IB 
Union Calendar No. 85 
117TH CONGRESS 
1ST SESSION H. R. 4611 
[Report No. 117–120] 
To direct the Secretary of Homeland Security to issue guidance with respect 
to certain information and communications technology or services con-
tracts, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 21, 2021 
Mr. TORRES of New York (for himself and Mr. GARBARINO) introduced the 
following bill; which was referred to the Committee on Homeland Security 
SEPTEMBER 14, 2021 
Reported with an amendment, committed to the Committee of the Whole 
House on the State of the Union, and ordered to be printed 
[Strike out all after the enacting clause and insert the part printed in italic] 
[For text of introduced bill, see copy of bill as introduced on July 21, 2021] 
VerDate Sep 11 2014 
01:47 Sep 16, 2021
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H4611.RH
H4611
pbinns on DSKJLVW7X2PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘DHS Software Supply 
Chain Risk Management Act of 2021’’. 
SEC. 2. DEPARTMENT OF HOMELAND SECURITY GUIDANCE 
WITH RESPECT TO CERTAIN INFORMATION 
AND 
COMMUNICATIONS 
TECHNOLOGY 
OR 
SERVICES CONTRACTS. 
(a) GUIDANCE.—The Secretary of Homeland Security, 
acting through the Under Secretary, shall issue guidance 
with respect to new and existing covered contracts. 
(b) NEW COVERED CONTRACTS.—In developing guid-
ance under subsection (a), with respect to each new covered 
contract, as a condition on the award of such a contract, 
each contractor responding to a solicitation for such a con-
tract shall submit to the covered officer— 
(1) a planned bill of materials when submitting 
a bid proposal; and 
(2) the certification and notifications described 
in subsection (e). 
(c) EXISTING COVERED CONTRACTS.—In developing 
guidance under subsection (a), with respect to each existing 
covered contract, each contractor with an existing covered 
contract shall submit to the covered officer— 
VerDate Sep 11 2014 
01:47 Sep 16, 2021
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H4611.RH
H4611
pbinns on DSKJLVW7X2PROD with BILLS
(1) the bill of materials used for such contract, 
upon the request of such officer; and 
(2) the certification and notifications described 
in subsection (e). 
(d) UPDATING BILL OF MATERIALS.—With respect to 
a covered contract, in the case of a change to the informa-
tion included in a bill of materials submitted pursuant to 
subsections (b)(1) and (c)(1), each contractor shall submit 
to the covered officer the update to such bill of materials, 
in a timely manner. 
(e) CERTIFICATION AND NOTIFICATIONS.—The certifi-
cation and notifications referred to in subsections (b)(2) 
and (c)(2), with respect to a covered contract, are the fol-
lowing: 
(1) A certification that each item listed on the 
submitted bill of materials is free from all known 
vulnerabilities or defects affecting the security of the 
end product or service identified in— 
(A) the National Institute of Standards and 
Technology National Vulnerability Database; 
and 
(B) any database designated by the Under 
Secretary, in coordination with the Director of 
the Cybersecurity and Infrastructure Security 
Agency, that tracks security vulnerabilities and 
VerDate Sep 11 2014 
01:47 Sep 16, 2021
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H4611.RH
H4611
pbinns on DSKJLVW7X2PROD with BILLS
defects in open source or third-party developed 
software. 
(2) A notification of each vulnerability or defect 
affecting the security of the end product or service, if 
identified, through— 
(A) the certification of such submitted bill 
of materials required under paragraph (1); or 
(B) any other manner of identification. 
(3) A notification relating to the plan to miti-
gate, repair, or resolve each security vulnerability or 
defect listed in the notification required under para-
graph (2). 
(f) ENFORCEMENT.—In developing guidance under 
subsection (a), the Secretary shall instruct covered officers 
with respect to— 
(1) the processes available to such officers enforc-
ing subsections (b) and (c); and 
(2) when such processes should be used. 
(g) EFFECTIVE DATE.—The guidance required under 
subsection (a) shall take effect on the date that is 180 days 
after the date of the enactment of this section. 
