II 

Calendar No. 76 

118TH CONGRESS 

1ST SESSION S. 917 

[Report No. 118–32] 

To establish the duties of the Director of the Cybersecurity and Infrastructure 

Security Agency regarding open source software security, and for other 

purposes. 

IN THE SENATE OF THE UNITED STATES 

MARCH 22, 2023 

Mr. PETERS (for himself and Mr. HAWLEY) introduced the following bill; 

which was read twice and referred to the Committee on Homeland Security and Governmental Affairs 

MAY 16, 2023 

Reported by Mr. PETERS, with amendments 

[Omit the part struck through and insert the part printed in italic] 

A BILL 

To establish the duties of the Director of the Cybersecurity 

and Infrastructure Security Agency regarding open 

source software security, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


kjohnson on DSK79L0C42PROD with BILLS
2 

•S 917 RS

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Securing Open Source 

3 Software Act of 2023’’. 

4 SEC. 2. FINDINGS. 

5 Congress finds that— 

6 (1) open source software fosters technology de7 velopment and is an integral part of overall cyberse8 curity; 

9 (2) a secure, healthy, vibrant, and resilient open 

10 source software ecosystem is crucial for ensuring the 

11 national security and economic vitality of the United 

12 States; 

13 (3) open source software is part of the founda14 tion of digital infrastructure that promotes a free 

15 and open internet; 

16 (4) due to both the unique strengths of open 

17 source software and inconsistent historical invest18 ment in open source software security, there exist 

19 unique challenges in securing open source software; 

20 and 

21 (5) the Federal Government should play a sup22 porting role in ensuring the long-term security of 

23 open source software. 

24 SEC. 3. OPEN SOURCE SOFTWARE SECURITY DUTIES. 

25 (a) IN GENERAL.—Title XXII of the Homeland Se26 curity Act of 2002 (6 U.S.C. 650 et seq.) is amended— 


kjohnson on DSK79L0C42PROD with BILLS
3 

•S 917 RS

1 (1) in section 2200 (6 U.S.C. 650)— 

2 (A) by redesignating paragraphs (22) 

3 through (28) as paragraphs (25) through (31), 

4 respectively; and 

5 (B) by inserting after paragraph (21) the 

6 following: 

7 ‘‘(22) OPEN SOURCE SOFTWARE.—The term 

8 ‘open source software’ means software for which the 

9 human-readable source code is made available to the 

10 public for use, study, re-use, modification, enhance11 ment, and re-distribution. 

12 ‘‘(23) OPEN SOURCE SOFTWARE COMMUNITY.— 

13 The term ‘open source software community’ means 

14 the community of individuals, foundations, nonprofit 

15 organizations, corporations, and other entities 

16 that— 

17 ‘‘(A) develop, contribute to, maintain, and 

18 publish open source software; or 

19 ‘‘(B) otherwise work to ensure the security 

20 of the open source software ecosystem. 

21 ‘‘(24) OPEN SOURCE SOFTWARE COMPONENT.— 

22 The term ‘open source software component’ means 

23 an individual repository of open source software that 

24 is made available to the public.’’; 

25 (2) in section 2202(c) (6 U.S.C. 652(c))— 


kjohnson on DSK79L0C42PROD with BILLS
4 

•S 917 RS

1 (A) in paragraph (13), by striking ‘‘and’’ 

2 at the end; 

3 (B) by redesignating paragraph (14) as 

4 paragraph (15); and 

5 (C) by inserting after paragraph (13) the 

6 following: 

7 ‘‘(14) support, including by offering services, 

8 the secure usage and deployment of software, includ9 ing open source software, in the software develop10 ment lifecycle at Federal agencies in accordance with 

11 section 2220E section 2220F; and’’; and 

12 (3) by adding at the end the following: 

13 ‘‘SEC. 2220F. OPEN SOURCE SOFTWARE SECURITY DUTIES. 

14 ‘‘(a) DEFINITION.—In this section, the term ‘soft15 ware bill of materials’ has the meaning given the term in 

16 the Minimum Elements for a Software Bill of Materials 

17 published by the Department of Commerce, or any super18 seding definition published by the Agency. 

