```

[Congressional Bills 113th Congress]
[From the U.S. Government Publishing Office]
[S. 1611 Reported in Senate (RS)]

                                                       Calendar No. 372
113th CONGRESS
  2d Session
                                S. 1611

                          [Report No. 113-157]

To require certain agencies to conduct assessments of data centers and 
       develop data center consolidation and optimization plans.

_______________________________________________________________________

                   IN THE SENATE OF THE UNITED STATES

                            October 30, 2013

   Mr. Bennet (for himself, Mr. Coburn, Ms. Ayotte, and Mr. Carper) 
introduced the following bill; which was read twice and referred to the 
        Committee on Homeland Security and Governmental Affairs

                              May 6, 2014

               Reported by Mr. Carper, with an amendment
 [Strike out all after the enacting clause and insert the part printed 
                               in italic]

_______________________________________________________________________

                                 A BILL

 
To require certain agencies to conduct assessments of data centers and 
       develop data center consolidation and optimization plans.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

<DELETED>SECTION 1. SHORT TITLE.</DELETED>

<DELETED>    This Act may be cited as the ``Federal Data Center 
Consolidation Act of 2013''.</DELETED>

<DELETED>SEC. 2. FEDERAL DATA CENTER CONSOLIDATION 
              INITIATIVE.</DELETED>

<DELETED>    (a) Definitions.--In this Act:</DELETED>
        <DELETED>    (1) Administrator.--The term ``Administrator'' 
        means the Administrator for the Office of E-Government and 
        Information Technology within the Office of Management and 
        Budget.</DELETED>
        <DELETED>    (2) FDCCI.--The term ``FDCCI'' means the Federal 
        Data Center Consolidation Initiative described in the Office of 
        Management and Budget Memorandum on the Federal Data Center 
        Consolidation Initiative, dated February 26, 2010, or any 
        successor thereto.</DELETED>
<DELETED>    (b) Federal Data Center Consolidation Inventories and 
Strategies.--</DELETED>
        <DELETED>    (1) In general.--</DELETED>
                <DELETED>    (A) Annual reporting.--Each year, 
                beginning in the first fiscal year after the date of 
                enactment of this Act and for each of the 4 fiscal 
                years thereafter, the head of each agency that is 
                described in subparagraph (D), assisted by the Chief 
                Information Officer of the agency, shall submit to the 
                Administrator--</DELETED>
                        <DELETED>    (i) a comprehensive asset 
                        inventory of the data centers owned, operated, 
                        or maintained by or on behalf of the agency, 
                        even if the center is administered by a third 
                        party; and</DELETED>
                        <DELETED>    (ii) a multi-year strategy to 
                        achieve the optimization and consolidation of 
                        agency data center assets, that includes--
                        </DELETED>
                                <DELETED>    (I) performance metrics--
                                </DELETED>
                                        <DELETED>    (aa) that are 
                                        consistent with performance 
                                        metrics established by the 
                                        Administrator under 
                                        subparagraphs (C) and (G) of 
                                        paragraph (2); and</DELETED>
                                        <DELETED>    (bb) by which the 
                                        quantitative and qualitative 
                                        progress of the agency toward 
                                        data center consolidation goals 
                                        can be measured;</DELETED>
                                <DELETED>    (II) a timeline for agency 
                                activities completed under the FDCCI, 
                                with an emphasis on benchmarks the 
                                agency can achieve by specific 
                                dates;</DELETED>
                                <DELETED>    (III) an aggregation of 
                                year-by-year investment and cost 
                                savings calculations for the period 
                                beginning on the date of enactment of 
                                this Act and ending on the date 
                                described in subsection (e), broken 
                                down by each year, including a 
                                description of any initial costs for 
                                data center consolidation and life 
                                cycle cost savings, with an emphasis 
                                on--</DELETED>
                                        <DELETED>    (aa) meeting the 
                                        Government-wide performance 
                                        metrics described in 
                                        subparagraphs (C) and (G) of 
                                        paragraph (2); and</DELETED>
                                        <DELETED>    (bb) demonstrating 
                                        agency-specific savings each 
                                        fiscal year achieved through 
                                        the FDCCI; and</DELETED>
                                <DELETED>    (IV) any additional 
                                information required by the 
                                Administrator.</DELETED>
                <DELETED>    (B) Use of existing reporting 
                structures.--The Administrator may require agencies 
                described in subparagraph (D) to submit any information 
