II 

118TH CONGRESS 

1ST SESSION S. 933 

To amend the Carl Levin and Howard P. ‘‘Buck’’ McKeon National Defense 

Authorization Act for Fiscal Year 2015 to modify requirements relating 

to data centers of certain Federal agencies, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

MARCH 22, 2023 

Ms. ROSEN (for herself, Mr. CORNYN, and Mr. PETERS) introduced the following bill; which was read twice and referred to the Committee on 

Homeland Security and Governmental Affairs 

A BILL 

To amend the Carl Levin and Howard P. ‘‘Buck’’ McKeon 

National Defense Authorization Act for Fiscal Year 2015 

to modify requirements relating to data centers of certain 

Federal agencies, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Federal Data Center 

5 Enhancement Act of 2023’’. 

6 SEC. 2. FEDERAL DATA CENTER CONSOLIDATION INITIA7 TIVE AMENDMENTS. 

8 (a) FINDINGS.—Congress finds the following: 


pbinns on DSKJLVW7X2PROD with $$_JOB
2 

•S 933 IS

1 (1) The statutory authorization for the Federal 

2 Data Center Optimization Initiative under section 

3 834 of the Carl Levin and Howard P. ‘‘Buck’’ 

4 McKeon National Defense Authorization Act for 

5 Fiscal Year 2015 (44 U.S.C. 3601 note; Public Law 

6 113–291) expires at the end of fiscal year 2022. 

7 (2) The expiration of the authorization de8 scribed in paragraph (1) presents Congress with an 

9 opportunity to review the objectives of the Federal 

10 Data Center Optimization Initiative to ensure that 

11 the initiative is meeting the current needs of the 

12 Federal Government. 

13 (3) The initial focus of the Federal Data Center 

14 Optimization Initiative, which was to consolidate 

15 data centers and create new efficiencies, has resulted 

16 in, since 2010— 

17 (A) the consolidation of more than 6,000 

18 Federal data centers; and 

19 (B) cost savings and avoidance of 

20 $5,800,000,000. 

21 (4) The need of the Federal Government for ac22 cess to data and data processing systems has evolved 

23 since the date of enactment in 2014 of subtitle D of 

24 title VIII of the Carl Levin and Howard P. ‘‘Buck’’ 


pbinns on DSKJLVW7X2PROD with $$_JOB
3 

•S 933 IS

1 McKeon National Defense Authorization Act for 

2 Fiscal Year 2015. 

3 (5) Federal agencies and employees involved in 

4 mission critical functions increasingly need reliable 

5 access to secure, reliable, sustainable, and protected 

6 facilities to house mission critical data and data op7 erations to meet the immediate needs of the people 

8 of the United States. 

9 (6) As of the date of enactment of this Act, 

10 there is a growing need for Federal agencies to use 

11 data centers and cloud applications that meet high 

12 standards for cybersecurity, resiliency, availability, 

13 and sustainability. 

14 (b) MINIMUM REQUIREMENTS FOR NEW DATA CEN15 TERS.—Section 834 of the Carl Levin and Howard P. 

16 ‘‘Buck’’ McKeon National Defense Authorization Act for 

17 Fiscal Year 2015 (44 U.S.C. 3601 note; Public Law 113– 

18 291) is amended— 

19 (1) in subsection (a), by striking paragraphs 

20 (3) and (4) and inserting the following: 

21 ‘‘(3) NEW DATA CENTER.—The term ‘new data 

22 center’ means— 

23 ‘‘(A)(i) a data center or a portion thereof 

24 that is owned, operated, or maintained by a 

25 covered agency; or 


pbinns on DSKJLVW7X2PROD with $$_JOB
4 

•S 933 IS

1 ‘‘(ii) to the extent practicable, a data cen2 ter or portion thereof— 

3 ‘‘(I) that is owned, operated, or main4 tained by a contractor on behalf of a cov5 ered agency on the date on which the con6 tract between the covered agency and the 

7 contractor expires; and 

8 ‘‘(II) with respect to which the cov9 ered agency extends the contract, or enters 

10 into a new contract, with the contractor; 

11 and 

12 ‘‘(B) on or after the date that is 180 days 

13 after the date of enactment of the Federal Data 

14 Center Enhancement Act of 2023, a data cen15 ter or portion thereof that is— 

16 ‘‘(i) established; or 

17 ‘‘(ii) substantially upgraded or ex18 panded.’’; 

19 (2) by striking subsection (b) and inserting the 

20 following: 

21 ‘‘(b) MINIMUM REQUIREMENTS FOR NEW DATA

22 CENTERS.— 

23 ‘‘(1) IN GENERAL.—Not later than 180 days 

24 after the date of enactment of the Federal Data 

25 Center Enhancement Act of 2023, the Administrator 


pbinns on DSKJLVW7X2PROD with $$_JOB
5 

•S 933 IS

1 shall establish minimum requirements for new data 

2 centers in consultation with the Administrator of 

3 General Services and the Federal Chief Information 

4 Officers Council. 

5 ‘‘(2) CONTENTS.— 

6 ‘‘(A) IN GENERAL.—The minimum re7 quirements established under paragraph (1) 

8 shall include requirements relating to— 

9 ‘‘(i) the availability of new data cen10 ters; 

11 ‘‘(ii) the use of new data centers; 

12 ‘‘(iii) the use of sustainable energy 

13 sources; 

14 ‘‘(iv) uptime percentage; 

15 ‘‘(v) protections against power fail16 ures, including on-site energy generation 

17 and access to multiple transmission paths; 

18 ‘‘(vi) protections against physical in19 trusions and natural disasters; 

20 ‘‘(vii) information security protections 

21 required by subchapter II of chapter 35 of 

22 title 44, United States Code, and other ap23 plicable law and policy; and 

24 ‘‘(viii) any other requirements the Ad25 ministrator determines appropriate. 


