 ma9ta91 & publi% op5 s\rce s(tw>e2 or 7,b7 o!rwise "w to ensure ! security ( ! op5 s\rce s(tw>e ecosy/em4 7#bd7 ,op5 s\rce s(tw>e compon5t ,! t]m op5 s\rce s(tw>e compon5t means an individual repository ( op5 s\rce s(tw>e t is made available to ! public4 2 7#b7 9 section #bbjb7;c7 7#f ,u4,s4,c4 #feb7;c77-- 7,a7 9 p>agraph 7#ac71 by /rik+ & at ! end2 7,b7 by r$esignat+ p>agraph 7#ad7 z p>agraph 7#ae72 & 7,c7 by ins]t+ aft] p>agraph 7#ac7 ! foll[+3 7#ad7 support1 includ+ by (f]+ s]vices1 ! secure usage & deploym5t ( s(tw>e1 includ+ op5 s\rce s(tw>e1 9 ! s(tw>e developm5t lifecycle at ,f$]al ag5cies 9 accordance ) section #bbbj;,f2 & 2 & 7#c7 by add+ at ! end ! foll[+3 #bbbj;,f4 ,op5 s\rce s(tw>e security duties 7a7 ,def9ition ,9 ?is section1 ! t]m s(tw>e bill ( mat]ials has ! mean+ giv5 su* t]m 9 ! ,m9imum ,elem5ts = a ,s(tw>e ,bill ( ,mat]ials publi%$ by ! ,dep>tm5t ( ,comm]ce1 or any sup]s$+ def9ition publi%$ by ! ,ag5cy4 7b7 ,employm5t ,! ,director %all1 to ! greate/ ext5t practicable1 employ individuals 9 ! ,ag5cy :o-- 7#a7 h exp]tise & exp]i5ce p>ticipat+ 9 ! op5 s\rce s(tw>e community2 & 7#b7 p]=m ! duties describ$ 9 subsection 7c74 7c7 ,duties ( ! ,director 7#a7 ,9 g5]al ,! ,director %all-- 7,a7 p]=m outrea* & engagem5t to bol/] ! security ( op5 s\rce s(tw>e2 7,b7 support ,f$]al ef=ts to /r5g!n ! security ( op5 s\rce s(tw>e2 7,c7 coord9ate1 z appropriate1 ) non-,f$]al entities on ef=ts to ensure ! long-t]m security ( op5 s\rce s(tw>e2 7,d7 s]ve z a public po9t ( contact reg>d+ ! security ( op5 s\rce s(tw>e = non-,f$]al entities1 includ+ ,/ate1 local1 ,tribal1 & t]ritorial p>tn]s1 ! private sector1 int]national p>tn]s1 & op5 s\rce s(tw>e communities2 & 7,e7 support ,f$]al & non-,f$]al supply *a9 security ef=ts by enc\rag+ ef=ts to bol/] op5 s\rce s(tw>e security1 su* z-- 7i7 assi/+ 9 coord9at$ vuln]ability disclosures 9 op5 s\rce s(tw>e compon5ts pursuant to section #bbji7n72 & 7ii7 support+ ! activities ( ! ,f$]al ,acquisition ,security ,c\ncil4 7#b7 ,assessm5t ( critical op5 s\rce s(tw>e compon5ts 7,a7 ,framework ,n lat] ?an "o ye> aft] ! date ( ! enactm5t ( ?is section1 ! ,director %all publicly publi% a framework1 incorporat+ gov]nm5t1 private sector1 & op5 s\rce s(tw>e community frameworks & be/ practices1 includ+ ^? publi%$ by ! ,national ,in/itute ( ,/&>ds & ,te*nology1 = assess+ ! risk ( op5 s\rce s(tw>e compon5ts1 includ+ direct & indirect op5 s\rce s(tw>e dep5d5cies1 :i* %all incorporate1 at a m9imum1 ! foll[+ ) respect to a giv5 op5 s\rce s(tw>e compon5t3 7i7 ,! security prop]ties ( code1 su* z :e!r ! code is writt5 9 a memory-safe programm+ language or successor language4 7ii7 ,! security practices ( developm5t1 build1 & release processes1 su* z ! use ( multi-factor au!ntication by ma9ta9]s & cryptographic sign+ ( releases4 7iii7 ,! numb] & sev]ity ( publicly kn[n1 unpat*$ vuln]abilities4 7iv7 ,! bread? ( deploym5t4 7v7 ,! level ( risk associat$ ) :]e su* compon5t is integrat$ or deploy$1 su* z :e!r su* compon5t op]ates on a network b\nd>y or 9 a privileg$ location4 7vi7 ,! heal? & su/a9ability ( ! op5 s\rce s(tw>e community1 includ+1 :]e applicable1 ! level ( curr5t & hi/orical inve/m5t & ma9t5ance 9 su* compon5t1 su* z ! numb] & activity ( individual ma9ta9]s4 7,b7 ,updat+ framework ,n less frequ5tly ?an annually aft] ! date on :i* ! framework is publi%$ "u subp>agraph 7,a71 ! ,director %all-- 7i7 det]m9e :e!r updates are ne$$ to su* framework1 includ+ ! augm5tation1 addition1 or removal ( ! elem5ts describ$ 9 clauses 7i7 ?r\gh 7vi7 ( su* subp>agraph2 & 7ii7 if ! ,director s det]m9es t su* additional updates are ne$$1 make su* updates4 7,c7 ,develop+ framework ,9 develop+ ! framework describ$ 9 subp>agraph 7,a71 ! ,director %all consult ) ! foll[+3 7i7 ,appropriate ,f$]al ag5cies1 includ+ ! ,national ,in/itute ( ,/&>ds & ,te*nology4 7ii7 ,! op5 s\rce s(tw>e community4 7,d7 ,usability ,! ,director %all ensure1 to ! greate/ ext5t practicable1 t ! framework describ$ 9 subp>agraph 7,a7 is usable by ! op5 s\rce s(tw>e community1 includ+ ?r\gh ! consultation requir$ "u subp>agraph 7,c74 7,e7 ,f$]al op5 s\rce s(tw>e assessm5t ,n lat] ?an "o ye> aft] ! publication ( ! framework "u subp>agraph 7,a7 & n less frequ5tly ?an e two ye>s !reaft]1 ! ,director %all1 to ! greate/ ext5t practicable & us+ su* framework-- 7i7 p]=m an assessm5t ( ea* op5 s\rce s(tw>e compon5t deploy$ on high value assets1 z describ$ 9 ,(fice ( ,managem5t & ,budget memor&um ,m-#ai-jc 7issu$ ,decemb] #aj1 #bjah7 or successor guidance1 at ,f$]al ag5cies bas$ on readily available1 &1 to ! greate/ ext5t practicable1 ma*9e readable1 in=mation1 su* z-- 7,i7 s(tw>e bills ( mat]ial t are1 at ! "t ( ! assessm5t1 made available to ! ,ag5cy or are o!rwise accessible via ! int]net2 7,,ii7 s(tw>e inv5tories1 available to ! ,director at ! "t ( ! assessm5t1 f ! ,cont9u\s ,diagno/ics & ,mitigation program ( ! ,ag5cy2 & 7,,iii7 o!r publicly available in=mation reg>d+ op5 s\rce s(tw>e compon5ts2 & 7ii7 develop1 9 consultation ) ! ,f$]al ag5cy at :i* an op5 s\rce s(tw>e compon5t is deploy$1 "o or m rank$ li/s ( compon5ts describ$ 9 clause 7i7 bas$ on su* assessm5t1 su* z rank$ by ! criticality1 level ( risk1 or usage ( ! compon5ts1 or a comb9ation !re(4 7,f7 ,automation ,! ,director %all1 to ! greate/ ext5t practicable1 automate ! assessm5t p]=m$ pursuant to subp>agraph 7,e74 7,g7 ,publication ,! ,director %all publicly publi% & ma9ta9 any tools develop$ to p]=m ! assessm5t "u subp>agraph 7,e7 z op5 s\rce s(tw>e4 7,h7 ,%>+ 7i7 ,results ,! ,director1 to ! greate/ ext5t practicable1 & tak+ into acc\nt ! s5sitivity ( ! in=mation conta9$ 9 ! assessm5t p]=m$ pursuant to subp>agraph 7,e71 %all facilitate ! %>+ ( ! results ( ea* assessm5t "u subp>agraph 7,e77i7 ) appropriate ,f$]al & non-,f$]al entities work+ to support ! security ( op5 s\rce s(tw>e1 includ+ by (f]+ means = appropriate ,f$]al & non-,f$]al entities to d[nload ! assessm5t 9 an automat$ mann]4 7ii7 ,datasets ,! ,director may publicly publi%1 z appropriate1 any datasets or v]sions ( ! datasets develop$ or consolidat$ z a result ( an assessm5t "u subp>agraph 7,e77i74 7,i7 ,critical infra/ructure assessm5t /udy & pilot 7i7 ,/udy ,n lat] ?an two ye>s aft] ! publication ( ! framework "u subp>agraph 7,a71 ! ,director %all conduct a /udy reg>d+ ! feasibility ( ! ,director conduct+ ! assessm5t "u subp>agraph 7,e7 = critical infra/ructure entities4 7ii7 ,pilot 7,i7 ,9 g5]al ,if ! ,director det]m9es t ! assessm5t describ$ 9 clause 7i7 is feasible1 ! ,director may conduct a pilot assessm5t on a volunt>y basis ) "o or m critical infra/ructure sectors1 9 coord9ation ) ! ,sector ,risk ,managem5t ,ag5cy & ! sector coord9at+ c\ncil ( ea* p>ticipat+ sector4 7,,ii7 ,t]m9ation ,if ! ,director proce$s ) ! pilot assessm5t describ$ 9 subclause 