Federal Data Center Consolidation Act of 2013

Summary: Federal Data Center Consolidation Act of 2013 - Requires the heads of specified federal agencies, assisted by their chief information officers, to submit to the Administrator for the Office of E-Government and Information Technology of the Office of Management and Budget (OMB) each fiscal year: (1) a comprehensive inventory of data centers owned, operated, or maintained by each such agency; and (2) a multi-year strategy to achieve the consolidation and optimization of such data centers that includes performance metrics, a timeline for agency activities to be completed under the OMB Federal Data Center Consolidation Initiative (FDCCI), and year-by-year calculations of investments and cost savings. Provides that for any year that the Department of Defense (DOD) is required to submit a performance plan for the reduction of resources required for data servers and centers, DOD: (1) may submit to the Administrator, in lieu of the multi-year strategy, the defense-wide plan and report on cost savings required by the National Defense Authorization Act for Fiscal Year 2012; and (2) shall submit the comprehensive inventory required by this Act unless the defense-wide plan contains a comparable comprehensive inventory.  Requires the Administrator to: (1)&nbsp;establish deadlines for annual reporting and requirements such agencies must meet to be considered in compliance with this Act, (2)&nbsp;develop and make publicly available a goal for the amount of planned cost savings and optimization improvements achieved through the FDCCI during a specified period, (3) aggregate the reported cost savings of each agency and optimization improvements achieved to date through the FDCCI and compare such savings to the projected cost savings and optimization improvements achieved through the FDCCI, and (4) report to Congress. Directs the Comptroller General (GAO) to review and verify the quality and completeness of the asset inventory and strategy of each agency and report to Congress.  Requires such agencies to implement&nbsp;their data center consolidation and optimization strategies consistent with federal guidelines on cloud computing security, including: (1) applicable provisions in the Federal Risk and Authorization Management Program (FedRAMP), and (2) guidance published by the National Institute of Standards and Technology (NIST).&nbsp; Authorizes the Director of National Intelligence (DNI) and the Secretary of Defense to waive the applicability of any provision of this Act to any national security system if such waiver is in the interest of national security. Requires the Director or the Secretary to submit to specified congressional committees a statement describing the waiver and the reasons for it.  Repeals this Act effective on October 1, 2018. 

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Federal Data Center Consolidation 
Act of 2013''.

SEC. 2. FEDERAL DATA CENTER CONSOLIDATION INITIATIVE.

