II 

Calendar No. 562 

117TH CONGRESS 

2D SESSION S. 4629 

[Report No. 117–210] 

To amend the Carl Levin and Howard P. ‘‘Buck’’ McKeon National Defense 

Authorization Act for Fiscal Year 2015 to modify requirements relating 

to data centers of certain Federal agencies, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JULY 27, 2022 

Ms. ROSEN (for herself, Mr. CORNYN, and Mr. PETERS) introduced the following bill; which was read twice and referred to the Committee on 

Homeland Security and Governmental Affairs 

NOVEMBER 17, 2022 

Reported by Mr. PETERS, with amendments 

[Omit the part struck through and insert the part printed in italic] 

A BILL 

To amend the Carl Levin and Howard P. ‘‘Buck’’ McKeon 

National Defense Authorization Act for Fiscal Year 2015 

to modify requirements relating to data centers of certain 

Federal agencies, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


pbinns on DSKJLVW7X2PROD with $$_JOB
2 

•S 4629 RS

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Federal Data Center 

3 Enhancement Act of 2022’’. 

4 SEC. 2. FEDERAL DATA CENTER CONSOLIDATION INITIA5 TIVE AMENDMENTS. 

6 (a) FINDINGS.—Congress finds the following: 

7 (1) The statutory authorization for the Federal 

8 Data Center Optimization Initiative under section 

9 834 of the Carl Levin and Howard P. ‘‘Buck’’ 

10 McKeon National Defense Authorization Act for 

11 Fiscal Year 2015 (44 U.S.C. 3601 note; Public Law 

12 113–291) expires at the end of fiscal year 2022. 

13 (2) The expiration of the authorization de14 scribed in paragraph (1) presents Congress with an 

15 opportunity to review the objectives of the Federal 

16 Data Center Optimization Initiative to ensure that 

17 the initiative is meeting the current needs of the 

18 Federal Government. 

19 (3) The initial focus of the Federal Data Center 

20 Optimization Initiative, which was to consolidate 

21 data centers and create new efficiencies, has resulted 

22 in, since 2010— 

23 (A) the consolidation of more than 6,000 

24 Federal data centers; and 

25 (B) cost savings and avoidance of 

26 $5,800,000,000. 


pbinns on DSKJLVW7X2PROD with $$_JOB
3 

•S 4629 RS

1 (4) The need of the Federal Government for ac2 cess to data and data processing systems has evolved 

3 since the date of enactment in 2014 of subtitle D of 

4 title VIII of the Carl Levin and Howard P. ‘‘Buck’’ 

5 McKeon National Defense Authorization Act for 

6 Fiscal Year 2015. 

7 (5) Federal agencies and employees involved in 

8 mission critical functions increasingly need reliable 

9 access to secure, reliable, sustainable, and protected 

10 facilities to house mission critical data and data op11 erations to meet the immediate needs of the people 

12 of the United States. 

13 (6) As of the date of enactment of this Act, 

14 there is a growing need for Federal agencies to use 

15 data centers and cloud applications that meet high 

16 standards for cybersecurity, resiliency, availability, 

17 and sustainability. 

18 (b) MINIMUM REQUIREMENTS FOR NEW DATA CEN19 TERS.—Section 834 of the Carl Levin and Howard P. 

20 ‘‘Buck’’ McKeon National Defense Authorization Act for 

21 Fiscal Year 2015 (44 U.S.C. 3601 note; Public Law 113– 

22 291) is amended— 

23 (1) in subsection (a), by striking paragraphs 

24 (3) and (4) and inserting the following: 


pbinns on DSKJLVW7X2PROD with $$_JOB
4 

•S 4629 RS

1 ‘‘(3) NEW DATA CENTER.—The term ‘new data 

2 center’ means a— 

3 ‘‘(A)(i) a data center or a portion thereof 

4 that is owned, operated, or maintained by a 

5 covered agency; or 

6 ‘‘(ii) to the extent practicable, a data cen7 ter or portion thereof— 

8 ‘‘(I) that is owned, operated, or main9 tained by a contractor on behalf of a cov10 ered agency on the date on which the con11 tract between the covered agency and the 

12 contractor expires; and 

13 ‘‘(II) with respect to which the cov14 ered agency extends the contract, or enters 

15 into a new contract, with the contractor; 

16 and 

17 ‘‘(B) on or after the date that is 180 days 

18 after the date of enactment of the Federal Data 

19 Center Enhancement Act of 2022, a data center 

20 or portion thereof that is— 

21 ‘‘(i) established; or 

22 ‘‘(ii) substantially upgraded or ex23 panded.’’; 

24 (2) by striking subsection (b) and inserting the 

25 following: 


pbinns on DSKJLVW7X2PROD with $$_JOB
5 

•S 4629 RS

1 ‘‘(b) MINIMUM REQUIREMENTS FOR NEW DATA

2 CENTERS.— 

3 ‘‘(1) IN GENERAL.—Not later than 180 days 

4 after the date of enactment of the Federal Data 

5 Center Enhancement Act of 2022, the Administrator 

6 shall establish minimum requirements for new data 

7 centers in consultation with the Administrator of 

8 General Services and the Federal Chief Information 

9 Officers Council. 

10 ‘‘(2) CONTENTS.— 

11 ‘‘(A) IN GENERAL.—The minimum re12 quirements established under paragraph (1) 

