II 

Calendar No. 677 

117TH CONGRESS 

2D SESSION S. 4913 

[Report No. 117–278] 

To establish the duties of the Director of the Cybersecurity and Infrastructure 

Security Agency regarding open source software security, and for other 

purposes. 

IN THE SENATE OF THE UNITED STATES 

SEPTEMBER 21, 2022 

Mr. PETERS (for himself and Mr. PORTMAN) introduced the following bill; 

which was read twice and referred to the Committee on Homeland Security and Governmental Affairs 

DECEMBER 19, 2022 

Reported by Mr. PETERS, with amendments 

[Omit the part struck through and insert the part printed in italic] 

A BILL 

To establish the duties of the Director of the Cybersecurity 

and Infrastructure Security Agency regarding open 

source software security, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


pamtmann on DSKBC07HB2PROD with BILLS
2 

•S 4913 RS

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Securing Open Source 

3 Software Act of 2022’’. 

4 SEC. 2. FINDINGS. 

5 Congress finds that— 

6 (1) open source software fosters technology de7 velopment and is an integral part of overall cyberse8 curity; 

9 (2) a secure, healthy, vibrant, and resilient open 

10 source software ecosystem is crucial for ensuring the 

11 national security and economic vitality of the United 

12 States; 

13 (3) open source software is part of the founda14 tion of digital infrastructure that promotes a free 

15 and open internet; 

16 (4) due to both the unique strengths of open 

17 source software and inconsistent historical invest18 ment in open source software security, there exist 

19 unique challenges in securing open source software; 

20 and 

21 (5) the Federal Government should play a sup22 porting role in ensuring the long-term security of 

23 open source software. 


pamtmann on DSKBC07HB2PROD with BILLS
3 

•S 4913 RS

1 SEC. 3. OPEN SOURCE SOFTWARE SECURITY DUTIES. 

2 (a) IN GENERAL.—Subtitle A of title XXII of the 

3 Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) 

4 is amended— 

5 (1) in section 2201 (6 U.S.C. 651)— 

6 (A) by redesignating paragraphs (5), (6), 

7 and (7) as paragraphs (8), (9), and (10), re8 spectively; and 

9 (B) by inserting after paragraph (4) the 

10 following: 

11 ‘‘(5) OPEN SOURCE SOFTWARE.—The term 

12 ‘open source software’ means software for which the 

13 human-readable source code is made available to the 

14 public for use, study, re-use, modification, enhance15 ment, and re-distribution. 

16 ‘‘(6) OPEN SOURCE SOFTWARE COMMUNITY.— 

17 The term ‘open source software community’ means 

18 the community of individuals, foundations, nonprofit 

19 organizations, corporations, and other entities 

20 that— 

21 ‘‘(A) develop, contribute to, maintain, and 

22 publish open source software; or 

23 ‘‘(B) otherwise work to ensure the security 

24 of the open source software ecosystem. 

25 ‘‘(7) OPEN SOURCE SOFTWARE COMPONENT.— 

26 The term ‘open source software component’ means 


pamtmann on DSKBC07HB2PROD with BILLS
4 

•S 4913 RS

1 an individual repository of open source software that 

2 is made available to the public.’’; 

3 (2) in section 2202(c) (6 U.S.C. 652(c))— 

4 (A) in paragraph (13), by striking ‘‘and’’ 

5 at the end; 

6 (B) by redesignating paragraph (14) as 

7 paragraph (15); and 

8 (C) by inserting after paragraph (13) the 

9 following: 

10 ‘‘(14) support, including by offering services, 

11 the secure usage and deployment of software, includ12 ing open source software, in the software develop13 ment lifecycle at Federal agencies in accordance with 

14 section 2220E; and’’; and 

15 (3) by adding at the end the following: 

16 ‘‘SEC. 2220E. OPEN SOURCE SOFTWARE SECURITY DUTIES. 

