mation included in a bill of materials submitted pursuant 
to subsections (b)(1) and (c)(1), each contractor shall sub-
mit to the covered officer the update to such bill of mate-
rials, in a timely manner. 
(e) CERTIFICATION AND NOTIFICATIONS.—The cer-
tification and notifications referred to in subsections 
(b)(2) and (c)(2), with respect to a covered contract, are 
the following: 
(1) A certification that each item listed on the 
submitted bill of materials is free from all known se-
curity vulnerabilities or defects identified in— 
(A) the National Institute of Standards 
and Technology National Vulnerability Data-
base; and 
(B) any database designated by the Under 
Secretary, in coordination with the Director of 
the Cybersecurity and Infrastructure Security 
Agency, that tracks security vulnerabilities and 
defects in open source or third-party developed 
software. 
(2) A notification of each security vulnerability 
or defect, if identified, through— 
(A) the certification of such submitted bill 
of materials required under paragraph (1); or 
(B) any other manner of identification. 
VerDate Sep 11 2014 
00:56 Aug 05, 2021
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4611.IH
H4611
kjohnson on DSK79L0C42PROD with BILLS
(3) A notification relating to the plan to miti-
gate, repair, or resolve each security vulnerability or 
defect listed in the notification required under para-
graph (2). 
(f) ENFORCEMENT.—In developing guidance under 
subsection (a), the Secretary shall instruct covered officers 
with respect to— 
(1) the processes available to such officers en-
forcing subsections (b) and (c); and 
(2) when such processes should be used. 
(g) EFFECTIVE DATE.—The guidance required under 
subsection (a) shall take effect on the date that is 180 
days after the date of the enactment of this section. 
(h) DEFINITIONS.—In this section: 
(1) BILL OF MATERIALS.—The term ‘‘bill of 
materials’’ means a list of the parts and components 
of an end product or service, including, with respect 
to each part and component, information relating to 
the origin, composition, integrity, and any other in-
formation as determined appropriate by the Under 
Secretary. 
(2) COVERED CONTRACT.—The term ‘‘covered 
contract’’ means a contract relating to the procure-
ment of covered information and communications 
VerDate Sep 11 2014 
00:56 Aug 05, 2021
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4611.IH
H4611
kjohnson on DSK79L0C42PROD with BILLS
technology or services for the Department of Home-
land Security. 
(3) COVERED INFORMATION AND COMMUNICA-
TIONS TECHNOLOGY OR SERVICES.—The term ‘‘cov-
ered information and communications technology or 
services’’ means the terms— 
(A) ‘‘information technology’’ (as such 
term is defined in section 11101(6) of title 40, 
United States Code); 
(B) ‘‘information system’’ (as such term is 
defined in section 3502(8) of title 44, United 
States Code); 
(C) ‘‘telecommunications equipment’’ (as 
such term is defined in section 3(52) of the 
Communications Act of 1934 (47 U.S.C. 
153(52))); and 
(D) ‘‘telecommunications service’’ (as such 
term is defined in section 3(53) of the Commu-
nications Act of 1934 (47 U.S.C. 153(53))). 
(4) COVERED OFFICER.—The term ‘‘covered of-
ficer’’ means— 
(A) a contracting officer of the Depart-
ment; and 
(B) any other official of the Department as 
determined appropriate by the Under Secretary. 
VerDate Sep 11 2014 
00:56 Aug 05, 2021
Jkt 019200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4611.IH
H4611
kjohnson on DSK79L0C42PROD with BILLS
(5) SOFTWARE.—The term ‘‘software’’ means 
computer programs and associated data that may be 
dynamically written or modified during execution. 
(6) UNDER
SECRETARY.—The term ‘‘Under 
Secretary’’ means the Under Secretary for Manage-
ment of the Department of Homeland Security. 
Æ 
VerDate Sep 11 2014 
00:56 Aug 05, 2021
Jkt 019200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6301
E:\BILLS\H4611.IH
H4611
kjohnson on DSK79L0C42PROD with BILLS