IIB 
117TH CONGRESS 
1ST SESSION H. R. 4611 
IN THE SENATE OF THE UNITED STATES 
OCTOBER 21, 2021 
Received; read twice and referred to the Committee on Homeland Security and 
Governmental Affairs 
AN ACT 
To direct the Secretary of Homeland Security to issue guid-
ance with respect to certain information and communica-
tions technology or services contracts, and for other pur-
poses. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Sep 11 2014 
02:34 Oct 22, 2021
Jkt 029200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H4611.RFS
H4611
pbinns on DSKJLVW7X2PROD with BILLS
HR 4611 RFS
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘DHS Software Supply 
Chain Risk Management Act of 2021’’. 
SEC. 2. DEPARTMENT OF HOMELAND SECURITY GUIDANCE 
WITH RESPECT TO CERTAIN INFORMATION 
AND 
COMMUNICATIONS 
TECHNOLOGY 
OR 
SERVICES CONTRACTS. 
(a) GUIDANCE.—The Secretary of Homeland Secu-
rity, acting through the Under Secretary, shall issue guid-
ance with respect to new and existing covered contracts. 
(b) NEW
COVERED
CONTRACTS.—In developing 
guidance under subsection (a), with respect to each new 
covered contract, as a condition on the award of such a 
contract, each contractor responding to a solicitation for 
such a contract shall submit to the covered officer— 
(1) a planned bill of materials when submitting 
a bid proposal; and 
(2) the certification and notifications described 
in subsection (e). 
(c) EXISTING COVERED CONTRACTS.—In developing 
guidance under subsection (a), with respect to each exist-
ing covered contract, each contractor with an existing cov-
ered contract shall submit to the covered officer— 
(1) the bill of materials used for such contract, 
upon the request of such officer; and 
VerDate Sep 11 2014 
02:34 Oct 22, 2021
Jkt 029200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H4611.RFS
H4611
pbinns on DSKJLVW7X2PROD with BILLS
HR 4611 RFS
(2) the certification and notifications described 
in subsection (e). 
(d) UPDATING BILL OF MATERIALS.—With respect 
to a covered contract, in the case of a change to the infor-
mation included in a bill of materials submitted pursuant 
to subsections (b)(1) and (c)(1), each contractor shall sub-
mit to the covered officer the update to such bill of mate-
rials, in a timely manner. 
(e) CERTIFICATION AND NOTIFICATIONS.—The cer-
tification and notifications referred to in subsections 
(b)(2) and (c)(2), with respect to a covered contract, are 
the following: 
(1) A certification that each item listed on the 
submitted bill of materials is free from all known 
vulnerabilities or defects affecting the security of the 
end product or service identified in— 
(A) the National Institute of Standards 
and Technology National Vulnerability Data-
base; and 
(B) any database designated by the Under 
Secretary, in coordination with the Director of 
the Cybersecurity and Infrastructure Security 
Agency, that tracks security vulnerabilities and 
defects in open source or third-party developed 
software. 
VerDate Sep 11 2014 
02:34 Oct 22, 2021
Jkt 029200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4611.RFS
H4611
pbinns on DSKJLVW7X2PROD with BILLS
HR 4611 RFS
(2) A notification of each vulnerability or defect 
affecting the security of the end product or service, 
if identified, through— 
(A) the certification of such submitted bill 
of materials required under paragraph (1); or 
(B) any other manner of identification. 
(3) A notification relating to the plan to miti-
gate, repair, or resolve each security vulnerability or 
defect listed in the notification required under para-
graph (2). 
(f) ENFORCEMENT.—In developing guidance under 
subsection (a), the Secretary shall instruct covered officers 
with respect to— 
(1) the processes available to such officers en-
forcing subsections (b) and (c); and 
(2) when such processes should be used. 
(g) EFFECTIVE DATE.—The guidance required under 
subsection (a) shall take effect on the date that is 180 
days after the date of the enactment of this section. 
