IB 
Union Calendar No. 127 
118TH CONGRESS 
1ST SESSION H. R. 3286 
[Report No. 118–160, Part I] 
To amend the Homeland Security Act of 2002 to establish the duties of 
the Director of the Cybersecurity and Infrastructure Security Agency 
regarding open source software security, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MAY 15, 2023 
Mr. GREEN of Tennessee (for himself, Mr. GARBARINO, and Mr. SWALWELL) 
introduced the following bill; which was referred to the Committee on 
Homeland Security, and in addition to the Committee on Oversight and 
Accountability, for a period to be subsequently determined by the Speak-
er, in each case for consideration of such provisions as fall within the ju-
risdiction of the committee concerned 
JULY 27, 2023 
Additional sponsor: Mr. LALOTA 
JULY 27, 2023 
Reported from the Committee on Homeland Security with an amendment 
[Strike out all after the enacting clause and insert the part printed in italic] 
JULY 27, 2023 
Committee on Oversight and Accountability discharged; committed to the 
Committee of the Whole House on the State of the Union and ordered 
to be printed 
[For text of introduced bill, see copy of bill as introduced on May 15, 2023] 
VerDate Sep 11 2014 
01:05 Jul 28, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H3286.RH
H3286
kjohnson on DSK79L0C42PROD with BILLS
A BILL 
To amend the Homeland Security Act of 2002 to establish 
the duties of the Director of the Cybersecurity and Infra-
structure Security Agency regarding open source soft-
ware security, and for other purposes. 
VerDate Sep 11 2014 
01:05 Jul 28, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H3286.RH
H3286
kjohnson on DSK79L0C42PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Securing Open Source 
Software Act of 2023’’. 
SEC. 2. OPEN SOURCE SOFTWARE SECURITY DUTIES. 
(a) IN GENERAL.—Title XXII of the Homeland Secu-
rity Act of 2002 (6 U.S.C. 650 et seq.) is amended— 
(1) in section 2200 (6 U.S.C. 650)— 
(A) by redesignating paragraphs (22) 
through (28) as paragraphs (25) through (31), 
respectively; and 
(B) by inserting after paragraph (21) the 
following new paragraphs: 
‘‘(22) OPEN
SOURCE
SOFTWARE.—The term 
‘open source software’ means software for which the 
human-readable source code is made available to the 
public for use, study, re-use, modification, enhance-
ment, and re-distribution. 
‘‘(23) OPEN SOURCE SOFTWARE COMMUNITY.— 
The term ‘open source software community’ means the 
community of individuals, foundations, nonprofit or-
ganizations, corporations, and other entities that— 
‘‘(A) develop, contribute to, maintain, and 
publish open source software; or 
VerDate Sep 11 2014 
01:05 Jul 28, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H3286.RH
H3286
kjohnson on DSK79L0C42PROD with BILLS
‘‘(B) otherwise work to ensure the security 
of the open source software ecosystem. 
‘‘(24) OPEN SOURCE SOFTWARE COMPONENT.— 
The term ‘open source software component’ means an 
individual repository of open source software that is 
made available to the public.’’; 
(2) in section 2202(c) (6 U.S.C. 652(c))— 
(A) in paragraph (13), by striking ‘‘and’’ 
at the end; 
(B) by redesignating paragraph (14) as 
paragraph (15); and 
(C) by inserting after paragraph (13) the 
following: 
‘‘(14) support, including by offering services, the 
secure usage and deployment of software, including 
open source software, in the software development 
lifecycle at Federal agencies in accordance with sec-
tion 2220F; and’’; and 
(3) by adding at the end the following: 
‘‘SEC. 2220F. OPEN SOURCE SOFTWARE SECURITY DUTIES. 
‘‘(a) DEFINITION.—In this section, the term ‘software 
bill of materials’ has the meaning given such term in the 
Minimum Elements for a Software Bill of Materials pub-
lished by the Department of Commerce, or any superseding 
definition published by the Agency. 
VerDate Sep 11 2014 
01:05 Jul 28, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H3286.RH
H3286
kjohnson on DSK79L0C42PROD with BILLS
‘‘(b) EMPLOYMENT.—The Director shall, to the greatest 
extent practicable, employ individuals in the Agency who— 
‘‘(1) have expertise and experience participating 
in the open source software community; and 
‘‘(2) perform the duties described in subsection 
(c). 