                required to be submitted under this subsection through 
                reporting structures in use as of the date of enactment 
                of this Act.</DELETED>
                <DELETED>    (C) Certification.--Each year, beginning 
                in the first fiscal year after the date of enactment of 
                this Act and for each of the 4 fiscal years thereafter, 
                acting through the chief information officer of the 
                agency, shall submit a statement to the Administrator 
                certifying that the agency has complied with the 
                requirements of this Act.</DELETED>
                <DELETED>    (D) Agencies described.--The agencies 
                (including all associated components of the agency) 
                described in this paragraph are the--</DELETED>
                        <DELETED>    (i) Department of 
                        Agriculture;</DELETED>
                        <DELETED>    (ii) Department of 
                        Commerce;</DELETED>
                        <DELETED>    (iii) Department of 
                        Defense;</DELETED>
                        <DELETED>    (iv) Department of 
                        Education;</DELETED>
                        <DELETED>    (v) Department of 
                        Energy;</DELETED>
                        <DELETED>    (vi) Department of Health and 
                        Human Services;</DELETED>
                        <DELETED>    (vii) Department of Homeland 
                        Security;</DELETED>
                        <DELETED>    (viii) Department of Housing and 
                        Urban Development;</DELETED>
                        <DELETED>    (ix) Department of the 
                        Interior;</DELETED>
                        <DELETED>    (x) Department of 
                        Justice;</DELETED>
                        <DELETED>    (xi) Department of 
                        Labor;</DELETED>
                        <DELETED>    (xii) Department of 
                        State;</DELETED>
                        <DELETED>    (xiii) Department of 
                        Transportation;</DELETED>
                        <DELETED>    (xiv) Department of the 
                        Treasury;</DELETED>
                        <DELETED>    (xv) Department of Veterans 
                        Affairs;</DELETED>
                        <DELETED>    (xvi) Environmental Protection 
                        Agency;</DELETED>
                        <DELETED>    (xvii) General Services 
                        Administration;</DELETED>
                        <DELETED>    (xviii) National Aeronautics and 
                        Space Administration;</DELETED>
                        <DELETED>    (xix) National Science 
                        Foundation;</DELETED>
                        <DELETED>    (xx) Nuclear Regulatory 
                        Commission;</DELETED>
                        <DELETED>    (xxi) Office of Personnel 
                        Management;</DELETED>
                        <DELETED>    (xxii) Small Business 
                        Administration;</DELETED>
                        <DELETED>    (xxiii) Social Security 
                        Administration; and</DELETED>
                        <DELETED>    (xxiv) United States Agency for 
                        International Development.</DELETED>
                <DELETED>    (E) Agency implementation of strategies.--
                Each agency described in subparagraph (D), under the 
                direction of the Chief Information Officer of the 
                agency shall--</DELETED>
                        <DELETED>    (i) implement the consolidation 
                        strategy required under subparagraph (A)(ii); 
                        and</DELETED>
                        <DELETED>    (ii) provide updates to the 
                        Administrator, on a quarterly basis, of--
                        </DELETED>
                                <DELETED>    (I) the completion of 
                                activities by the agency under the 
                                FDCCI;</DELETED>
                                <DELETED>    (II) any progress of the 
                                agency towards meeting the Government-
                                wide data center performance metrics 
                                described in subparagraphs (C) and (G) 
                                of paragraph (2); and</DELETED>
                                <DELETED>    (III) the actual cost 
                                savings realized through the 
                                implementation of the FDCCI.</DELETED>
                <DELETED>    (F) Rule of construction.--Nothing in this 
                paragraph shall be construed to limit the reporting of 
                information by any agency described in subparagraph (F) 
                to the Administrator, the Director of the Office of 
                Management and Budget, or to Congress.</DELETED>
        <DELETED>    (2) Administrator responsibilities.--The 
        Administrator shall--</DELETED>
                <DELETED>    (A) establish the deadline, on an annual 
                basis, for agencies to submit information under this 
                section;</DELETED>
                <DELETED>    (B) establish a list of requirements that 
                the agencies must meet to be considered in compliance 
                with paragraph (1);</DELETED>
                <DELETED>    (C) ensure that each certification 
                submitted under paragraph (1)(C) and information 
                relating to agency progress towards meeting the 
                Government-wide total cost of ownership optimization 
                and consolidation metrics is made available in a timely 
                manner to the general public;</DELETED>
                <DELETED>    (D) review the plans submitted under 
                paragraph (1) to determine whether each plan is 
                comprehensive and complete;</DELETED>
                <DELETED>    (E) monitor the implementation of the data 