7,i71 su* pilot assessm5t %all t]m9ate n lat] ?an two ye>s aft] ! date on :i* ! ,director beg9s su* pilot assessm5t4 7iii7 ,reports 7,i7 ,/udy ,n lat] ?an #ahj days aft] ! date on :i* ! ,director completes ! /udy conduct$ "u clause 7i71 ! ,director %all submit to ! appropriate congressional committees a report t-- 7aa7 summ>izes ! /udy2 7bb7 /ates :e!r ! ,director plans to proce$ ) ! pilot assessm5t describ$ 9 clause 7ii77,i72 & 7cc7 if ! ,director proce$s ) su* pilot assessm5t1 describes-- 7,,aa7 ! me?odology = select+ ! critical infra/ructure sector or sectors to p>ticipate 9 ! pilot2 & 7,,bb7 ! res\rces requir$ to c>ry out ! pilot4 7,,ii7 ,pilot ,if ! ,director proce$s ) ! pilot assessm5t describ$ 9 clause 7ii71 n lat] ?an "o ye> aft] ! date on :i* ! ,director beg9s su* pilot assessm5t1 ! ,director %all submit to ! appropriate congressional committees a report t includes ! foll[+3 7aa7 ,a summ>y ( ! results ( su* pilot assessm5t4 7bb7 ,a recomm5dation z to :e!r ! activities c>ri$ out "u su* pilot assessm5t %\ld be cont9u$ aft] ! t]m9ation ( su* pilot assessm5t 9 accordance ) clause 7ii77,,ii74 7#c7 ,consultation ) ,national ,cyb] ,director ,! ,director %all-- 7,a7 brief ! ,national ,cyb] ,director on ! activities describ$ 9 ?is subsection2 & 7,b7 consult ) ! ,national ,cyb] ,director reg>d+ su* activities1 z appropriate4 7#d7 ,reports 7,a7 ,9 g5]al ,n lat] ?an "o ye> aft] ! date ( ! enactm5t ( ?is section & e two ye>s !reaft] = ! foll[+ six ye>s1 ! ,director %all submit to ! appropriate congressional committees a report t includes = ! p]iod cov]$ by ea* su* report ! foll[+3 7i7 ,a summ>y ( ! "w on op5 s\rce s(tw>e security p]=m$ by ! ,director1 includ+ a li/ ( ! ,f$]al & non-,f$]al entities ) :i* ! ,director int]fac$4 7ii7 ,! framework "u p>agraph 7#b77;,a7 or a summ>y ( any updates to su* framework pursuant to p>agraph 7#b77;,b71 z ! case may be4 7iii7 ,a summ>y ( ea* assessm5t "u p>agraph 7#b77;,e77i74 7iv7 ,a summ>y ( *anges made to ea* su* assessm5t1 includ+ ov]all security tr5ds4 7v7 ,a summ>y ( ! types ( entities ) :i* ea* su* assessm5t 0 %>$ pursuant to p>agraph 7#b77;,h71 includ+ a li/ ( ! ,f$]al & non-,f$]al entities ) :i* su* assessm5t 0 %>$4 7vi7 ,in=mation on res\rces1 includ+ /aff+1 allocat$ to ! ,director's op5 s\rce s(tw>e responsibilities "u ?is section4 7,b7 ,public report ,n lat] ?an #cj days aft] ! date on :i* ! ,director submits ea* report requir$ "u subp>agraph 7,a71 ! ,director %all make a v]sion ( ea* su* report publicly available on ! website ( ! ,ag5cy4 4 7b7 ,te*nical & con=m+ am5dm5t ,! table ( cont5ts 9 section #a7;b7 ( ! ,homel& ,security ,act ( #bjjb is am5d$ by ins]t+ aft] ! item relat+ to section #bbbj;,e ! foll[+ new item3 ,sec4 #bbbj;,f4 ,op5 s\rce s(tw>e security duties4 4 7c7 ,s(tw>e security advisory subcommittee ,section #bbai7;d77#a7 ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #ffe;e7d77#a77 is am5d$ by add+ at ! end ! foll[+3 7,e7 ,s(tw>e security1 includ+ op5 s\rce s(tw>e security4 4 7d7 ,rule ( con/ruction ,no?+ 9 ?is ,act or ! am5dm5ts made by ?is ,act may be con/ru$ to provide any additional regulatory au?ority to any ,f$]al ag5cy describ$ !re94 ,july #bg1 #bjbc,report$ f ! ,committee on ,homel& ,security ) an amendment,july #bg1 #bjbc;,committee on ,ov]sight & ,acc\ntability dis*>g$2 committ$ to ! ,committee ( ! ,:ole ,h\se on ! ,/ate ( ! ,union & ord]$ to be pr9t$