‘‘(c) DUTIES OF THE DIRECTOR.— 
‘‘(1) IN GENERAL.—The Director shall— 
‘‘(A) perform outreach and engagement to 
bolster the security of open source software; 
‘‘(B) support Federal efforts to strengthen 
the security of open source software; 
‘‘(C) coordinate, as appropriate, with non- 
Federal entities on efforts to ensure the long-term 
security of open source software; 
‘‘(D) serve as a public point of contact re-
garding the security of open source software for 
non-Federal entities, including State, local, Trib-
al, and territorial partners, the private sector, 
international partners, and open source software 
communities; and 
‘‘(E) support Federal and non-Federal sup-
ply chain security efforts by encouraging efforts 
to bolster open source software security, such 
as— 
VerDate Sep 11 2014 
01:05 Jul 28, 2023
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H3286.RH
H3286
kjohnson on DSK79L0C42PROD with BILLS
‘‘(i) assisting in coordinated vulner-
ability disclosures in open source software 
components pursuant to section 2209(n); 
and 
‘‘(ii) supporting the activities of the 
Federal Acquisition Security Council. 
‘‘(2) ASSESSMENT OF CRITICAL OPEN SOURCE 
SOFTWARE COMPONENTS.— 
‘‘(A) FRAMEWORK.—Not later than one 
year after the date of the enactment of this sec-
tion, the Director shall publicly publish a frame-
work, incorporating government, private sector, 
and open source software community frameworks 
and best practices, including those published by 
the National Institute of Standards and Tech-
nology, for assessing the risk of open source soft-
ware components, including direct and indirect 
open source software dependencies, which shall 
incorporate, at a minimum, the following with 
respect to a given open source software compo-
nent: 
‘‘(i) The security properties of code, 
such as whether the code is written in a 
memory-safe programming language or suc-
cessor language. 
VerDate Sep 11 2014 
01:05 Jul 28, 2023
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H3286.RH
H3286
kjohnson on DSK79L0C42PROD with BILLS
‘‘(ii) The security practices of develop-
ment, build, and release processes, such as 
the use of multi-factor authentication by 
maintainers and cryptographic signing of 
releases. 
‘‘(iii) The number and severity of pub-
licly known, unpatched vulnerabilities. 
‘‘(iv) The breadth of deployment. 
‘‘(v) The level of risk associated with 
where such component is integrated or de-
ployed, such as whether such component op-
erates on a network boundary or in a privi-
leged location. 
‘‘(vi) The health and sustainability of 
the open source software community, in-
cluding, where applicable, the level of cur-
rent and historical investment and mainte-
nance in such component, such as the num-
ber and activity of individual maintainers. 
‘‘(B) UPDATING FRAMEWORK.—Not less fre-
quently than annually after the date on which 
the framework is published under subparagraph 
(A), the Director shall— 
‘‘(i) determine whether updates are 
needed to such framework, including the 
VerDate Sep 11 2014 
01:05 Jul 28, 2023
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H3286.RH
H3286
kjohnson on DSK79L0C42PROD with BILLS
augmentation, addition, or removal of the 
elements described in clauses (i) through 
(vi) of such subparagraph; and 
‘‘(ii) if the Director so determines that 
such additional updates are needed, make 
such updates. 
‘‘(C) DEVELOPING FRAMEWORK.—In devel-
oping the framework described in subparagraph 
(A), the Director shall consult with the following: 
‘‘(i) Appropriate Federal agencies, in-
cluding the National Institute of Standards 
and Technology. 
‘‘(ii) The open source software commu-
nity. 
‘‘(D) USABILITY.—The Director shall en-
sure, to the greatest extent practicable, that the 
framework described in subparagraph (A) is usa-
ble by the open source software community, in-
cluding through the consultation required under 
subparagraph (C). 