                center plan of each agency described in paragraph 
                (1)(A)(ii);</DELETED>
                <DELETED>    (F) update, on an annual basis, the 
                cumulative cost savings realized through the 
                implementation of the agency plans; and</DELETED>
                <DELETED>    (G) establish Government-wide data center 
                total cost of ownership optimization and consolidation 
                metrics, which shall include server efficiency and 
                other comprehensive metrics established at the 
                discretion of the Administrator.</DELETED>
        <DELETED>    (3) Cost saving goal and updates for congress.--
        </DELETED>
                <DELETED>    (A) In general.--Not later than 1 year 
                after the date of enactment of this Act, the 
                Administrator shall develop and publish a goal for the 
                total amount of planned cost savings by the Federal 
                Government through the Federal Data Center 
                Consolidation Initiative during the 5-year period 
                beginning on the date of enactment of this Act, which 
                shall include a breakdown on a year-by-year basis of 
                the projected savings.</DELETED>
                <DELETED>    (B) Annual update.--</DELETED>
                        <DELETED>    (i) In general.--Not later than 1 
                        year after the date on which the goal described 
                        in subparagraph (A) is determined and each year 
                        thereafter until the end of 2018, the 
                        Administrator shall aggregate the savings 
                        achieved to date, by each relevant agency, 
                        through the FDCCI as compared to the projected 
                        savings developed under subparagraph (A) (based 
                        on data collected from each affected agency 
                        under paragraph (1)).</DELETED>
                        <DELETED>    (ii) Update for congress.--The 
                        goal required to be developed and published 
                        under subparagraph (A) shall be submitted to 
                        Congress and shall include an update on the 
                        progress made by each agency described in 
                        subsection paragraph (1)(E) on--</DELETED>
                                <DELETED>    (I) whether each agency 
                                has in fact submitted a comprehensive 
                                asset inventory, including an 
                                assessment broken down by agency, which 
                                shall include the specific numbers, 
                                utilization, and efficiency level of 
                                data centers; and</DELETED>
                                <DELETED>    (II) whether each agency 
                                has submitted a comprehensive 
                                consolidation plan with the key 
                                elements described in paragraph 
                                (1)(A)(ii).</DELETED>
                        <DELETED>    (iii) Request for information.--
                        Upon request from the Committee on Homeland 
                        Security and Governmental Affairs of the Senate 
                        or the Committee on Oversight and Government 
                        Reform of the House of Representatives, the 
                        head of an agency described in paragraph (1)(E) 
                        or the Director of the Office of Management and 
                        Budget shall submit to the requesting committee 
                        any report or information submitted to the 
                        Office of Management and Budget for the purpose 
                        of preparing a report required under clause (i) 
                        or an updated progress report required under 
                        clause (ii).</DELETED>
        <DELETED>    (4) GAO review.--</DELETED>
                <DELETED>    (A) In general.--During the 5-fiscal-year 
                period following the date of enactment of this Act, the 
                Comptroller General of the United States shall review 
                the quality and completeness, and verify, each agency's 
                asset inventory and plans required under paragraph 
                (1)(A).</DELETED>
                <DELETED>    (B) Report.--The Comptroller General of 
                the United States shall, on an annual basis during the 
                5-fiscal-year period following the date of enactment of 
                this Act, publish a report on each review conducted 
                under subparagraph (A) of an agency during the fiscal 
                year for which the report is published.</DELETED>
<DELETED>    (c) Ensuring Cybersecurity Standards for Data Center 
Consolidation and Cloud Computing.--An agency required to implement a 
data center consolidation plan under this Act and migrate to cloud 
computing shall do so in a manner that is consistent with Federal 
guidelines on cloud computing security, including--</DELETED>
        <DELETED>    (1) applicable provisions found within the Federal 
        Risk and Authorization Management Program (FedRAMP); 
        and</DELETED>
        <DELETED>    (2) guidance published by the National Institute 
        of Standards and Technology.</DELETED>
<DELETED>    (d) Classified Information.--The Director of National 
Intelligence may waive the requirements of this Act for any element (or 
component of an element) of the intelligence community.</DELETED>
<DELETED>    (e) Sunset.--This Act is repealed effective on October 1, 
2018.</DELETED>

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Federal Data Center Consolidation 
Act of 2013''.

SEC. 2. FEDERAL DATA CENTER CONSOLIDATION INITIATIVE.

    (a) Definitions.--In this Act:
            (1) Administrator.--The term ``Administrator'' means the 
        Administrator for the Office of E-Government and Information 
        Technology within the Office of Management and Budget.
