I 
118TH CONGRESS 
1ST SESSION H. R. 5218 
To amend the Carl Levin and Howard P. ‘‘Buck’’ McKeon National Defense 
Authorization Act for Fiscal Year 2015 to modify requirements relating 
to data centers of certain Federal agencies, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
AUGUST 15, 2023 
Mr. NEGUSE (for himself and Mr. LALOTA) introduced the following bill; 
which was referred to the Committee on Oversight and Accountability 
A BILL 
To amend the Carl Levin and Howard P. ‘‘Buck’’ McKeon 
National Defense Authorization Act for Fiscal Year 2015 
to modify requirements relating to data centers of certain 
Federal agencies, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Federal Data Center 
Enhancement Act of 2023’’. 
SEC. 2. FEDERAL DATA CENTER CONSOLIDATION INITIA-
TIVE AMENDMENTS. 
(a) FINDINGS.—Congress finds the following: 
VerDate Sep 11 2014 
00:14 Aug 23, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5218.IH
H5218
kjohnson on DSK79L0C42PROD with BILLS
(1) The statutory authorization for the Federal 
Data Center Optimization Initiative under section 
834 of the Carl Levin and Howard P. ‘‘Buck’’ 
McKeon National Defense Authorization Act for 
Fiscal Year 2015 (44 U.S.C. 3601 note; Public Law 
113–291) expires at the end of fiscal year 2022. 
(2) The expiration of the authorization de-
scribed in paragraph (1) presents Congress with an 
opportunity to review the objectives of the Federal 
Data Center Optimization Initiative to ensure that 
the initiative is meeting the current needs of the 
Federal Government. 
(3) The initial focus of the Federal Data Center 
Optimization Initiative, which was to consolidate 
data centers and create new efficiencies, has resulted 
in, since 2010— 
(A) the consolidation of more than 6,000 
Federal data centers; and 
(B) 
cost 
savings 
and 
avoidance 
of 
$5,800,000,000. 
(4) The need of the Federal Government for ac-
cess to data and data processing systems has evolved 
since the date of enactment in 2014 of subtitle D of 
title VIII of the Carl Levin and Howard P. ‘‘Buck’’ 
VerDate Sep 11 2014 
00:14 Aug 23, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5218.IH
H5218
kjohnson on DSK79L0C42PROD with BILLS
McKeon National Defense Authorization Act for 
Fiscal Year 2015. 
(5) Federal agencies and employees involved in 
mission critical functions increasingly need reliable 
access to secure, reliable, sustainable, and protected 
facilities to house mission critical data and data op-
erations to meet the immediate needs of the people 
of the United States. 
(6) As of the date of enactment of this Act, 
there is a growing need for Federal agencies to use 
data centers and cloud applications that meet high 
standards for cybersecurity, resiliency, availability, 
and sustainability. 
(b) MINIMUM REQUIREMENTS FOR NEW DATA CEN-
TERS.—Section 834 of the Carl Levin and Howard P. 
‘‘Buck’’ McKeon National Defense Authorization Act for 
Fiscal Year 2015 (44 U.S.C. 3601 note; Public Law 113– 
291) is amended— 
(1) in subsection (a), by striking paragraphs 
(3) and (4) and inserting the following: 
‘‘(3) NEW DATA CENTER.—The term ‘new data 
center’ means— 
‘‘(A)(i) a data center or a portion thereof 
that is owned, operated, or maintained by a 
covered agency; or 
VerDate Sep 11 2014 
00:14 Aug 23, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5218.IH
H5218
kjohnson on DSK79L0C42PROD with BILLS
‘‘(ii) to the extent practicable, a data cen-
ter or portion thereof— 
‘‘(I) that is owned, operated, or main-
tained by a contractor on behalf of a cov-
ered agency on the date on which the con-
tract between the covered agency and the 
contractor expires; and 
‘‘(II) with respect to which the cov-
ered agency extends the contract, or enters 
into a new contract, with the contractor; 
and 
‘‘(B) on or after the date that is 180 days 
after the date of enactment of the Federal Data 
Center Enhancement Act of 2023, a data cen-
ter or portion thereof that is— 
‘‘(i) established; or 
‘‘(ii) substantially upgraded or ex-
panded.’’; 
(2) by striking subsection (b) and inserting the 
following: 
‘‘(b) MINIMUM REQUIREMENTS
FOR NEW DATA 
CENTERS.— 
‘‘(1) IN GENERAL.—Not later than 180 days 
after the date of enactment of the Federal Data 
Center Enhancement Act of 2023, the Administrator 
VerDate Sep 11 2014 
00:14 Aug 23, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5218.IH
H5218
kjohnson on DSK79L0C42PROD with BILLS
‘‘(B) CONSULTATION.—In establishing the 
requirements 
described 
in 
subparagraph 
(A)(vii), the Administrator shall consult with 
the Director of the Cybersecurity and Infra-
structure Security Agency and the National 
Cyber Director. 