‘‘(E) FEDERAL
OPEN
SOURCE
SOFTWARE 
ASSESSMENT.—Not later than one year after the 
publication of the framework under subpara-
graph (A) and not less frequently than every two 
years thereafter, the Director shall, to the great-
VerDate Sep 11 2014 
01:05 Jul 28, 2023
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H3286.RH
H3286
kjohnson on DSK79L0C42PROD with BILLS
est extent practicable and using such frame-
work— 
‘‘(i) perform an assessment of each 
open source software component deployed on 
high value assets, as described in Office of 
Management and Budget memorandum M- 
19-03 (issued December 10, 2018) or suc-
cessor guidance, at Federal agencies based 
on readily available, and, to the greatest ex-
tent practicable, machine readable, informa-
tion, such as— 
‘‘(I) software bills of material that 
are, at the time of the assessment, 
made available to the Agency or are 
otherwise accessible via the internet; 
‘‘(II) software inventories, avail-
able to the Director at the time of the 
assessment, 
from 
the 
Continuous 
Diagnostics and Mitigation program of 
the Agency; and 
‘‘(III) other publicly available in-
formation regarding open source soft-
ware components; and 
‘‘(ii) develop, in consultation with the 
Federal agency at which an open source 
VerDate Sep 11 2014 
01:05 Jul 28, 2023
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H3286.RH
H3286
kjohnson on DSK79L0C42PROD with BILLS
software component is deployed, one or 
more ranked lists of components described 
in clause (i) based on such assessment, such 
as ranked by the criticality, level of risk, or 
usage of the components, or a combination 
thereof. 
‘‘(F) AUTOMATION.—The Director shall, to 
the greatest extent practicable, automate the as-
sessment performed pursuant to subparagraph 
(E). 
‘‘(G) PUBLICATION.—The Director shall 
publicly publish and maintain any tools devel-
oped to perform the assessment under subpara-
graph (E) as open source software. 
‘‘(H) SHARING.— 
‘‘(i) RESULTS.—The Director, to the 
greatest extent practicable, and taking into 
account the sensitivity of the information 
contained in the assessment performed pur-
suant to subparagraph (E), shall facilitate 
the sharing of the results of each assessment 
under subparagraph (E)(i) with appro-
priate Federal and non-Federal entities 
working to support the security of open 
source software, including by offering means 
VerDate Sep 11 2014 
01:05 Jul 28, 2023
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6203
E:\BILLS\H3286.RH
H3286
kjohnson on DSK79L0C42PROD with BILLS
for appropriate Federal and non-Federal 
entities to download the assessment in an 
automated manner. 
‘‘(ii) DATASETS.—The Director may 
publicly 
publish, 
as 
appropriate, 
any 
datasets or versions of the datasets developed 
or consolidated as a result of an assessment 
under subparagraph (E)(i). 
‘‘(I) CRITICAL
INFRASTRUCTURE
ASSESS-
MENT STUDY AND PILOT.— 
‘‘(i) STUDY.—Not later than two years 
after the publication of the framework under 
subparagraph (A), the Director shall con-
duct a study regarding the feasibility of the 
Director conducting the assessment under 
subparagraph (E) for critical infrastructure 
entities. 
‘‘(ii) PILOT.— 
‘‘(I) IN GENERAL.—If the Director 
determines that the assessment de-
scribed in clause (i) is feasible, the Di-
rector may conduct a pilot assessment 
on a voluntary basis with one or more 
critical infrastructure sectors, in co-
ordination with the Sector Risk Man-
VerDate Sep 11 2014 
01:05 Jul 28, 2023
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6203
E:\BILLS\H3286.RH
H3286
kjohnson on DSK79L0C42PROD with BILLS
agement Agency and the sector coordi-
nating council of each participating 
sector. 
‘‘(II) TERMINATION.—If the Di-
rector proceeds with the pilot assess-
ment described in subclause (I), such 
pilot assessment shall terminate not 
later than two years after the date on 
which the Director begins such pilot 
assessment. 
‘‘(iii) REPORTS.— 
‘‘(I) STUDY.—Not later than 180 
days after the date on which the Direc-
tor completes the study conducted 
under clause (i), the Director shall sub-
mit to the appropriate congressional 
committees a report that— 
‘‘(aa) summarizes the study; 
‘‘(bb) states whether the Di-
rector plans to proceed with the 
pilot 
assessment 
described 
in 
clause (ii)(I); and 
‘‘(cc) if the Director proceeds 
with such pilot assessment, de-
scribes— 
VerDate Sep 11 2014 
01:05 Jul 28, 2023
Jkt 039200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6203
E:\BILLS\H3286.RH
H3286
kjohnson on DSK79L0C42PROD with BILLS
‘‘(AA) the methodology 
for selecting the critical in-
frastructure sector or sectors 
to participate in the pilot; 
and 
‘‘(BB) the resources re-
quired to carry out the pilot. 
‘‘(II) PILOT.—If the Director pro-
ceeds with the pilot assessment de-
scribed in clause (ii), not later than 
one year after the date on which the 
Director begins such pilot assessment, 
the Director shall submit to the appro-
priate congressional committees a re-
port that includes the following: 
‘‘(aa) A summary of the re-
sults of such pilot assessment. 