(h) GAO REPORT.—Not later than 1 year after the 
date of the enactment of this Act, the Comptroller General 
of the United States shall submit to the Secretary, the Com-
mittee on Homeland Security of the House of Representa-
VerDate Sep 11 2014 
01:47 Sep 16, 2021
Jkt 019200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H4611.RH
H4611
pbinns on DSKJLVW7X2PROD with BILLS
tives, and the Committee on Homeland Security and Gov-
ernmental Affairs of the Senate a report that includes— 
(1) a review of the implementation of this sec-
tion; 
(2) information relating to the engagement of the 
Department of Homeland Security with industry; 
(3) an assessment of how the guidance issued 
pursuant to subsection (a) complies with Executive 
Order 14208 (86 Fed. Reg. 26633; relating to improv-
ing the nation’s cybersecurity); and 
(4) any recommendations relating to improving 
the supply chain with respect to covered contracts. 
(i) DEFINITIONS.—In this section: 
(1) BILL OF MATERIALS.—The term ‘‘bill of ma-
terials’’ means a list of the parts and components 
(whether new or reused) of an end product or service, 
including, with respect to each part and component, 
information relating to the origin, composition, integ-
rity, and any other information as determined appro-
priate by the Under Secretary. 
(2) COVERED
CONTRACT.—The term ‘‘covered 
contract’’ means a contract relating to the procure-
ment of covered information and communications 
technology or services for the Department of Home-
land Security. 
VerDate Sep 11 2014 
01:47 Sep 16, 2021
Jkt 019200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H4611.RH
H4611
pbinns on DSKJLVW7X2PROD with BILLS
(3) COVERED
INFORMATION
AND
COMMUNICA-
TIONS TECHNOLOGY OR SERVICES.—The term ‘‘cov-
ered information and communications technology or 
services’’ means the terms— 
(A) ‘‘information technology’’ (as such term 
is defined in section 11101(6) of title 40, United 
States Code); 
(B) ‘‘information system’’ (as such term is 
defined in section 3502(8) of title 44, United 
States Code); 
(C) ‘‘telecommunications equipment’’ (as 
such term is defined in section 3(52) of the Com-
munications Act of 1934 (47 U.S.C. 153(52))); 
and 
(D) ‘‘telecommunications service’’ (as such 
term is defined in section 3(53) of the Commu-
nications Act of 1934 (47 U.S.C. 153(53))). 
(4) COVERED OFFICER.—The term ‘‘covered offi-
cer’’ means— 
(A) a contracting officer of the Department; 
and 
(B) any other official of the Department as 
determined appropriate by the Under Secretary. 
VerDate Sep 11 2014 
01:47 Sep 16, 2021
Jkt 019200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H4611.RH
H4611
pbinns on DSKJLVW7X2PROD with BILLS
(5) SOFTWARE.—The term ‘‘software’’ means 
computer programs and associated data that may be 
dynamically written or modified during execution. 
(6) UNDER SECRETARY.—The term ‘‘Under Sec-
retary’’ means the Under Secretary for Management 
of the Department of Homeland Security. 
VerDate Sep 11 2014 
01:47 Sep 16, 2021
Jkt 019200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H4611.RH
H4611
pbinns on DSKJLVW7X2PROD with BILLS
Union Calendar No. 85 
117TH CONGRESS 
1ST SESSION 
H. R. 4611 
[Report No. 117–120] 
A BILL 
To direct the Secretary of Homeland Security to 
issue guidance with respect to certain informa-
tion and communications technology or services 
contracts, and for other purposes. 
SEPTEMBER 14, 2021 
Reported with an amendment, committed to the Com-
mittee of the Whole House on the State of the Union, 
and ordered to be printed 
VerDate Sep 11 2014 
01:47 Sep 16, 2021
Jkt 019200
PO 00000
Frm 00010
Fmt 6651
Sfmt 6651
E:\BILLS\H4611.RH
H4611
pbinns on DSKJLVW7X2PROD with BILLS