19 ‘‘(b) EMPLOYMENT.—The Director shall, to the 

20 greatest extent practicable, employ individuals in the 

21 Agency who— 

22 ‘‘(1) have expertise and experience participating 

23 in the open source software community; and 

24 ‘‘(2) perform the duties described in subsection 

25 (c). 


kjohnson on DSK79L0C42PROD with BILLS
5 

•S 917 RS

1 ‘‘(c) DUTIES OF THE DIRECTOR.— 

2 ‘‘(1) IN GENERAL.—The Director shall— 

3 ‘‘(A) perform outreach and engagement to 

4 bolster the security of open source software; 

5 ‘‘(B) support Federal efforts to strengthen 

6 the security of open source software; 

7 ‘‘(C) coordinate, as appropriate, with non8 Federal entities on efforts to ensure the long9 term security of open source software; 

10 ‘‘(D) serve as a public point of contact re11 garding the security of open source software for 

12 non-Federal entities, including State, local, 

13 Tribal, and territorial partners, the private sec14 tor, international partners, open source soft15 ware organizations, and open source software 

16 developers and the open source software commu17 nity; and 

18 ‘‘(E) support Federal and non-Federal 

19 supply chain security efforts by encouraging ef20 forts to bolster open source software security, 

21 such as— 

22 ‘‘(i) assisting in coordinated vulner23 ability disclosures in open source software 

24 components pursuant to section 2209(n); 

25 and 


kjohnson on DSK79L0C42PROD with BILLS
6 

•S 917 RS

1 ‘‘(ii) supporting the activities of the 

2 Federal Acquisition Security Council. 

3 ‘‘(2) ASSESSMENT OF CRITICAL OPEN SOURCE

4 SOFTWARE COMPONENTS.— 

5 ‘‘(A) FRAMEWORK.—Not later than 1 year 

6 after the date of enactment of this section, the 

7 Director shall publicly publish a framework, in8 corporating government, industry, and open 

9 source software community frameworks and 

10 best practices, including those published by the 

11 National Institute of Standards and Tech12 nology, for assessing the risk of open source 

13 software components, including direct and indi14 rect open source software dependencies, which 

15 shall incorporate, at a minimum— 

16 ‘‘(i) the security properties of code in 

17 a given open source software component, 

18 such as whether the code is written in a 

19 memory-safe programming language; 

20 ‘‘(ii) the security practices of develop21 ment, build, and release processes of a 

22 given open source software component, 

23 such as the use of multi-factor authentica24 tion by maintainers and cryptographic 

25 signing of releases; 


kjohnson on DSK79L0C42PROD with BILLS
7 

•S 917 RS

1 ‘‘(iii) the number and severity of pub2 licly known, unpatched vulnerabilities in a 

3 given open source software component; 

4 ‘‘(iv) the breadth of deployment of a 

5 given open source software component; 

6 ‘‘(v) the level of risk associated with 

7 where a given open source software compo8 nent is integrated or deployed, such as 

9 whether the component operates on a net10 work boundary or in a privileged location; 

11 and 

12 ‘‘(vi) the health of the open source 

13 software community for a given open 

14 source software component, including, 

15 where applicable, the level of current and 

16 historical investment and maintenance in 

17 the open source software component, such 

18 as the number and activity of individual 

19 maintainers. 

20 ‘‘(B) UPDATING FRAMEWORK.—Not less 

21 frequently than annually after the date on 

22 which the framework is published under sub23 paragraph (A), the Director shall— 

24 ‘‘(i) determine whether updates are 

25 needed to the framework described in subVerDate Sep 11 2014 00:05 May 17, 2023 Jkt 039200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S917.RS S917

kjohnson on DSK79L0C42PROD with BILLS
8 

•S 917 RS

1 paragraph (A), including the augmenta2 tion, addition, or removal of the elements 

3 described in clauses (i) through (vi) of 

4 such subparagraph; and 

5 ‘‘(ii) if the Director determines that 

6 additional updates are needed under clause 

7 (i), make those updates to the framework. 