17 ‘‘(a) DEFINITION.—In this section, the term ‘soft18 ware bill of materials’ has the meaning given the term in 

19 the Minimum Elements for a Software Bill of Materials 

20 published by the Department of Commerce, or any super21 seding definition published by the Agency. 

22 ‘‘(b) EMPLOYMENT.—The Director shall, to the 

23 greatest extent practicable, employ individuals in the 

24 Agency who— 


pamtmann on DSKBC07HB2PROD with BILLS
5 

•S 4913 RS

1 ‘‘(1) have expertise and experience participating 

2 in the open source software community; and 

3 ‘‘(2) perform the duties described in subsection 

4 (c). 

5 ‘‘(c) DUTIES OF THE DIRECTOR.— 

6 ‘‘(1) IN GENERAL.—The Director shall— 

7 ‘‘(A) perform outreach and engagement to 

8 bolster the security of open source software; 

9 ‘‘(B) support Federal efforts to strengthen 

10 the security of open source software; 

11 ‘‘(C) coordinate, as appropriate, with non12 Federal entities on efforts to ensure the long13 term security of open source software; 

14 ‘‘(D) serve as a public point of contact re15 garding the security of open source software for 

16 non-Federal entities, including State, local, 

17 Tribal, and territorial partners, the private sec18 tor, international partners, open source soft19 ware organizations, and open source software 

20 developers; and 

21 ‘‘(E) support Federal and non-Federal 

22 supply chain security efforts by encouraging ef23 forts to bolster open source software security, 

24 such as— 


pamtmann on DSKBC07HB2PROD with BILLS
6 

•S 4913 RS

1 ‘‘(i) assisting in coordinated vulner2 ability disclosures in open source software 

3 components pursuant to section 2209(n); 

4 and 

5 ‘‘(ii) supporting the activities of the 

6 Federal Acquisition Security Council. 

7 ‘‘(2) ASSESSMENT OF CRITICAL OPEN SOURCE

8 SOFTWARE COMPONENTS.— 

9 ‘‘(A) FRAMEWORK.—Not later than 1 year 

10 after the date of enactment of this section, the 

11 Director shall publicly publish a framework, in12 corporating government, including those pub13 lished by the National Institute of Standards 

14 and Technology, industry, and open source soft15 ware community frameworks and best practices, 

16 including those published by the National Insti17 tute of Standards and Technology, for assessing 

18 the risk of open source software components, 

19 including direct and indirect open source soft20 ware dependencies, which shall incorporate, at a 

21 minimum— 

22 ‘‘(i) the security properties of code in 

23 a given open source software component, 

24 such as whether the code is written in a 

25 memory-safe programming language; 


pamtmann on DSKBC07HB2PROD with BILLS
7 

•S 4913 RS

1 ‘‘(ii) the security practices of develop2 ment, build, and release processes of a 

3 given open source software component, 

4 such as the use of multi-factor authentica5 tion by maintainers and cryptographic 

6 signing of releases; 

7 ‘‘(iii) the number and severity of pub8 licly known, unpatched vulnerabilities in a 

9 given open source software component; 

10 ‘‘(iv) the breadth of deployment of a 

11 given open source software component; 

12 ‘‘(v) the level of risk associated with 

13 where a given open source software compo14 nent is integrated or deployed, such as 

15 whether the component operates on a net16 work boundary or in a privileged location; 

17 and 

18 ‘‘(vi) the health of the community for 

19 a given open source software component, 

20 including, where applicable, the level of 

21 current and historical investment and 

22 maintenance in the open source software 

23 component, such as the number and activ24 ity of individual maintainers. 


pamtmann on DSKBC07HB2PROD with BILLS
8 

•S 4913 RS

1 ‘‘(B) UPDATING FRAMEWORK.—Not less 

2 frequently than annually after the date on 

3 which the framework is published under sub4 paragraph (A), the Director shall— 

5 ‘‘(i) determine whether additional up6 dates are needed to the framework de7 scribed in subparagraph (A); and 

8 ‘‘(ii) if the Director determines that 

9 additional updates are needed under clause 

10 (i), make those updates to the framework. 