‘‘(bb) A recommendation as 
to whether the activities carried 
out under such pilot assessment 
should be continued after the ter-
mination of such pilot assessment 
in accordance with clause (ii)(II). 
‘‘(3) CONSULTATION WITH NATIONAL CYBER DI-
RECTOR.—The Director shall— 
VerDate Sep 11 2014 
01:05 Jul 28, 2023
Jkt 039200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6203
E:\BILLS\H3286.RH
H3286
kjohnson on DSK79L0C42PROD with BILLS
‘‘(A) brief the National Cyber Director on 
the activities described in this subsection; and 
‘‘(B) consult with the National Cyber Direc-
tor regarding such activities, as appropriate. 
‘‘(4) REPORTS.— 
‘‘(A) IN GENERAL.—Not later than one year 
after the date of the enactment of this section 
and every two years thereafter for the following 
six years, the Director shall submit to the appro-
priate congressional committees a report that in-
cludes for the period covered by each such report 
the following: 
‘‘(i) A summary of the work on open 
source software security performed by the 
Director, including a list of the Federal and 
non-Federal entities with which the Director 
interfaced. 
‘‘(ii) The framework under paragraph 
(2)(A) or a summary of any updates to 
such framework pursuant to paragraph 
(2)(B), as the case may be. 
‘‘(iii) A summary of each assessment 
under paragraph (2)(E)(i). 
VerDate Sep 11 2014 
01:05 Jul 28, 2023
Jkt 039200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6203
E:\BILLS\H3286.RH
H3286
kjohnson on DSK79L0C42PROD with BILLS
‘‘(iv) A summary of changes made to 
each such assessment, including overall se-
curity trends. 
‘‘(v) A summary of the types of entities 
with which each such assessment was shared 
pursuant to paragraph (2)(H), including a 
list of the Federal and non-Federal entities 
with which such assessment was shared. 
‘‘(vi) Information on resources, includ-
ing staffing, allocated to the Director’s open 
source software responsibilities under this 
section. 
‘‘(B) PUBLIC REPORT.—Not later than 30 
days after the date on which the Director sub-
mits each report required under subparagraph 
(A), the Director shall make a version of each 
such report publicly available on the website of 
the Agency.’’. 
(b) TECHNICAL AND CONFORMING AMENDMENT.—The 
table of contents in section 1(b) of the Homeland Security 
Act of 2002 is amended by inserting after the item relating 
to section 2220E the following new item: 
‘‘Sec. 2220F. Open source software security duties.’’. 
(c) 
SOFTWARE
SECURITY
ADVISORY
SUB-
COMMITTEE.—Section 2219(d)(1) of the Homeland Security 
VerDate Sep 11 2014 
01:05 Jul 28, 2023
Jkt 039200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6203
E:\BILLS\H3286.RH
H3286
kjohnson on DSK79L0C42PROD with BILLS
Act of 2002 (6 U.S.C. 665e(d)(1)) is amended by adding 
at the end the following: 
‘‘(E) Software security, including open 
source software security.’’. 
(d) RULE OF CONSTRUCTION.—Nothing in this Act or 
the amendments made by this Act may be construed to pro-
vide any additional regulatory authority to any Federal 
agency described therein. 
VerDate Sep 11 2014 
01:05 Jul 28, 2023
Jkt 039200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6203
E:\BILLS\H3286.RH
H3286
kjohnson on DSK79L0C42PROD with BILLS
VerDate Sep 11 2014 
01:05 Jul 28, 2023
Jkt 039200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6203
E:\BILLS\H3286.RH
H3286
kjohnson on DSK79L0C42PROD with BILLS
Union Calendar No. 127 
118TH CONGRESS 
1ST SESSION 
H. R. 3286 
[Report No. 118–160, Part I] 
A BILL 
To amend the Homeland Security Act of 2002 to 
establish the duties of the Director of the Cyber-
security and Infrastructure Security Agency re-
garding open source software security, and for 
other purposes. 
JULY 27, 2023 
Reported from the Committee on Homeland Security 
with an amendment 
JULY 27, 2023 
Committee on Oversight and Accountability discharged; 
committed to the Committee of the Whole House on 
the State of the Union and ordered to be printed 
VerDate Sep 11 2014 
01:05 Jul 28, 2023
Jkt 039200
PO 00000
Frm 00018
Fmt 6651
Sfmt 6651
E:\BILLS\H3286.RH
H3286
kjohnson on DSK79L0C42PROD with BILLS