(h) GAO REPORT.—Not later than 1 year after the 
date of the enactment of this Act, the Comptroller General 
of the United States shall submit to the Secretary, the 
Committee on Homeland Security of the House of Rep-
resentatives, and the Committee on Homeland Security 
VerDate Sep 11 2014 
02:34 Oct 22, 2021
Jkt 029200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4611.RFS
H4611
pbinns on DSKJLVW7X2PROD with BILLS
HR 4611 RFS
and Governmental Affairs of the Senate a report that in-
cludes— 
(1) a review of the implementation of this sec-
tion; 
(2) information relating to the engagement of 
the Department of Homeland Security with indus-
try; 
(3) an assessment of how the guidance issued 
pursuant to subsection (a) complies with Executive 
Order 14208 (86 Fed. Reg. 26633; relating to im-
proving the nation’s cybersecurity); and 
(4) any recommendations relating to improving 
the supply chain with respect to covered contracts. 
(i) DEFINITIONS.—In this section: 
(1) BILL OF MATERIALS.—The term ‘‘bill of 
materials’’ means a list of the parts and components 
(whether new or reused) of an end product or serv-
ice, including, with respect to each part and compo-
nent, information relating to the origin, composition, 
integrity, and any other information as determined 
appropriate by the Under Secretary. 
(2) COVERED CONTRACT.—The term ‘‘covered 
contract’’ means a contract relating to the procure-
ment of covered information and communications 
VerDate Sep 11 2014 
02:34 Oct 22, 2021
Jkt 029200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4611.RFS
H4611
pbinns on DSKJLVW7X2PROD with BILLS
HR 4611 RFS
technology or services for the Department of Home-
land Security. 
(3) COVERED INFORMATION AND COMMUNICA-
TIONS TECHNOLOGY OR SERVICES.—The term ‘‘cov-
ered information and communications technology or 
services’’ means the terms— 
(A) ‘‘information technology’’ (as such 
term is defined in section 11101(6) of title 40, 
United States Code); 
(B) ‘‘information system’’ (as such term is 
defined in section 3502(8) of title 44, United 
States Code); 
(C) ‘‘telecommunications equipment’’ (as 
such term is defined in section 3(52) of the 
Communications Act of 1934 (47 U.S.C. 
153(52))); and 
(D) ‘‘telecommunications service’’ (as such 
term is defined in section 3(53) of the Commu-
nications Act of 1934 (47 U.S.C. 153(53))). 
(4) COVERED OFFICER.—The term ‘‘covered of-
ficer’’ means— 
(A) a contracting officer of the Depart-
ment; and 
(B) any other official of the Department as 
determined appropriate by the Under Secretary. 
VerDate Sep 11 2014 
02:34 Oct 22, 2021
Jkt 029200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4611.RFS
H4611
pbinns on DSKJLVW7X2PROD with BILLS
HR 4611 RFS
(5) SOFTWARE.—The term ‘‘software’’ means 
computer programs and associated data that may be 
dynamically written or modified during execution. 
(6) UNDER
SECRETARY.—The term ‘‘Under 
Secretary’’ means the Under Secretary for Manage-
ment of the Department of Homeland Security. 
SEC. 3. DETERMINATION OF BUDGETARY EFFECTS. 
The budgetary effects of this Act, for the purpose of 
complying with the Statutory Pay-As-You-Go Act of 2010, 
shall be determined by reference to the latest statement 
titled ‘‘Budgetary Effects of PAYGO Legislation’’ for this 
Act, submitted for printing in the Congressional Record 
by the Chairman of the House Budget Committee, pro-
vided that such statement has been submitted prior to the 
vote on passage. 
Passed the House of Representatives October 20, 
2021. 
Attest: 
CHERYL L. JOHNSON, 
Clerk. 
VerDate Sep 11 2014 
02:34 Oct 22, 2021
Jkt 029200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4611.RFS
H4611
pbinns on DSKJLVW7X2PROD with BILLS