            (2) Covered agency.--The term ``covered agency'' means the 
        following (including all associated components of the agency):
                    (A) Department of Agriculture;
                    (B) Department of Commerce;
                    (C) Department of Defense;
                    (D) Department of Education;
                    (E) Department of Energy;
                    (F) Department of Health and Human Services;
                    (G) Department of Homeland Security;
                    (H) Department of Housing and Urban Development;
                    (I) Department of the Interior;
                    (J) Department of Justice;
                    (K) Department of Labor;
                    (L) Department of State;
                    (M) Department of Transportation;
                    (N) Department of Treasury;
                    (O) Department of Veterans Affairs;
                    (P) Environmental Protection Agency;
                    (Q) General Services Administration;
                    (R) National Aeronautics and Space Administration;
                    (S) National Science Foundation;
                    (T) Nuclear Regulatory Commission;
                    (U) Office of Personnel Management;
                    (V) Small Business Administration;
                    (W) Social Security Administration; and
                    (X) United States Agency for International 
                Development.
            (3) FDCCI.--The term ``FDCCI'' means the Federal Data 
        Center Consolidation Initiative described in the Office of 
        Management and Budget Memorandum on the Federal Data Center 
        Consolidation Initiative, dated February 26, 2010, or any 
        successor thereto.
            (4) Government-wide data center consolidation and 
        optimization metrics.--The term ``Government-wide data center 
        consolidation and optimization metrics'' means the metrics 
        established by the Administrator under subsection (b)(2)(G).
    (b) Federal Data Center Consolidation Inventories and Strategies.--
            (1) In general.--
                    (A) Annual reporting.--Each year, beginning in the 
                first fiscal year after the date of enactment of this 
                Act and each fiscal year thereafter, the head of each 
                covered agency, assisted by the Chief Information 
                Officer of the agency, shall submit to the 
                Administrator--
                            (i) a comprehensive inventory of the data 
                        centers owned, operated, or maintained by or on 
                        behalf of the agency; and
                            (ii) a multi-year strategy to achieve the 
                        consolidation and optimization of the data 
                        centers inventoried under clause (i), that 
                        includes--
                                    (I) performance metrics--
                                            (aa) that are consistent 
                                        with the Government-wide data 
                                        center consolidation and 
                                        optimization metrics; and
                                            (bb) by which the 
                                        quantitative and qualitative 
                                        progress of the agency toward 
                                        the goals of the FDCCI can be 
                                        measured;
                                    (II) a timeline for agency 
                                activities to be completed under the 
                                FDCCI, with an emphasis on benchmarks 
                                the agency can achieve by specific 
                                dates;
                                    (III) year-by-year calculations of 
                                investment and cost savings for the 
                                period beginning on the date of 
                                enactment of this Act and ending on the 
                                date described in subsection (e), 
                                broken down by each year, including a 
                                description of any initial costs for 
                                data center consolidation and 
                                optimization and life cycle cost 
                                savings and other improvements, with an 
                                emphasis on--
                                            (aa) meeting the 
                                        Government-wide data center 
                                        consolidation and optimization 
                                        metrics; and
                                            (bb) demonstrating the 
                                        amount of agency-specific cost 
                                        savings each fiscal year 
                                        achieved through the FDCCI; and
                                    (IV) any additional information 
                                required by the Administrator.
                    (B) Use of other reporting structures.--The 
                Administrator may require a covered agency to include 
                the information required to be submitted under this 
                subsection through reporting structures determined by 
                the Administrator to be appropriate.
                    (C) Statement.--Each year, beginning in the first 
                fiscal year after the date of enactment of this Act and 
                each fiscal year thereafter, the head of each covered 
                agency, acting through the Chief Information Officer of 
                the agency, shall--
                            (i)(I) submit a statement to the 
                        Administrator stating whether the agency has 
                        complied with the requirements of this Act; and
                            (II) make the statement submitted under 
                        subclause (I) publically available; and
                            (ii) if the agency has not complied with 
                        the requirements of this Act, submit a 
                        statement to the Administrator explaining the 
                        reasons for not complying with such 
                        requirements.
                    (D) Agency implementation of strategies.--Each 
                covered agency, under the direction of the Chief 
                Information Officer of the agency, shall--
                            (i) implement the strategy required under 
                        subparagraph (A)(ii); and
                            (ii) provide updates to the Administrator, 
                        on a quarterly basis, of --
                                    (I) the completion of activities by 
                                the agency under the FDCCI;
                                    (II) any progress of the agency 
                                towards meeting the Government-wide 
                                data center consolidation and 
                                optimization metrics; and
                                    (III) the actual cost savings and 
                                other improvements realized through the 
                                implementation of the strategy of the 
                                agency.
                    (E) Rule of construction.--Nothing in this Act 
                shall be construed to limit the reporting of 
                information by a covered agency to the Administrator, 
                the Director of the Office of Management and Budget, or 
                Congress.