11 ‘‘(C) DEVELOPING FRAMEWORK.—In de12 veloping the framework described in subpara13 graph (A), the Director shall consult with— 

14 ‘‘(i) appropriate Federal agencies, in15 cluding the National Institute of Standards 

16 and Technology; 

17 ‘‘(ii) individuals and nonprofit organi18 zations from the open source software com19 munity; and 

20 ‘‘(iii) private companies from the open 

21 source software community. 

22 ‘‘(D) FEDERAL OPEN SOURCE SOFTWARE

23 ASSESSMENT.—Not later than 1 year after the 

24 publication of the framework described in sub25 paragraph (A), and not less frequently than 


pamtmann on DSKBC07HB2PROD with BILLS
9 

•S 4913 RS

1 every 2 years thereafter, the Director shall, to 

2 the greatest extent practicable and using the 

3 framework described in subparagraph (A)— 

4 ‘‘(i) perform an assessment of open 

5 source software components used directly 

6 or indirectly by Federal agencies based on 

7 readily available, and, to the greatest ex8 tent practicable, machine readable, infor9 mation, such as— 

10 ‘‘(I) software bills of material 

11 that are made available to the Agency 

12 or are otherwise accessible via the 

13 internet; 

14 ‘‘(II) software inventories col15 lected from the Continuous 

16 Diagnostics and Mitigation program 

17 of the Agency; and 

18 ‘‘(III) other publicly available in19 formation regarding open source soft20 ware components; and 

21 ‘‘(ii) develop 1 or more ranked lists of 

22 components described in clause (i) based 

23 on the assessment, such as ranked by the 

24 criticality, level of risk, or usage of the 

25 components, or a combination thereof. 


pamtmann on DSKBC07HB2PROD with BILLS
10 

•S 4913 RS

1 ‘‘(E) AUTOMATION.—The Director shall, 

2 to the greatest extent practicable, automate the 

3 assessment conducted under subparagraph (D). 

4 ‘‘(F) PUBLICATION.—The Director shall 

5 publicly publish and maintain any tools devel6 oped to conduct the assessment described in 

7 subparagraph (D) as open source software. 

8 ‘‘(G) SHARING.— 

9 ‘‘(i) RESULTS.—The Director shall fa10 cilitate the sharing of the results of the as11 sessment described in subparagraph (D) 

12 with appropriate Federal and non-Federal 

13 entities working to support the security of 

14 open source software, including by offering 

15 means for appropriate Federal and non16 Federal entities to download the assess17 ment in an automated manner. 

18 ‘‘(ii) DATASETS.—The Director may 

19 publicly publish, as appropriate, any 

20 datasets or versions of the datasets devel21 oped or consolidated as a result of the as22 sessment described in subparagraph (D). 

23 ‘‘(H) CRITICAL INFRASTRUCTURE ASSESS24 MENT STUDY AND PILOT.— 


pamtmann on DSKBC07HB2PROD with BILLS
11 

•S 4913 RS

1 ‘‘(i) STUDY.—Not later than 2 years 

2 after the publication of the framework de3 scribed in subparagraph (A), the Director 

4 shall conduct a study regarding the feasi5 bility of the Director conducting the as6 sessment described in subparagraph (D) 

7 for critical infrastructure entities. 

8 ‘‘(ii) PILOT.—If the Director deter9 mines that the assessment described in 

10 clause (i) is feasible, the Director may con11 duct a pilot assessment on a voluntary 

12 basis with 1 or more critical infrastructure 

13 sectors, in coordination with the Sector 

14 Risk Management Agency and the sector 

15 coordinating council of each participating 

16 sector. 