    (a) Definitions.--In this Act:
            (1) Administrator.--The term ``Administrator'' means the 
        Administrator for the Office of E-Government and Information 
        Technology within the Office of Management and Budget.
            (2) Covered agency.--The term ``covered agency'' means the 
        following (including all associated components of the agency):
                    (A) Department of Agriculture;
                    (B) Department of Commerce;
                    (C) Department of Defense;
                    (D) Department of Education;
                    (E) Department of Energy;
                    (F) Department of Health and Human Services;
                    (G) Department of Homeland Security;
                    (H) Department of Housing and Urban Development;
                    (I) Department of the Interior;
                    (J) Department of Justice;
                    (K) Department of Labor;
                    (L) Department of State;
                    (M) Department of Transportation;
                    (N) Department of Treasury;
                    (O) Department of Veterans Affairs;
                    (P) Environmental Protection Agency;
                    (Q) General Services Administration;
                    (R) National Aeronautics and Space Administration;
                    (S) National Science Foundation;
                    (T) Nuclear Regulatory Commission;
                    (U) Office of Personnel Management;
                    (V) Small Business Administration;
                    (W) Social Security Administration; and
                    (X) United States Agency for International 
                Development.
            (3) FDCCI.--The term ``FDCCI'' means the Federal Data 
        Center Consolidation Initiative described in the Office of 
        Management and Budget Memorandum on the Federal Data Center 
        Consolidation Initiative, dated February 26, 2010, or any 
        successor thereto.
            (4) Government-wide data center consolidation and 
        optimization metrics.--The term ``Government-wide data center 
        consolidation and optimization metrics'' means the metrics 
        established by the Administrator under subsection (b)(2)(G).
    (b) Federal Data Center Consolidation Inventories and Strategies.--
            (1) In general.--
                    (A) Annual reporting.--Each year, beginning in the 
                first fiscal year after the date of enactment of this 
                Act and each fiscal year thereafter, the head of each 
                covered agency, assisted by the Chief Information 
                Officer of the agency, shall submit to the 
                Administrator--
                            (i) a comprehensive inventory of the data 
                        centers owned, operated, or maintained by or on 
                        behalf of the agency; and
                            (ii) a multi-year strategy to achieve the 
                        consolidation and optimization of the data 
                        centers inventoried under clause (i), that 
                        includes--
                                    (I) performance metrics--
                                            (aa) that are consistent 
                                        with the Government-wide data 
                                        center consolidation and 
                                        optimization metrics; and
                                            (bb) by which the 
                                        quantitative and qualitative 
                                        progress of the agency toward 
                                        the goals of the FDCCI can be 
                                        measured;
                                    (II) a timeline for agency 
                                activities to be completed under the 
                                FDCCI, with an emphasis on benchmarks 
                                the agency can achieve by specific 
                                dates;
                                    (III) year-by-year calculations of 
                                investment and cost savings for the 
                                period beginning on the date of 
                                enactment of this Act and ending on the 
                                date described in subsection (e), 
                                broken down by each year, including a 
                                description of any initial costs for 
                                data center consolidation and 
                                optimization and life cycle cost 
                                savings and other improvements, with an 
                                emphasis on--
                                            (aa) meeting the 
                                        Government-wide data center 
                                        consolidation and optimization 
                                        metrics; and
                                            (bb) demonstrating the 
                                        amount of agency-specific cost 
                                        savings each fiscal year 
                                        achieved through the FDCCI; and
                                    (IV) any additional information 
                                required by the Administrator.
                    (B) Use of other reporting structures.--The 
                Administrator may require a covered agency to include 
                the information required to be submitted under this 
                subsection through reporting structures determined by 
                the Administrator to be appropriate.
                    (C) Department of defense reporting.--For any year 
                that the Department of Defense is required to submit a 
                performance plan for reduction of resources required 
                for data servers and centers, as required under section 
                2867(b) of the National Defense Authorization Act for 
                Fiscal Year 2012 (10 U.S.C. 2223a note), the Department 
                of Defense--
                            (i) may submit to the Administrator, in 
                        lieu of the multi-year strategy required under 
                        subparagraph (A)(ii)--
                                    (I) the defense-wide plan required 
                                under section 2867(b)(2) of the 
                                National Defense Authorization Act for 
                                Fiscal Year 2012 (10 U.S.C. 2223a 
                                note); and
                                    (II) the report on cost savings 
                                required under section 2867(d) of the 
                                National Defense Authorization Act for 
                                Fiscal Year 2012 (10 U.S.C. 2223a 
                                note); and
                            (ii) shall submit the comprehensive 
                        inventory required under subparagraph (A)(i), 
                        unless the defense-wide plan required under 
                        section 2867(b)(2) of the National Defense 
                        Authorization Act for Fiscal Year 2012 (10 
                        U.S.C. 2223a note)--
                                    (I) contains a comparable 
                                comprehensive inventory; and
                                    (II) is submitted under clause (i).
                    (D) Statement.--Each year, beginning in the first 
                fiscal year after the date of enactment of this Act and 
                each fiscal year thereafter, the head of each covered 
                agency, acting through the Chief Information Officer of 
                the agency, shall--
                            (i)(I) submit a statement to the 
                        Administrator stating whether the agency has 
                        complied with the requirements of this Act; and
                            (II) make the statement submitted under 
                        subclause (I) publically available; and
                            (ii) if the agency has not complied with 