13 shall include requirements relating to— 

14 ‘‘(i) the availability of new data cen15 ters; 

16 ‘‘(ii) the use of new data centers; 

17 ‘‘(iii) the use of sustainable energy 

18 sources; 

19 ‘‘(iv) uptime percentage; 

20 ‘‘(v) protections against power fail21 ures, including on-site energy generation 

22 and access to multiple transmission paths; 

23 ‘‘(vi) protections against physical in24 trusions and natural disasters; 


pbinns on DSKJLVW7X2PROD with $$_JOB
6 

•S 4629 RS

1 ‘‘(vii) information security protections 

2 required by subchapter II of chapter 35 of 

3 title 44, United States Code, and other ap4 plicable law and policy; and 

5 ‘‘(viii) any other requirements the Ad6 ministrator determines appropriate. 

7 ‘‘(B) CONSULTATION.—In establishing the 

8 requirements described in subparagraph 

9 (A)(vii), the Administrator shall consult with 

10 the Director of the Cybersecurity and Infra11 structure Security Agency and the National 

12 Cyber Director. 

13 ‘‘(3) USE OF EXISTING STANDARDS.—The Ad14 ministrator may incorporate the minimum require15 ments established under paragraph (1) into the ap16 propriate requirements of any agency data center ex17 isting as of the date of enactment of the Federal 

18 Data Center Enhancement Act of 2022. 

19 ‘‘(4) REVIEW OF STANDARDS.—The Adminis20 trator, in consultation with the Administrator of 

21 General Services and the Federal Chief Information 

22 Officers Council, shall review, update, and modify 

23 the minimum requirements established under para24 graph (1), as necessary. 


pbinns on DSKJLVW7X2PROD with $$_JOB
7 

•S 4629 RS

1 ‘‘(5) REPORT ON NEW DATA CENTERS.—During 

2 the development and planning lifecycle of a new data 

3 center, if the head of a covered agency determines 

4 that the covered agency is likely to make a manage5 ment or financial decision relating to the new data 

6 center, the head of the covered agency shall— 

7 ‘‘(A) notify— 

8 ‘‘(i) the Administrator; 

9 ‘‘(ii) Committee on Homeland Secu10 rity and Governmental Affairs of the Sen11 ate; and 

12 ‘‘(iii) Committee on Oversight and Re13 form of the House of Representatives; and 

14 ‘‘(B) describe in the notification with suffi15 cient detail how the covered agency intends to 

16 comply with the minimum requirements estab17 lished under paragraph (1). 

18 ‘‘(6) USE OF TECHNOLOGY.—In determining 

19 whether to establish or continue to operate a data 

20 center, the head of a covered agency shall— 

21 ‘‘(A) regularly assess the application port22 folio of the covered agency and ensure that each 

23 legacy application is updated, replaced, or mod24 ernized, as appropriate, to take advantage of 

25 modern technologies; and 


pbinns on DSKJLVW7X2PROD with $$_JOB
8 

•S 4629 RS

1 ‘‘(B) prioritize and, to the greatest extent 

2 possible, leverage commercial cloud environ3 ments rather than acquiring, overseeing, or 

4 managing custom data center infrastructure.’’; 

5 and 

6 (3) in subsection (c), by striking paragraph (1) 

7 and inserting the following: 

8 ‘‘(1) IN GENERAL.—The head of a covered 

9 agency shall oversee and manage the data center 

10 portfolio and the information technology strategy of 

11 the covered agency in accordance with Federal cy12 bersecurity guidelines and directives, including— 

13 ‘‘(A) information security standards and 

14 guidelines promulgated by the Director of the 

15 National Institute of Standards and Tech16 nology; 

17 ‘‘(B) applicable provisions found within the 

18 Federal Risk and Authorization Management 

19 Program; and 

20 ‘‘(C) directives issued by the Secretary of 

21 Homeland Security under section 3553 of title 

22 44, United States Code.’’. 

23 (c) EXTENSION OF SUNSET.—Section 834(e) of the 

24 Carl Levin and Howard P. ‘‘Buck’’ McKeon National De25 fense Authorization Act for Fiscal Year 2015 (44 U.S.C. 


pbinns on DSKJLVW7X2PROD with $$_JOB
9 

•S 4629 RS

1 3601 note; Public Law 113–291) is amended by striking 

2 ‘‘2022’’ and inserting ‘‘2025’’. 


pbinns on DSKJLVW7X2PROD with $$_JOB
Calendar No. 562 

117TH CONGRESS 

2D SESSION S. 4629 

[Report No. 117–210] 

A BILL 

To amend the Carl Levin and Howard P. ‘‘Buck’’ 

for other purposes. to data centers of certain Federal agencies, and Fiscal Year 2015 to modify requirements relating McKeon National Defense Authorization Act for 

NOVEMBER 17, 2022 

Reported with amendments 


pbinns on DSKJLVW7X2PROD with $$_JOB