form Act of 2023, a list of high-risk legacy in-
formation technology systems used, operated, or 
maintained by the agency, in accordance with 
the guidance issued under paragraph (4); and 
‘‘(B) on or before September 30 of each 
year after the first year in which the list is pro-
vided under subparagraph (A), any updates to 
such list. 
‘‘(2) LEGACY
FEDERAL
IT
INVENTORY.—The 
Federal Chief Information Officer shall— 
‘‘(A) on or before the first December 30 
that occurs after the date of the enactment of 
the Modernizing Government Technology Re-
form Act of 2023, compile a Legacy Federal IT 
Inventory on the basis of the each list provided 
by an agency Chief Information Officers under 
paragraph (1)(A) that includes information 
about each high-risk legacy information tech-
nology system used, operated, or maintained by 
an agency; and 
‘‘(B) on or before December 30 each year 
after the year in which the Legacy Federal IT 
Inventory is compiled, update such Inventory on 
the basis of each update to the list provided by 
VerDate Sep 11 2014 
01:36 Sep 19, 2023
Jkt 039200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H5527.IH
H5527
kjohnson on DSK7ZCZBW3PROD with $$_JOB
an agency Chief Information Officer under 
paragraph (1)(B). 
‘‘(3) PRIORITIZATION LIST.— 
‘‘(A) REQUIREMENT.—The Federal Chief 
Information Officer shall— 
‘‘(i) not later than 90 days after the 
date on which the Federal Chief Informa-
tion Officer receives the list required by 
paragraph (1)(A) from each agency Chief 
Information Officer, compile, on the basis 
of each such list, a list of 10 legacy infor-
mation technology systems that present the 
greatest security, privacy, and operational 
risks to the Federal Government; and 
‘‘(ii) not later than 90 days after the 
date on which the Federal Chief Informa-
tion Officer receives updates under para-
graph (1)(B) from each agency Chief In-
formation Officer, update the list required 
by subparagraph (A) on the basis of each 
updates to the list provided by agency 
Chief information Officers under para-
graph (1)(B). 
‘‘(B) REPORT
TO
CONGRESS.—Not later 
than 14 days after the date on which the Fed-
VerDate Sep 11 2014 
01:36 Sep 19, 2023
Jkt 039200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H5527.IH
H5527
kjohnson on DSK7ZCZBW3PROD with $$_JOB
eral Chief Information Officer compiles the list 
required by subparagraph (A), or updates such 
list, the Director shall submit to the Committee 
on Oversight and Accountability of the House 
of Representatives, the Committee on Home-
land Security and Governmental Affairs of the 
Senate, and the Comptroller General of the 
United States, a report (which may include a 
classified annex) containing— 
‘‘(i) such list (including any update 
made to such list under subparagraph 
(A)(ii)); and 
‘‘(ii) each list provided by an agency 
Chief Information Officer under paragraph 
(1)(A) (including any update made to any 
such list under paragraph (1)(B)). 
‘‘(4) GUIDANCE.— 
‘‘(A) IN
GENERAL.—Not later than 180 
days after enactment of this Act, the Director 
shall issue guidance on implementing the re-
quirements of this subsection that shall, at a 
minimum— 
‘‘(i) prescribe an appropriate format 
for list to be provided under paragraph 
(1)(A); 
VerDate Sep 11 2014 
01:36 Sep 19, 2023
Jkt 039200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H5527.IH
H5527
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(ii) prescribe the information to be 
included in the Legacy Federal IT Inven-
tory required by paragraph (2); 
‘‘(iii) provide guidance on how an 
agency Chief Information Officer should 
identify high-risk legacy information tech-
nology systems that, at least, requires 
agency Chief Information Officers, in co-
ordination with other agency stakeholders, 
to identify as a high risk legacy informa-
tion technology system any outdated or ob-
solete system of information technology 
that is critical to the agency such that the 
loss or degradation of the system would 
create a security, operational, or privacy 
risk to the agency or would otherwise im-
pact the ability of the agency to perform 
the mission of the agency, effectively de-
liver programs, or conduct business; and 
‘‘(iv) provide guidance on how existing 
reporting structures can be used to submit 
the Legacy Federal IT inventory required 
by paragraph (2). 
VerDate Sep 11 2014 
01:36 Sep 19, 2023
Jkt 039200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H5527.IH
H5527
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(B) UPDATES.—The Director may update 
the guidance issued under subparagraph (A) as 
the Director determines necessary. 
‘‘(5) DEFINITIONS.—In this subsection: 
‘‘(A) AGENCY CHIEF INFORMATION OFFI-
CER.—The term ‘agency Chief Information Of-
ficer’ means a Chief Information Officer des-
ignated under section 3506(a)(2) of title 44, 
United States Code. 
‘‘(B) FEDERAL CHIEF INFORMATION OFFI-
CER.—The term ‘Federal Chief Information Of-
ficer’ means the Administrator of the Office of 
Electronic Government.’’; and 
(7) in subsection (g)(1), as so redesignated, by 
striking ‘‘On and after the date that is 2 years after 
the date on which the Comptroller General of the 
United States issues the third report required under 
subsection (b)(7)(B),’’ and inserting ‘‘After Decem-
ber 31, 2030,’’. 
Æ 
VerDate Sep 11 2014 
01:36 Sep 19, 2023
Jkt 039200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6301
E:\BILLS\H5527.IH
H5527
kjohnson on DSK7ZCZBW3PROD with $$_JOB