                        the requirements of this Act, submit a 
                        statement to the Administrator explaining the 
                        reasons for not complying with such 
                        requirements.
                    (E) Agency implementation of strategies.--Each 
                covered agency, under the direction of the Chief 
                Information Officer of the agency, shall--
                            (i) implement the strategy required under 
                        subparagraph (A)(ii); and
                            (ii) provide updates to the Administrator, 
                        on a quarterly basis, of--
                                    (I) the completion of activities by 
                                the agency under the FDCCI;
                                    (II) any progress of the agency 
                                towards meeting the Government-wide 
                                data center consolidation and 
                                optimization metrics; and
                                    (III) the actual cost savings and 
                                other improvements realized through the 
                                implementation of the strategy of the 
                                agency.
                    (F) Rule of construction.--Nothing in this Act 
                shall be construed to limit the reporting of 
                information by a covered agency to the Administrator, 
                the Director of the Office of Management and Budget, or 
                Congress.
            (2) Administrator responsibilities.--The Administrator 
        shall--
                    (A) establish the deadline, on an annual basis, for 
                covered agencies to submit information under this 
                section;
                    (B) establish a list of requirements that the 
                covered agencies must meet to be considered in 
                compliance with paragraph (1);
                    (C) ensure that information relating to agency 
                progress towards meeting the Government-wide data 
                center consolidation and optimization metrics is made 
                available in a timely manner to the general public;
                    (D) review the inventories and strategies submitted 
                under paragraph (1) to determine whether they are 
                comprehensive and complete;
                    (E) monitor the implementation of the data center 
                strategy of each covered agency that is required under 
                paragraph (1)(A)(ii);
                    (F) update, on an annual basis, the cumulative cost 
                savings realized through the implementation of the 
                FDCCI; and
                    (G) establish metrics applicable to the 
                consolidation and optimization of data centers 
                Government-wide, including metrics with respect to--
                            (i) costs;
                            (ii) efficiencies, including at least 
                        server efficiency; and
                            (iii) any other metrics the Administrator 
                        establishes under this subparagraph.
            (3) Cost saving goal and updates for congress.--
                    (A) In general.--Not later than 1 year after the 
                date of enactment of this Act, the Administrator shall 
                develop, and make publically available, a goal, broken 
                down by year, for the amount of planned cost savings 
                and optimization improvements achieved through the 
                FDCCI during the period beginning on the date of 
                enactment of this Act and ending on the date described 
                in subsection (e).
                    (B) Annual update.--
                            (i) In general.--Not later than 1 year 
                        after the date on which the goal described in 
                        subparagraph (A) is made publically available, 
                        and each year thereafter, the Administrator 
                        shall aggregate the reported cost savings of 
                        each covered agency and optimization 
                        improvements achieved to date through the FDCCI 
                        and compare the savings to the projected cost 
                        savings and optimization improvements developed 
                        under subparagraph (A).
                            (ii) Update for congress.--The goal 
                        required to be developed under subparagraph (A) 
                        shall be submitted to Congress and shall be 
                        accompanied by a statement describing--
                                    (I) whether each covered agency has 
                                in fact submitted a comprehensive asset 
                                inventory, including an assessment 
                                broken down by agency, which shall 
                                include the specific numbers, 
                                utilization, and efficiency level of 
                                data centers; and
                                    (II) whether each covered agency 
                                has submitted a comprehensive 
                                consolidation strategy with the key 
                                elements described in paragraph 
                                (1)(A)(ii).
            (4) GAO review.--
                    (A) In general.--Not later than 1 year after the 
                date of enactment of this Act, and each year 
                thereafter, the Comptroller General of the United 
                States shall review and verify the quality and 
                completeness of the asset inventory and strategy of 
                each covered agency required under paragraph (1)(A).
                    (B) Report.--The Comptroller General of the United 
                States shall, on an annual basis, publish a report on 
                each review conducted under subparagraph (A).
    (c) Ensuring Cybersecurity Standards for Data Center Consolidation 
and Cloud Computing.--
            (1) In general.--In implementing a data center 
        consolidation and optimization strategy under this Act, a 
        covered agency shall do so in a manner that is consistent with 
        Federal guidelines on cloud computing security, including--
                    (A) applicable provisions found within the Federal 
                Risk and Authorization Management Program (FedRAMP); 
                and
                    (B) guidance published by the National Institute of 
                Standards and Technology.
            (2) Rule of construction.--Nothing in this Act shall be 
        construed to limit the ability of the Director of the Office of 
        Management and Budget to update or modify the Federal 
        guidelines on cloud computing security.
    (d) Waiver of Requirements.--The Director of National Intelligence 
and the Secretary of Defense, or their respective designee, may waive 
the applicability to any national security system, as defined in 
section 3542 of title 44, United States Code, of any provision of this 
Act if the Director of National Intelligence or the Secretary of 
Defense, or their respective designee, determines that such waiver is 
in the interest of national security. Not later than 30 days after 
making a waiver under this subsection, the Director of National 
Intelligence or the Secretary of Defense, or their respective designee, 
shall submit to the Committee on Homeland Security and Governmental 
Affairs and the Select Committee on Intelligence of the Senate and the 
Committee on Oversight and Government Reform and the Permanent Select 
Committee on Intelligence of the House of Representatives a statement 
describing the waiver and the reasons for the waiver.
    (e) Sunset.--This Act is repealed effective on October 1, 2018.

            Passed the Senate September 18, 2014.

            Attest:

                                                NANCY ERICKSON,

                                                             Secretary.