8 ‘‘(C) DEVELOPING FRAMEWORK.—In de9 veloping the framework described in subpara10 graph (A), the Director shall consult with— 

11 ‘‘(i) appropriate Federal agencies, in12 cluding the National Institute of Standards 

13 and Technology; 

14 ‘‘(ii) individuals and nonprofit organi15 zations from the open source software com16 munity; and 

17 ‘‘(iii) private companies from the open 

18 source software community. 

19 ‘‘(D) USABILITY.—The Director shall en20 sure, to the greatest extent practicable, that the 

21 framework described in subparagraph (A) is us22 able by the open source software community, 

23 including through the consultation described in 

24 subparagraph (C). 


kjohnson on DSK79L0C42PROD with BILLS
9 

•S 917 RS

1 ‘‘(E) FEDERAL OPEN SOURCE SOFTWARE

2 ASSESSMENT.—Not later than 1 year after the 

3 publication of the framework described in sub4 paragraph (A), and not less frequently than 

5 every 2 years thereafter, the Director shall, to 

6 the greatest extent practicable and using the 

7 framework described in subparagraph (A)— 

8 ‘‘(i) perform an assessment of open 

9 source software components used directly 

10 or indirectly by Federal agencies based on 

11 readily available, and, to the greatest ex12 tent practicable, machine readable, infor13 mation, such as— 

14 ‘‘(I) software bills of materials 

15 that are, at the time of the assess16 ment, made available to the Agency or 

17 are otherwise accessible via the inter18 net; 

19 ‘‘(II) software inventories, avail20 able to the Director at the time of the 

21 assessment, from the Continuous 

22 Diagnostics and Mitigation program 

23 of the Agency; and 


kjohnson on DSK79L0C42PROD with BILLS
10 

•S 917 RS

1 ‘‘(III) other publicly available in2 formation regarding open source soft3 ware components; and 

4 ‘‘(ii) develop 1 or more ranked lists of 

5 components described in clause (i) based 

6 on the assessment, such as ranked by the 

7 criticality, level of risk, or usage of the 

8 components, or a combination thereof. 

9 ‘‘(F) AUTOMATION.—The Director shall, to 

10 the greatest extent practicable, automate the 

11 assessment conducted under subparagraph (E). 

12 ‘‘(G) PUBLICATION.—The Director shall 

13 publicly publish and maintain any tools devel14 oped to conduct the assessment described in 

15 subparagraph (E) as open source software. 

16 ‘‘(H) SHARING.— 

17 ‘‘(i) RESULTS.—The Director shall fa18 cilitate the sharing of the results of the 

19 each assessment described in subparagraph 

20 (E) (i) with appropriate Federal and non21 Federal entities working to support the se22 curity of open source software, including 

23 by offering means for appropriate Federal 

24 and non-Federal entities to download the 

25 assessment in an automated manner. 


kjohnson on DSK79L0C42PROD with BILLS
11 

•S 917 RS

1 ‘‘(ii) DATASETS.—The Director may 

2 publicly publish, as appropriate, any 

3 datasets or versions of the datasets devel4 oped or consolidated as a result of the an 

5 assessment described in subparagraph (E) 

6 (i). 

7 ‘‘(I) CRITICAL INFRASTRUCTURE ASSESS8 MENT STUDY AND PILOT.— 

9 ‘‘(i) STUDY.—Not later than 2 years 

10 after the publication of the framework de11 scribed in subparagraph (A), the Director 

12 shall conduct a study regarding the feasi13 bility of the Director conducting the as14 sessment described in subparagraph (E) 

15 for critical infrastructure entities. 

16 ‘‘(ii) PILOT.— 

17 ‘‘(I) IN GENERAL.—If the Direc18 tor determines that the assessment 

19 described in clause (i) is feasible, the 

20 Director may conduct a pilot assess21 ment on a voluntary basis with 1 or 

22 more critical infrastructure sectors, in 

23 coordination with the Sector Risk 

24 Management Agency and the sector 


kjohnson on DSK79L0C42PROD with BILLS
12 

•S 917 RS

1 coordinating council of each partici2 pating sector. 