pbinns on DSKJLVW7X2PROD with $$_JOB
6 

•S 933 IS

1 ‘‘(B) CONSULTATION.—In establishing the 

2 requirements described in subparagraph 

3 (A)(vii), the Administrator shall consult with 

4 the Director of the Cybersecurity and Infra5 structure Security Agency and the National 

6 Cyber Director. 

7 ‘‘(3) INCORPORATION OF MINIMUM REQUIRE8 MENTS INTO CURRENT DATA CENTERS.—As soon as 

9 practicable, and in any case not later than 90 days 

10 after the Administrator establishes the minimum re11 quirements pursuant to paragraph (1), the Adminis12 trator shall issue guidance to ensure, as appropriate, 

13 that covered agencies incorporate the minimum re14 quirements established under that paragraph into 

15 the operations of any data center of a covered agen16 cy existing as of the date of enactment of the Fed17 eral Data Center Enhancement Act of 2023. 

18 ‘‘(4) REVIEW OF REQUIREMENTS.—The Admin19 istrator, in consultation with the Administrator of 

20 General Services and the Federal Chief Information 

21 Officers Council, shall review, update, and modify 

22 the minimum requirements established under para23 graph (1), as necessary. 

24 ‘‘(5) REPORT ON NEW DATA CENTERS.—During 

25 the development and planning lifecycle of a new data 


pbinns on DSKJLVW7X2PROD with $$_JOB
7 

•S 933 IS

1 center, if the head of a covered agency determines 

2 that the covered agency is likely to make a manage3 ment or financial decision relating to any data cen4 ter, the head of the covered agency shall— 

5 ‘‘(A) notify— 

6 ‘‘(i) the Administrator; 

7 ‘‘(ii) Committee on Homeland Secu8 rity and Governmental Affairs of the Sen9 ate; and 

10 ‘‘(iii) Committee on Oversight and Ac11 countability of the House of Representa12 tives; and 

13 ‘‘(B) describe in the notification with suffi14 cient detail how the covered agency intends to 

15 comply with the minimum requirements estab16 lished under paragraph (1). 

17 ‘‘(6) USE OF TECHNOLOGY.—In determining 

18 whether to establish or continue to operate an exist19 ing data center, the head of a covered agency shall— 

20 ‘‘(A) regularly assess the application port21 folio of the covered agency and ensure that each 

22 at-risk legacy application is updated, replaced, 

23 or modernized, as appropriate, to take advan24 tage of modern technologies; and 


pbinns on DSKJLVW7X2PROD with $$_JOB
8 

•S 933 IS

1 ‘‘(B) prioritize and, to the greatest extent 

2 possible, leverage commercial cloud environ3 ments rather than acquiring, overseeing, or 

4 managing custom data center infrastructure. 

5 ‘‘(7) PUBLIC WEBSITE.— 

6 ‘‘(A) IN GENERAL.—The Administrator 

7 shall maintain a public-facing website that in8 cludes information, data, and explanatory state9 ments relating to the compliance of covered 

10 agencies with the requirements of this section. 

11 ‘‘(B) PROCESSES AND PROCEDURES.—In 

12 maintaining the website described in subpara13 graph (A), the Administrator shall— 

14 ‘‘(i) ensure covered agencies regularly, 

15 and not less frequently than biannually, 

16 update the information, data, and explana17 tory statements posed on the website, pur18 suant to guidance issued by the Adminis19 trator, relating to any new data centers 

20 and, as appropriate, each existing data 

21 center of the covered agency; and 

22 ‘‘(ii) ensure that all information, data, 

23 and explanatory statements on the website 

24 are maintained as open Government data 

25 assets.’’; and 


pbinns on DSKJLVW7X2PROD with $$_JOB
9 

•S 933 IS

1 (3) in subsection (c), by striking paragraph (1) 

2 and inserting the following: 

3 ‘‘(1) IN GENERAL.—The head of a covered 

4 agency shall oversee and manage the data center 

5 portfolio and the information technology strategy of 

6 the covered agency in accordance with Federal cy7 bersecurity guidelines and directives, including— 

8 ‘‘(A) information security standards and 

9 guidelines promulgated by the Director of the 

10 National Institute of Standards and Tech11 nology; 

12 ‘‘(B) applicable requirements and guidance 

13 issued by the Director of the Office of Manage14 ment and Budget pursuant to section 3614 of 

15 title 44, United States Code; and 

16 ‘‘(C) directives issued by the Secretary of 

17 Homeland Security under section 3553 of title 

18 44, United States Code.’’. 

19 (c) EXTENSION OF SUNSET.—Section 834(e) of the 

20 Carl Levin and Howard P. ‘‘Buck’’ McKeon National De21 fense Authorization Act for Fiscal Year 2015 (44 U.S.C. 

22 3601 note; Public Law 113–291) is amended by striking 

23 ‘‘2022’’ and inserting ‘‘2026’’. 

24 (d) GAO REVIEW.—Not later than 1 year after the 

25 date of the enactment of this Act, and annually thereafter, 


pbinns on DSKJLVW7X2PROD with $$_JOB
10 

•S 933 IS

1 the Comptroller General of the United States shall review, 

2 verify, and audit the compliance of covered agencies with 

3 the minimum requirements established pursuant to section 

4 834(b)(1) of the Carl Levin and Howard P. ‘‘Buck’’ 

5 McKeon National Defense Authorization Act for Fiscal 

6 Year 2015 (44 U.S.C. 3601 note; Public Law 113–291) 

7 for new data centers and subsection (b)(3) of that Act for 

8 existing data centers, as appropriate. 

Æ 


pbinns on DSKJLVW7X2PROD with $$_JOB