17 ‘‘(iii) REPORTS.— 

18 ‘‘(I) STUDY.—Not later than 180 

19 days after the date on which the Di20 rector completes the study conducted 

21 under clause (i), the Director shall 

22 submit to the appropriate congres23 sional committees a report that— 

24 ‘‘(aa) summarizes the study; 

25 and 


pamtmann on DSKBC07HB2PROD with BILLS
12 

•S 4913 RS

1 ‘‘(bb) states whether the Di2 rector plans to proceed with the 

3 pilot described in clause (ii). 

4 ‘‘(II) PILOT.—If the Director 

5 proceeds with the pilot described in 

6 clause (ii), not later than 1 year after 

7 the date on which the Director begins 

8 the pilot, the Director shall submit to 

9 the appropriate congressional commit10 tees a report that includes— 

11 ‘‘(aa) a summary of the re12 sults of the pilot; and 

13 ‘‘(bb) a recommendation as 

14 to whether the pilot should be 

15 continued. 

16 ‘‘(3) COORDINATION WITH NATIONAL CYBER DI17 RECTOR.—The Director shall— 

18 ‘‘(A) brief the National Cyber Director on 

19 the activities described in this subsection; and 

20 ‘‘(B) coordinate activities with the Na21 tional Cyber Director, as appropriate. 

22 ‘‘(4) REPORTS.— 

23 ‘‘(A) IN GENERAL.—Not later than 1 year 

24 after the date of enactment of this section, and 

25 every 2 years thereafter, the Director shall subVerDate Sep 11 2014 16:03 Dec 20, 2022 Jkt 039200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S4913.RS S4913

pamtmann on DSKBC07HB2PROD with BILLS
13 

•S 4913 RS

1 mit to the appropriate congressional committees 

2 a report that includes— 

3 ‘‘(i) a summary of the work on open 

4 source software security performed by the 

5 Director during the period covered by the 

6 report, including a list of the Federal and 

7 non-Federal entities with which the Direc8 tor interfaced; 

9 ‘‘(ii) the framework developed under 

10 paragraph (2)(A); 

11 ‘‘(iii) a summary of changes made to 

12 the framework developed under paragraph 

13 (2)(A) since the last report submitted 

14 under this subparagraph; 

15 ‘‘(iv) a summary of the assessment 

16 conducted pursuant to paragraph (2)(D); 

17 ‘‘(v) a summary of changes made to 

18 the assessment conducted pursuant to 

19 paragraph (2)(D) since the last report sub20 mitted under this subparagraph, including 

21 overall security trends; and 

22 ‘‘(vi) a summary of the types of enti23 ties with which the assessment was shared 

24 pursuant to paragraph (2)(G), including a 


pamtmann on DSKBC07HB2PROD with BILLS
14 

•S 4913 RS

1 list of the Federal and non-Federal entities 

2 with which the assessment was shared. 

3 ‘‘(B) PUBLIC REPORT.—Not later than 30 

4 days after the date on which the Director sub5 mits a report required under subparagraph (A), 

6 the Director shall make a version of the report 

7 publicly available on the website of the Agen8 cy.’’. 

9 (b) TECHNICAL AND CONFORMING AMENDMENT.— 

10 The table of contents in section 1(b) of the Homeland Se11 curity Act of 2002 (Public Law 107–296; 116 Stat. 2135) 

12 is amended— 

13 (1) by moving the item relating to section 

14 2220D to appear after the item relating to section 

15 2220C; and 

16 (2) by inserting after the item relating to sec17 tion 2220D the following: 

‘‘Sec. 2220E. Open source software security duties.’’. 

18 SEC. 4. SOFTWARE SECURITY ADVISORY SUBCOMMITTEE. 

19 Section 2219(d)(1) of the Homeland Security Act of 

20 2002 (6 U.S.C. 665e(d)(1)) is amended by adding at the 

21 end the following: 

22 ‘‘(E) Software security, including open 

23 source software security.’’. 

