(i) in subparagraph (B) by striking 
the period at the end and inserting ‘‘; 
and’’; and 
(ii) by inserting after subparagraph 
(B) the following; 
‘‘(C) a senior official from the Cybersecu-
rity and Infrastructure Security Agency of the 
Department of Homeland Security, appointed 
by the Director of the Cybersecurity and Infra-
structure Security Agency, with the approval of 
the Director of the Office of Management and 
Budget.’’; 
(B) in paragraph (6)(A)— 
(i) by striking ‘‘shall be—’’ and in-
serting ‘‘shall be 4 employees of the Fed-
eral Government primarily having technical 
expertise in information technology devel-
opment, financial management, cybersecu-
rity and privacy, and acquisition, ap-
pointed by the Director.’’; and 
(ii) by striking clauses (i) and (ii); 
and 
(4) in subsection (d)(2)— 
(A) in subparagraph (A), by striking ‘‘sub-
section (b)(3)(A) and for products, services, and
acquisition vehicles funded under subsection 
(b)(3)(B)’’ and inserting ‘‘subsection (b)(3)’’; 
and 
(B) in subparagraph (C), by inserting after 
‘‘and reduce waste’’ the following: ‘‘and ensure 
total amounts in the Fund are no less than the 
amounts needed to keep the Fund operational 
until the Fund sunsets pursuant to subsection 
(g)(1)’’; 
(5) by redesignating subsections (e) and (f) as 
subsections (f) and (g), respectively; 
(6) by inserting after subsection (d) the fol-
lowing new subsection: 
‘‘(e) RESPONSIBILITIES OF THE FEDERAL CHIEF IN-
FORMATION OFFICER; AGENCY CHIEF INFORMATION OF-
FICERS.— 
‘‘(1) AGENCY
INVENTORY.—An agency Chief 
Information Officer, in coordination with stake-
holders and other agency officials, shall provide to 
the Federal Chief Information Officer— 
‘‘(A) on or before the first September 30 
that occurs after the date of the enactment of 
the Modernizing Government Technology Re-
form Act of 2023, a list of high-risk legacy in-
formation technology systems used, operated, or
maintained by the agency, in accordance with 
the guidance issued under paragraph (4); and 
‘‘(B) on or before September 30 of each 
year after the first year in which the list is pro-
vided under subparagraph (A), any updates to 
such list. 
‘‘(2) LEGACY
FEDERAL
IT
INVENTORY.—The 
Federal Chief Information Officer shall— 
‘‘(A) on or before the first December 30 
that occurs after the date of the enactment of 
the Modernizing Government Technology Re-
form Act of 2023, compile a Legacy Federal IT 
Inventory on the basis of the each list provided 
by an agency Chief Information Officers under 
paragraph (1)(A) that includes information 
about each high-risk legacy information tech-
nology system used, operated, or maintained by 
an agency; and 
‘‘(B) on or before December 30 each year 
after the year in which the Legacy Federal IT 
Inventory is compiled, update such Inventory on 
the basis of each update to the list provided by 
an agency Chief Information Officer under 
paragraph (1)(B). 
‘‘(3) PRIORITIZATION LIST.—
‘‘(A) REQUIREMENT.—The Federal Chief 
Information Officer shall— 
‘‘(i) not later than 90 days after the 
date on which the Federal Chief Informa-
tion Officer receives the list required by 
paragraph (1)(A) from each agency Chief 
Information Officer, compile, on the basis 
of each such list, a list of 10 legacy infor-
mation technology systems that present the 
greatest security, privacy, and operational 
risks to the Federal Government; and 
‘‘(ii) not later than 90 days after the 
date on which the Federal Chief Informa-
tion Officer receives updates under para-
graph (1)(B) from each agency Chief In-
formation Officer, update the list required 
by subparagraph (A) on the basis of each 
updates to the list provided by agency 
Chief information Officers under para-
graph (1)(B). 
‘‘(B) REPORT
TO
CONGRESS.—Not later 
than 14 days after the date on which the Fed-
eral Chief Information Officer compiles the list 
required by subparagraph (A), or updates such 
list, the Director shall submit to the Committee
on Oversight and Accountability of the House 
of Representatives, the Committee on Home-
land Security and Governmental Affairs of the 
Senate, and the Comptroller General of the 
United States, a report (which may include a 
classified annex) containing— 
‘‘(i) such list (including any update 
made to such list under subparagraph 
(A)(ii)); and 
‘‘(ii) each list provided by an agency 
Chief Information Officer under paragraph 
(1)(A) (including any update made to any 
such list under paragraph (1)(B)). 
‘‘(4) GUIDANCE.— 
‘‘(A) IN
GENERAL.—Not later than 180 
days after enactment of this Act, the Director 
shall issue guidance on implementing the re-
quirements of this subsection that shall, at a 
minimum— 
‘‘(i) prescribe an appropriate format 
for list to be provided under paragraph 
(1)(A); 
‘‘(ii) prescribe the information to be 
included in the Legacy Federal IT Inven-
tory required by paragraph (2);
‘‘(A) AGENCY CHIEF INFORMATION OFFI-
CER.—The term ‘agency Chief Information Of-
ficer’ means a Chief Information Officer des-
ignated under section 3506(a)(2) of title 44, 
United States Code. 
‘‘(B) FEDERAL CHIEF INFORMATION OFFI-
CER.—The term ‘Federal Chief Information Of-
ficer’ means the Administrator of the Office of 
Electronic Government.’’; and 
(7) in subsection (g)(1), as so redesignated, by 
striking ‘‘On and after the date that is 2 years after 
the date on which the Comptroller General of the 
United States issues the third report required under 
subsection (b)(7)(B),’’ and inserting ‘‘After Decem-
ber 31, 2031,’’. 
Passed the House of Representatives May 21, 2024. 
Attest: 
Clerk.
118TH CONGRESS 
2D SESSION 
H. R. 5527 
AN ACT 
To amend section 1078 of the National Defense 
Authorization Act for Fiscal Year 2018 to in-
crease the effectiveness of the Technology Mod-
ernization Fund, and for other purposes.