3 ‘‘(II) TERMINATION.—If the Di4 rector proceeds with the pilot de5 scribed in clause (ii) subclause (I), the 

6 pilot shall terminate on the date that 

7 is 2 years after the date on which the 

8 Director begins the pilot. 

9 ‘‘(iii) REPORTS.— 

10 ‘‘(I) STUDY.—Not later than 180 

11 days after the date on which the Di12 rector completes the study conducted 

13 under clause (i), the Director shall 

14 submit to the appropriate congres15 sional committees a report that— 

16 ‘‘(aa) summarizes the study; 

17 and 

18 ‘‘(bb) states whether the Di19 rector plans to proceed with the 

20 pilot described in clause (ii) (I). 

21 ‘‘(II) PILOT.—If the Director 

22 proceeds with the pilot described in 

23 clause (ii), not later than 1 year after 

24 the date on which the Director begins 

25 the pilot, the Director shall submit to 


kjohnson on DSK79L0C42PROD with BILLS
13 

•S 917 RS

1 the appropriate congressional commit2 tees a report that includes— 

3 ‘‘(aa) a summary of the re4 sults of the pilot; and 

5 ‘‘(bb) a recommendation as 

6 to whether the activities carried 

7 out under the pilot should be 

8 continued after the termination 

9 of the pilot described in clause 

10 (ii)(II). 

11 ‘‘(3) COORDINATION WITH NATIONAL CYBER DI12 RECTOR.—The Director shall— 

13 ‘‘(A) brief the National Cyber Director on 

14 the activities described in this subsection; and 

15 ‘‘(B) coordinate activities with the Na16 tional Cyber Director, as appropriate. 

17 ‘‘(4) REPORTS.— 

18 ‘‘(A) IN GENERAL.—Not later than 1 year 

19 after the date of enactment of this section, and 

20 every 2 years thereafter, the Director shall sub21 mit to the appropriate congressional committees 

22 a report that includes— 

23 ‘‘(i) a summary of the work on open 

24 source software security performed by the 

25 Director during the period covered by the 


kjohnson on DSK79L0C42PROD with BILLS
14 

•S 917 RS

1 report, including a list of the Federal and 

2 non-Federal entities with which the Direc3 tor interfaced; 

4 ‘‘(ii) the framework developed under 

5 paragraph (2)(A); 

6 ‘‘(iii) a summary of any updates made 

7 to the framework developed under para8 graph (2)(A) pursuant to paragraph 

9 (2)(B) since the last report submitted 

10 under this subparagraph; 

11 ‘‘(iv) a summary of the each assess12 ment conducted pursuant to paragraph 

13 (2)(E) since the last report was submitted 

14 under this subparagraph; 

15 ‘‘(v) a summary of changes made to 

16 the assessment conducted pursuant to 

17 paragraph (2)(E) since the last report sub18 mitted under this subparagraph, including 

19 overall security trends; and 

20 ‘‘(vi) a summary of the types of enti21 ties with which the an assessment con22 ducted pursuant to paragraph (2)(E) since 

23 the last reported submitted under this sub24 paragraph was shared pursuant to para25 graph (2)(H), including a list of the FedVerDate Sep 11 2014 00:05 May 17, 2023 Jkt 039200 PO 00000 Frm 00014 Fmt 6652 Sfmt 6201 E:\BILLS\S917.RS S917

kjohnson on DSK79L0C42PROD with BILLS
15 

•S 917 RS

1 eral and non-Federal entities with which 

2 the assessment was shared. 

3 ‘‘(B) PUBLIC REPORT.—Not later than 30 

4 days after the date on which the Director sub5 mits a report required under subparagraph (A), 

6 the Director shall make a version of the report 

7 publicly available on the website of the Agen8 cy.’’. 

9 (b) TECHNICAL AND CONFORMING AMENDMENT.— 

10 The table of contents in section 1(b) of the Homeland Se11 curity Act of 2002 (Public Law 107–296; 116 Stat. 2135) 

12 is amended by inserting after the item relating to section 

13 2220E the following: 

‘‘Sec. 2220F. Open source software security duties.’’. 