24 SEC. 5. OPEN SOURCE SOFTWARE GUIDANCE. 

25 (a) DEFINITIONS.—In this section: 


pamtmann on DSKBC07HB2PROD with BILLS
15 

•S 4913 RS

1 (1) APPROPRIATE CONGRESSIONAL COM2 MITTEE.—The term ‘‘appropriate congressional com3 mittee’’ has the meaning given the term in section 

4 2 of the Homeland Security Act of 2002 (6 U.S.C. 

5 101). 

6 (2) COVERED AGENCY.—The term ‘‘covered 

7 agency’’ means an agency described in section 

8 901(b) of title 31, United States Code. 

9 (3) DIRECTOR.—The term ‘‘Director’’ means 

10 the Director of the Office of Management and Budg11 et. 

12 (4) NATIONAL SECURITY SYSTEM.—The term 

13 ‘‘national security system’’ has the meaning given the 

14 term in section 3552 of title 44, United States Code. 

15 (4)(5) OPEN SOURCE SOFTWARE; OPEN SOURCE

16 SOFTWARE COMMUNITY.—The terms ‘‘open source 

17 software’’ and ‘‘open source software community’’ 

18 have the meanings given those terms in section 2201 

19 of the Homeland Security Act of 2002 (6 U.S.C. 

20 651), as amended by section 3 of this Act. 

21 (b) GUIDANCE.— 

22 (1) IN GENERAL.—Not later than 1 year after 

23 the date of enactment of this Act, the Director, in 

24 coordination with the National Cyber Director, the 

25 Director of the Cybersecurity and Infrastructure SeVerDate Sep 11 2014 16:03 Dec 20, 2022 Jkt 039200 PO 00000 Frm 00015 Fmt 6652 Sfmt 6201 E:\BILLS\S4913.RS S4913

pamtmann on DSKBC07HB2PROD with BILLS
16 

•S 4913 RS

1 curity Agency, and the Administrator of General 

2 Services, shall issue guidance on the responsibilities 

3 of the chief information officer at each covered agen4 cy regarding open source software, which shall in5 clude— 

6 (A) how chief information officers at each 

7 covered agency should, considering industry and 

8 open source software community best prac9 tices— 

10 (i) manage and reduce risks of using 

11 open source software; and 

12 (ii) guide contributing to and releas13 ing open source software; 

14 (B) how chief information officers should 

15 enable, rather than inhibit, the secure usage of 

16 open source software at each covered agency; 

17 (C) any relevant updates to the Memo18 randum M–16–21 issued by the Office of Man19 agement and Budget on August 8, 2016, enti20 tled, ‘‘Federal Source Code Policy: Achieving 

21 Efficiency, Transparency, and Innovation 

22 through Reusable and Open Source Software’’; 

23 and 

24 (D) how covered agencies may contribute 

25 publicly to open source software that the covVerDate Sep 11 2014 16:03 Dec 20, 2022 Jkt 039200 PO 00000 Frm 00016 Fmt 6652 Sfmt 6201 E:\BILLS\S4913.RS S4913

pamtmann on DSKBC07HB2PROD with BILLS
17 

•S 4913 RS

1 ered agency uses, including how chief informa2 tion officers should encourage those contribu3 tions. 

4 (2) EXEMPTION OF NATIONAL SECURITY SYS5 TEMS.—The guidance issued under paragraph (1) 

6 shall not apply to national security systems. 