‘‘(3) INCORPORATION
OF
MINIMUM
REQUIRE-
MENTS INTO CURRENT DATA CENTERS.—As soon as 
practicable, and in any case not later than 90 days 
after the Administrator establishes the minimum re-
quirements pursuant to paragraph (1), the Adminis-
trator shall issue guidance to ensure, as appropriate, 
that covered agencies incorporate the minimum re-
quirements established under that paragraph into 
the operations of any data center of a covered agen-
cy existing as of the date of enactment of the Fed-
eral Data Center Enhancement Act of 2023. 
‘‘(4) REVIEW OF REQUIREMENTS.—The Admin-
istrator, in consultation with the Administrator of 
General Services and the Federal Chief Information 
Officers Council, shall review, update, and modify 
the minimum requirements established under para-
graph (1), as necessary. 
‘‘(5) REPORT ON NEW DATA CENTERS.—During 
the development and planning lifecycle of a new data 
VerDate Sep 11 2014 
00:14 Aug 23, 2023
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5218.IH
H5218
kjohnson on DSK79L0C42PROD with BILLS
center, if the head of a covered agency determines 
that the covered agency is likely to make a manage-
ment or financial decision relating to any data cen-
ter, the head of the covered agency shall— 
‘‘(A) notify— 
‘‘(i) the Administrator; 
‘‘(ii) Committee on Homeland Secu-
rity and Governmental Affairs of the Sen-
ate; and 
‘‘(iii) Committee on Oversight and Ac-
countability of the House of Representa-
tives; and 
‘‘(B) describe in the notification with suffi-
cient detail how the covered agency intends to 
comply with the minimum requirements estab-
lished under paragraph (1). 
‘‘(6) USE
OF
TECHNOLOGY.—In determining 
whether to establish or continue to operate an exist-
ing data center, the head of a covered agency shall— 
‘‘(A) regularly assess the application port-
folio of the covered agency and ensure that each 
at-risk legacy application is updated, replaced, 
or modernized, as appropriate, to take advan-
tage of modern technologies; and 
VerDate Sep 11 2014 
00:14 Aug 23, 2023
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5218.IH
H5218
kjohnson on DSK79L0C42PROD with BILLS
‘‘(B) prioritize and, to the greatest extent 
possible, leverage commercial cloud environ-
ments rather than acquiring, overseeing, or 
managing custom data center infrastructure. 
‘‘(7) PUBLIC WEBSITE.— 
‘‘(A) IN
GENERAL.—The Administrator 
shall maintain a public-facing website that in-
cludes information, data, and explanatory state-
ments relating to the compliance of covered 
agencies with the requirements of this section. 
‘‘(B) PROCESSES
AND
PROCEDURES.—In 
maintaining the website described in subpara-
graph (A), the Administrator shall— 
‘‘(i) ensure covered agencies regularly, 
and not less frequently than biannually, 
update the information, data, and explana-
tory statements posed on the website, pur-
suant to guidance issued by the Adminis-
trator, relating to any new data centers 
and, as appropriate, each existing data 
center of the covered agency; and 
‘‘(ii) ensure that all information, data, 
and explanatory statements on the website 
are maintained as open Government data 
assets.’’; and 
VerDate Sep 11 2014 
00:14 Aug 23, 2023
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H5218.IH
H5218
kjohnson on DSK79L0C42PROD with BILLS
(3) in subsection (c), by striking paragraph (1) 
and inserting the following: 
‘‘(1) IN
GENERAL.—The head of a covered 
agency shall oversee and manage the data center 
portfolio and the information technology strategy of 
the covered agency in accordance with Federal cy-
bersecurity guidelines and directives, including— 
‘‘(A) information security standards and 
guidelines promulgated by the Director of the 
National Institute of Standards and Tech-
nology; 
‘‘(B) applicable requirements and guidance 
issued by the Director of the Office of Manage-
ment and Budget pursuant to section 3614 of 
title 44, United States Code; and 
‘‘(C) directives issued by the Secretary of 
Homeland Security under section 3553 of title 
44, United States Code.’’. 
(c) EXTENSION OF SUNSET.—Section 834(e) of the 
Carl Levin and Howard P. ‘‘Buck’’ McKeon National De-
fense Authorization Act for Fiscal Year 2015 (44 U.S.C. 
3601 note; Public Law 113–291) is amended by striking 
‘‘2022’’ and inserting ‘‘2026’’. 
(d) GAO REVIEW.—Not later than 1 year after the 
date of the enactment of this Act, and annually thereafter, 
VerDate Sep 11 2014 
00:14 Aug 23, 2023
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H5218.IH
H5218
kjohnson on DSK79L0C42PROD with BILLS
the Comptroller General of the United States shall review, 
verify, and audit the compliance of covered agencies with 
the minimum requirements established pursuant to section 
834(b)(1) of the Carl Levin and Howard P. ‘‘Buck’’ 
McKeon National Defense Authorization Act for Fiscal 
Year 2015 (44 U.S.C. 3601 note; Public Law 113–291) 
for new data centers and subsection (b)(3) of that Act for 
existing data centers, as appropriate. 
Æ 
VerDate Sep 11 2014 
00:14 Aug 23, 2023
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6301
E:\BILLS\H5218.IH
H5218
kjohnson on DSK79L0C42PROD with BILLS