14 SEC. 4. SOFTWARE SECURITY ADVISORY SUBCOMMITTEE. 

15 Section 2219(d)(1) of the Homeland Security Act of 

16 2002 (6 U.S.C. 665e(d)(1)) is amended by adding at the 

17 end the following: 

18 ‘‘(E) Software security, including open 

19 source software security.’’. 

20 SEC. 5. OPEN SOURCE SOFTWARE GUIDANCE. 

21 (a) DEFINITIONS.—In this section: 

22 (1) APPROPRIATE CONGRESSIONAL COM23 MITTEE.—The term ‘‘appropriate congressional com24 mittee’’ has the meaning given the term in section 


kjohnson on DSK79L0C42PROD with BILLS
16 

•S 917 RS

1 2 of the Homeland Security Act of 2002 (6 U.S.C. 

2 101). 

3 (2) COVERED AGENCY.—The term ‘‘covered 

4 agency’’ means an agency described in section 

5 901(b) of title 31, United States Code. 

6 (3) DIRECTOR.—The term ‘‘Director’’ means 

7 the Director of the Office of Management and Budg8 et. 

9 (4) NATIONAL SECURITY SYSTEM.—The term 

10 ‘‘national security system’’ has the meaning given 

11 the term in section 3552 of title 44, United States 

12 Code. 

13 (5) OPEN SOURCE SOFTWARE; OPEN SOURCE

14 SOFTWARE COMMUNITY.—The terms ‘‘open source 

15 software’’ and ‘‘open source software community’’ 

16 have the meanings given those terms in section 2200 

17 of the Homeland Security Act of 2002 (6 U.S.C. 

18 650), as amended by section 3 of this Act. 

19 (b) GUIDANCE.— 

20 (1) IN GENERAL.—Not later than 1 year after 

21 the date of enactment of this Act, the Director, in 

22 coordination with the National Cyber Director, the 

23 Director of the Cybersecurity and Infrastructure Se24 curity Agency, and the Administrator of General 

25 Services, shall issue guidance on the responsibilities 


kjohnson on DSK79L0C42PROD with BILLS
17 

•S 917 RS

1 of the chief information officer at each covered agen2 cy regarding open source software, which shall in3 clude— 

4 (A) how chief information officers at each 

5 covered agency should, considering industry and 

6 open source software community best prac7 tices— 

8 (i) manage and reduce risks of using 

9 open source software; and 

10 (ii) guide contributing to and releas11 ing open source software; 

12 (B) how chief information officers should 

13 enable, rather than inhibit, the secure usage of 

14 open source software at each covered agency; 

15 (C) any relevant updates to the Memo16 randum M–16–21 issued by the Office of Man17 agement and Budget on August 8, 2016, enti18 tled, ‘‘Federal Source Code Policy: Achieving 

19 Efficiency, Transparency, and Innovation 

20 through Reusable and Open Source Software’’; 

21 and 

22 (D) how covered agencies may contribute 

23 publicly to open source software that the cov24 ered agency uses, including how chief informaVerDate Sep 11 2014 00:05 May 17, 2023 Jkt 039200 PO 00000 Frm 00017 Fmt 6652 Sfmt 6201 E:\BILLS\S917.RS S917

kjohnson on DSK79L0C42PROD with BILLS
18 

•S 917 RS

1 tion officers should encourage those contribu2 tions. 

3 (2) EXEMPTION OF NATIONAL SECURITY SYS4 TEMS.—The guidance issued under paragraph (1) 

5 shall not apply to national security systems. 