7 (c) PILOT.— 

8 (1) IN GENERAL.—Not later than 1 year after 

9 the date of enactment of this Act, the chief informa10 tion officer of each covered agency described in se11 lected under paragraph (2), in coordination with the 

12 Director, the National Cyber Director, the Director 

13 of the Cybersecurity and Infrastructure Security 

14 Agency, and the Administrator of General Services, 

15 shall establish a pilot open source function at the 

16 covered agency that— 

17 (A) is modeled after open source program 

18 offices, such as those in the private sector, the 

19 nonprofit sector, academia, and other non-Fed20 eral entities; and 

21 (B) shall— 

22 (i) support the secure usage of open 

23 source software at the covered agency; 

24 (ii) develop policies and processes for 

25 contributions to and releases of open 


pamtmann on DSKBC07HB2PROD with BILLS
18 

•S 4913 RS

1 source software at the covered agency, in 

2 consultation, as appropriate, with the 

3 Ooffices of G general C counsel and P 

4 procurement of the covered agency; 

5 (iii) interface with the open source 

6 software community; and 

7 (iv) manage and reduce risks of con8 suming using open source software at the 

9 covered agency. 

10 (2) SELECTION OF PILOT AGENCIES.—The Di11 rector, in coordination with the National Cyber Di12 rector, the Director of the Cybersecurity and Infra13 structure Security Agency, and the Administrator of 

14 General Services, shall select 1 or more covered 

15 agencies to conduct the pilot described in paragraph 

16 (1) 

17 (3) ASSESSMENT.—Not later than 1 year after 

18 the establishment of the pilot open source functions 

19 described in paragraph (1), the Director, in coordi20 nation with the National Cyber Director, the Direc21 tor of the Cybersecurity and Infrastructure Security 

22 Agency, and the Administrator of General Services, 

23 shall assess whether open source functions should be 

24 established at some or all covered agencies, includ25 ing— 


pamtmann on DSKBC07HB2PROD with BILLS
19 

•S 4913 RS

1 (A) how to organize those functions within 

2 covered agencies, such as the creation of open 

3 source program offices; and 

4 (B) appropriate roles and responsibilities 

5 for those functions. 

6 (4) GUIDANCE.—If the Director determines, 

7 based on the assessment described in paragraph (3), 

8 that some or all of the open source functions should 

9 be established at some or all covered agencies, the 

10 Director, in coordination with the National Cyber 

11 Director, the Director of the Cybersecurity and In12 frastructure Security Agency, and the Administrator 

13 of General Services, shall issue guidance on the im14 plementation of those functions. 

15 (d) BRIEFING AND REPORT.—The Director shall— 

16 (1) not later than 1 year after the date of en17 actment of this Act, brief the appropriate congres18 sional committees on the guidance issued under sub19 section (b); and 

20 (2) not later than 540 days after the establish21 ment of the pilot open source functions under sub22 section (c)(1), submit to the appropriate congres23 sional committees a report on— 

24 (A) the pilot open source functions; and 


pamtmann on DSKBC07HB2PROD with BILLS
20 

•S 4913 RS

1 (B) the results of the assessment con2 ducted under subsection (c)(3). 

3 (e) DUTIES.—Section 3554(b) of title 44, United 

4 States Code, is amended— 

5 (1) in paragraph (7), by striking ‘‘and’’ at the 

6 end; 

7 (2) in paragraph (8), by striking the period at 

8 the end and inserting ‘‘; and’’; and 

9 (3) by adding at the end the following: 

10 ‘‘(9) plans and procedures to ensure the secure 

11 usage and development of software, including open 

12 source software.’’. 

13 SEC. 6. RULE OF CONSTRUCTION. 

14 Nothing in this Act or the amendments made by this 

15 Act shall be construed to provide any additional regulatory 

16 authority to any Federal agency described therein. 


pamtmann on DSKBC07HB2PROD with BILLS

pamtmann on DSKBC07HB2PROD with BILLS
Calendar No. 677 

117TH CONGRESS 

2D SESSION S. 4913 

[Report No. 117–278] 

A BILL 

To establish the duties of the Director of the Cyother purposes. regarding open source software security, and for bersecurity and Infrastructure Security Agency 

DECEMBER 19, 2022 

Reported with amendments 


pamtmann on DSKBC07HB2PROD with BILLS