II 

Calendar No. 39 

118TH CONGRESS 

1ST SESSION S. 933 

[Report No. 118–15] 

To amend the Carl Levin and Howard P. ‘‘Buck’’ McKeon National Defense 

Authorization Act for Fiscal Year 2015 to modify requirements relating 

to data centers of certain Federal agencies, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

MARCH 22, 2023 

Ms. ROSEN (for herself, Mr. CORNYN, and Mr. PETERS) introduced the following bill; which was read twice and referred to the Committee on 

Homeland Security and Governmental Affairs 

APRIL 27, 2023 

Reported by Mr. PETERS, without amendment 

A BILL 

To amend the Carl Levin and Howard P. ‘‘Buck’’ McKeon 

National Defense Authorization Act for Fiscal Year 2015 

to modify requirements relating to data centers of certain 

Federal agencies, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


pbinns on DSKJLVW7X2PROD with $$_JOB
2 

•S 933 RS

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Federal Data Center 

3 Enhancement Act of 2023’’. 

4 SEC. 2. FEDERAL DATA CENTER CONSOLIDATION INITIA5 TIVE AMENDMENTS. 

6 (a) FINDINGS.—Congress finds the following: 

7 (1) The statutory authorization for the Federal 

8 Data Center Optimization Initiative under section 

9 834 of the Carl Levin and Howard P. ‘‘Buck’’ 

10 McKeon National Defense Authorization Act for 

11 Fiscal Year 2015 (44 U.S.C. 3601 note; Public Law 

12 113–291) expires at the end of fiscal year 2022. 

13 (2) The expiration of the authorization de14 scribed in paragraph (1) presents Congress with an 

15 opportunity to review the objectives of the Federal 

16 Data Center Optimization Initiative to ensure that 

17 the initiative is meeting the current needs of the 

18 Federal Government. 

19 (3) The initial focus of the Federal Data Center 

20 Optimization Initiative, which was to consolidate 

21 data centers and create new efficiencies, has resulted 

22 in, since 2010— 

23 (A) the consolidation of more than 6,000 

24 Federal data centers; and 

25 (B) cost savings and avoidance of 

26 $5,800,000,000. 


pbinns on DSKJLVW7X2PROD with $$_JOB
3 

•S 933 RS

1 (4) The need of the Federal Government for ac2 cess to data and data processing systems has evolved 

3 since the date of enactment in 2014 of subtitle D of 

4 title VIII of the Carl Levin and Howard P. ‘‘Buck’’ 

5 McKeon National Defense Authorization Act for 

6 Fiscal Year 2015. 

7 (5) Federal agencies and employees involved in 

8 mission critical functions increasingly need reliable 

9 access to secure, reliable, sustainable, and protected 

10 facilities to house mission critical data and data op11 erations to meet the immediate needs of the people 

12 of the United States. 

13 (6) As of the date of enactment of this Act, 

14 there is a growing need for Federal agencies to use 

15 data centers and cloud applications that meet high 

16 standards for cybersecurity, resiliency, availability, 

17 and sustainability. 

18 (b) MINIMUM REQUIREMENTS FOR NEW DATA CEN19 TERS.—Section 834 of the Carl Levin and Howard P. 

20 ‘‘Buck’’ McKeon National Defense Authorization Act for 

21 Fiscal Year 2015 (44 U.S.C. 3601 note; Public Law 113– 

22 291) is amended— 

23 (1) in subsection (a), by striking paragraphs 

24 (3) and (4) and inserting the following: 


pbinns on DSKJLVW7X2PROD with $$_JOB
4 

•S 933 RS

1 ‘‘(3) NEW DATA CENTER.—The term ‘new data 

2 center’ means— 

3 ‘‘(A)(i) a data center or a portion thereof 

4 that is owned, operated, or maintained by a 

5 covered agency; or 

6 ‘‘(ii) to the extent practicable, a data cen7 ter or portion thereof— 

8 ‘‘(I) that is owned, operated, or main9 tained by a contractor on behalf of a cov10 ered agency on the date on which the con11 tract between the covered agency and the 