            (2) Administrator responsibilities.--The Administrator 
        shall--
                    (A) establish the deadline, on an annual basis, for 
                covered agencies to submit information under this 
                section;
                    (B) establish a list of requirements that the 
                covered agencies must meet to be considered in 
                compliance with paragraph (1);
                    (C) ensure that information relating to agency 
                progress towards meeting the Government-wide data 
                center consolidation and optimization metrics is made 
                available in a timely manner to the general public;
                    (D) review the inventories and strategies submitted 
                under paragraph (1) to determine whether they are 
                comprehensive and complete;
                    (E) monitor the implementation of the data center 
                strategy of each covered agency that is required under 
                paragraph (1)(A)(ii);
                    (F) update, on an annual basis, the cumulative cost 
                savings realized through the implementation of the 
                FDCCI; and
                    (G) establish metrics applicable to the 
                consolidation and optimization of data centers 
                Government-wide, including metrics with respect to--
                            (i) costs;
                            (ii) efficiencies, including at least 
                        server efficiency; and
                            (iii) any other metrics the Administrator 
                        establishes under this subparagraph.
            (3) Cost saving goal and updates for congress.--
                    (A) In general.--Not later than 1 year after the 
                date of enactment of this Act, the Administrator shall 
                develop, and make publically available, a goal, broken 
                down by year, for the amount of planned cost savings 
                and optimization improvements achieved through the 
                FDCCI during the period beginning on the date of 
                enactment of this Act and ending on the date described 
                in subsection (e).
                    (B) Annual update.--
                            (i) In general.--Not later than 1 year 
                        after the date on which the goal described in 
                        subparagraph (A) is made publically available, 
                        and each year thereafter, the Administrator 
                        shall aggregate the reported cost savings of 
                        each covered agency and optimization 
                        improvements achieved to date through the FDCCI 
                        and compare the savings to the projected cost 
                        savings and optimization improvements developed 
                        under subparagraph (A).
                            (ii) Update for congress.--The goal 
                        required to be developed under subparagraph (A) 
                        shall be submitted to Congress and shall be 
                        accompanied by a statement describing--
                                    (I) whether each covered agency has 
                                in fact submitted a comprehensive asset 
                                inventory, including an assessment 
                                broken down by agency, which shall 
                                include the specific numbers, 
                                utilization, and efficiency level of 
                                data centers; and
                                    (II) whether each covered agency 
                                has submitted a comprehensive 
                                consolidation strategy with the key 
                                elements described in paragraph 
                                (1)(A)(ii).
            (4) GAO review.--
                    (A) In general.--Not later than 1 year after the 
                date of enactment of this Act, and each year 
                thereafter, the Comptroller General of the United 
                States shall review and verify the quality and 
                completeness of the asset inventory and strategy of 
                each covered agency required under paragraph (1)(A).
                    (B) Report.--The Comptroller General of the United 
                States shall, on an annual basis, publish a report on 
                each review conducted under subparagraph (A).
    (c) Ensuring Cybersecurity Standards for Data Center Consolidation 
and Cloud Computing.--
            (1) In general.--In implementing a data center 
        consolidation and optimization strategy under this Act, a 
        covered agency shall do so in a manner that is consistent with 
        Federal guidelines on cloud computing security, including--
                    (A) applicable provisions found within the Federal 
                Risk and Authorization Management Program (FedRAMP); 
                and
                    (B) guidance published by the National Institute of 
                Standards and Technology.
            (2) Rule of construction.--Nothing in this Act shall be 
        construed to limit the ability of the Director of the Office of 
        Management and Budget to update or modify the Federal 
        guidelines on cloud computing security.
    (d) Waiver of Disclosure Requirements.--The Director of National 
Intelligence may waive the applicability to any element (or component 
of an element) of the intelligence community of any provision of this 
Act if the Director of National Intelligence determines that such 
waiver is in the interest of national security. Not later than 30 days 
after making a waiver under this subsection, the Director of National 
Intelligence shall submit to the Committee on Homeland Security and 
Governmental Affairs and the Select Committee on Intelligence of the 
Senate and the Committee on Oversight and Government Reform and the 
Permanent Select Committee on Intelligence of the House of 
Representatives a statement describing the waiver and the reasons for 
the waiver.
    (e) Sunset.--This Act is repealed effective on October 1, 2018.
                                                       Calendar No. 372

113th CONGRESS

  2d Session

                                S. 1611

                          [Report No. 113-157]

_______________________________________________________________________

                                 A BILL

To require certain agencies to conduct assessments of data centers and 
       develop data center consolidation and optimization plans.

_______________________________________________________________________

                              May 6, 2014

                       Reported with an amendment
```