6 (c) PILOT.— 

7 (1) IN GENERAL.—Not later than 1 year after 

8 the date of enactment of this Act, the chief informa9 tion officer of each covered agency selected under 

10 paragraph (2), in coordination with the Director, the 

11 National Cyber Director, the Director of the Cyber12 security and Infrastructure Security Agency, and the 

13 Administrator of General Services, shall establish a 

14 pilot open source function at the covered agency 

15 that— 

16 (A) is modeled after open source program 

17 offices, such as those in the private sector, the 

18 nonprofit sector, academia, and other non-Fed19 eral entities; and 

20 (B) shall— 

21 (i) support the secure usage of open 

22 source software at the covered agency; 

23 (ii) develop policies and processes for 

24 contributions to and releases of open 

25 source software at the covered agency, in 


kjohnson on DSK79L0C42PROD with BILLS
19 

•S 917 RS

1 consultation, as appropriate, with the of2 fices of general counsel and procurement of 

3 the covered agency; 

4 (iii) interface with the open source 

5 software community; and 

6 (iv) manage and reduce risks of using 

7 open source software at the covered agen8 cy. 

9 (2) SELECTION OF PILOT AGENCIES.—The Di10 rector, in coordination with the National Cyber Di11 rector, the Director of the Cybersecurity and Infra12 structure Security Agency, and the Administrator of 

13 General Services, shall select not less than 1 and not 

14 more than 5 covered agencies to conduct the pilot 

15 described in paragraph (1). 

16 (3) ASSESSMENT.—Not later than 1 year after 

17 the establishment of the pilot open source functions 

18 described in paragraph (1), the Director, in coordi19 nation with the National Cyber Director, the Direc20 tor of the Cybersecurity and Infrastructure Security 

21 Agency, and the Administrator of General Services, 

22 shall assess whether open source functions should be 

23 established at some or all covered agencies, includ24 ing— 


kjohnson on DSK79L0C42PROD with BILLS
20 

•S 917 RS

1 (A) how to organize those functions within 

2 covered agencies, such as the creation of open 

3 source program offices; and 

4 (B) appropriate roles and responsibilities 

5 for those functions. 

6 (4) GUIDANCE.—Notwithstanding the termi7 nation of the pilot open source functions under para8 graph (5), if the Director determines, based on the 

9 assessment described in paragraph (3), that some or 

10 all of the open source functions should be estab11 lished at some or all covered agencies, the Director, 

12 in coordination with the National Cyber Director, 

13 the Director of the Cybersecurity and Infrastructure 

14 Security Agency, and the Administrator of General 

15 Services, shall issue guidance on the implementation 

16 of those functions. 

17 (5) TERMINATION.—The pilot open source 

18 functions described in paragraph (1) shall terminate 

19 not later than 4 years after the establishment of the 

20 pilot open source functions. 

21 (d) BRIEFING AND REPORT.—The Director shall— 

22 (1) not later than 1 year after the date of en23 actment of this Act, brief the appropriate congres24 sional committees on the guidance issued under sub25 section (b); and 


kjohnson on DSK79L0C42PROD with BILLS
21 

•S 917 RS

1 (2) not later than 540 days after the establish2 ment of the pilot open source functions under sub3 section (c)(1), submit to the appropriate congres4 sional committees a report on— 

5 (A) the pilot open source functions; and 

6 (B) the results of the assessment con7 ducted under subsection (c)(3). 

8 (e) DUTIES.—Section 3554(b) of title 44, United 

9 States Code, is amended— 

10 (1) in paragraph (7), by striking ‘‘and’’ at the 

11 end; 

12 (2) in paragraph (8), by striking the period at 

13 the end and inserting ‘‘; and’’; and 

14 (3) by adding at the end the following: 

15 ‘‘(9) plans and procedures to ensure the secure 

16 usage and development of software, including open 

17 source software (as defined in section 2200 of the 

18 Homeland Security Act of 2002 (6 U.S.C. 650)).’’. 

19 SEC. 6. RULE OF CONSTRUCTION. 

20 Nothing in this Act or the amendments made by this 

21 Act shall be construed to provide any additional regulatory 

22 authority to any Federal agency described therein. 


kjohnson on DSK79L0C42PROD with BILLS
Calendar No. 76 

118TH CONGRESS 

1ST SESSION S. 917 

[Report No. 118–32] 

A BILL 

To establish the duties of the Director of the Cyother purposes. regarding open source software security, and for bersecurity and Infrastructure Security Agency 

MAY 16, 2023 

Reported with amendments 


kjohnson on DSK79L0C42PROD with BILLS