12 contractor expires; and 

13 ‘‘(II) with respect to which the cov14 ered agency extends the contract, or enters 

15 into a new contract, with the contractor; 

16 and 

17 ‘‘(B) on or after the date that is 180 days 

18 after the date of enactment of the Federal Data 

19 Center Enhancement Act of 2023, a data cen20 ter or portion thereof that is— 

21 ‘‘(i) established; or 

22 ‘‘(ii) substantially upgraded or ex23 panded.’’; 

24 (2) by striking subsection (b) and inserting the 

25 following: 


pbinns on DSKJLVW7X2PROD with $$_JOB
5 

•S 933 RS

1 ‘‘(b) MINIMUM REQUIREMENTS FOR NEW DATA

2 CENTERS.— 

3 ‘‘(1) IN GENERAL.—Not later than 180 days 

4 after the date of enactment of the Federal Data 

5 Center Enhancement Act of 2023, the Administrator 

6 shall establish minimum requirements for new data 

7 centers in consultation with the Administrator of 

8 General Services and the Federal Chief Information 

9 Officers Council. 

10 ‘‘(2) CONTENTS.— 

11 ‘‘(A) IN GENERAL.—The minimum re12 quirements established under paragraph (1) 

13 shall include requirements relating to— 

14 ‘‘(i) the availability of new data cen15 ters; 

16 ‘‘(ii) the use of new data centers; 

17 ‘‘(iii) the use of sustainable energy 

18 sources; 

19 ‘‘(iv) uptime percentage; 

20 ‘‘(v) protections against power fail21 ures, including on-site energy generation 

22 and access to multiple transmission paths; 

23 ‘‘(vi) protections against physical in24 trusions and natural disasters; 


pbinns on DSKJLVW7X2PROD with $$_JOB
6 

•S 933 RS

1 ‘‘(vii) information security protections 

2 required by subchapter II of chapter 35 of 

3 title 44, United States Code, and other ap4 plicable law and policy; and 

5 ‘‘(viii) any other requirements the Ad6 ministrator determines appropriate. 

7 ‘‘(B) CONSULTATION.—In establishing the 

8 requirements described in subparagraph 

9 (A)(vii), the Administrator shall consult with 

10 the Director of the Cybersecurity and Infra11 structure Security Agency and the National 

12 Cyber Director. 

13 ‘‘(3) INCORPORATION OF MINIMUM REQUIRE14 MENTS INTO CURRENT DATA CENTERS.—As soon as 

15 practicable, and in any case not later than 90 days 

16 after the Administrator establishes the minimum re17 quirements pursuant to paragraph (1), the Adminis18 trator shall issue guidance to ensure, as appropriate, 

19 that covered agencies incorporate the minimum re20 quirements established under that paragraph into 

21 the operations of any data center of a covered agen22 cy existing as of the date of enactment of the Fed23 eral Data Center Enhancement Act of 2023. 

24 ‘‘(4) REVIEW OF REQUIREMENTS.—The Admin25 istrator, in consultation with the Administrator of 


pbinns on DSKJLVW7X2PROD with $$_JOB
7 

•S 933 RS

1 General Services and the Federal Chief Information 

2 Officers Council, shall review, update, and modify 

3 the minimum requirements established under para4 graph (1), as necessary. 

5 ‘‘(5) REPORT ON NEW DATA CENTERS.—During 

6 the development and planning lifecycle of a new data 

7 center, if the head of a covered agency determines 

8 that the covered agency is likely to make a manage9 ment or financial decision relating to any data cen10 ter, the head of the covered agency shall— 

11 ‘‘(A) notify— 

12 ‘‘(i) the Administrator; 

13 ‘‘(ii) Committee on Homeland Secu14 rity and Governmental Affairs of the Sen15 ate; and 

16 ‘‘(iii) Committee on Oversight and Ac17 countability of the House of Representa18 tives; and 

19 ‘‘(B) describe in the notification with suffi20 cient detail how the covered agency intends to 

21 comply with the minimum requirements estab22 lished under paragraph (1). 

23 ‘‘(6) USE OF TECHNOLOGY.—In determining 

24 whether to establish or continue to operate an exist25 ing data center, the head of a covered agency shall— 


pbinns on DSKJLVW7X2PROD with $$_JOB
8 

•S 933 RS

1 ‘‘(A) regularly assess the application port2 folio of the covered agency and ensure that each 

3 at-risk legacy application is updated, replaced, 

4 or modernized, as appropriate, to take advan5 tage of modern technologies; and 

6 ‘‘(B) prioritize and, to the greatest extent 

7 possible, leverage commercial cloud environ8 ments rather than acquiring, overseeing, or 

9 managing custom data center infrastructure. 

10 ‘‘(7) PUBLIC WEBSITE.— 

11 ‘‘(A) IN GENERAL.—The Administrator 

12 shall maintain a public-facing website that in13 cludes information, data, and explanatory state14 ments relating to the compliance of covered 

15 agencies with the requirements of this section. 

16 ‘‘(B) PROCESSES AND PROCEDURES.—In 

17 maintaining the website described in subpara18 graph (A), the Administrator shall— 

19 ‘‘(i) ensure covered agencies regularly, 

20 and not less frequently than biannually, 

21 update the information, data, and explana22 tory statements posed on the website, pur23 suant to guidance issued by the Adminis24 trator, relating to any new data centers 


pbinns on DSKJLVW7X2PROD with $$_JOB
9 

•S 933 RS

1 and, as appropriate, each existing data 

2 center of the covered agency; and 

3 ‘‘(ii) ensure that all information, data, 

4 and explanatory statements on the website 

5 are maintained as open Government data 

6 assets.’’; and 

7 (3) in subsection (c), by striking paragraph (1) 

8 and inserting the following: 

9 ‘‘(1) IN GENERAL.—The head of a covered 

10 agency shall oversee and manage the data center 

11 portfolio and the information technology strategy of 

12 the covered agency in accordance with Federal cy13 bersecurity guidelines and directives, including— 

14 ‘‘(A) information security standards and 

15 guidelines promulgated by the Director of the 

16 National Institute of Standards and Tech17 nology; 

18 ‘‘(B) applicable requirements and guidance 

19 issued by the Director of the Office of Manage20 ment and Budget pursuant to section 3614 of 

21 title 44, United States Code; and 

22 ‘‘(C) directives issued by the Secretary of 

23 Homeland Security under section 3553 of title 

24 44, United States Code.’’. 


pbinns on DSKJLVW7X2PROD with $$_JOB
10 

•S 933 RS

1 (c) EXTENSION OF SUNSET.—Section 834(e) of the 

2 Carl Levin and Howard P. ‘‘Buck’’ McKeon National De3 fense Authorization Act for Fiscal Year 2015 (44 U.S.C. 

4 3601 note; Public Law 113–291) is amended by striking 

5 ‘‘2022’’ and inserting ‘‘2026’’. 

6 (d) GAO REVIEW.—Not later than 1 year after the 

7 date of the enactment of this Act, and annually thereafter, 

8 the Comptroller General of the United States shall review, 

9 verify, and audit the compliance of covered agencies with 

10 the minimum requirements established pursuant to section 

11 834(b)(1) of the Carl Levin and Howard P. ‘‘Buck’’ 

12 McKeon National Defense Authorization Act for Fiscal 

13 Year 2015 (44 U.S.C. 3601 note; Public Law 113–291) 

14 for new data centers and subsection (b)(3) of that Act for 

15 existing data centers, as appropriate. 


pbinns on DSKJLVW7X2PROD with $$_JOB

pbinns on DSKJLVW7X2PROD with $$_JOB
Calendar No. 39 

118TH CONGRESS 

1ST SESSION S. 933 

[Report No. 118–15] 

A BILL 

To amend the Carl Levin and Howard P. ‘‘Buck’’ 

for other purposes. to data centers of certain Federal agencies, and Fiscal Year 2015 to modify requirements relating McKeon National Defense Authorization Act for 

APRIL 27, 2023 

Reported without amendment 


pbinns on DSKJLVW7X2PROD with $$_JOB