an individual repository of open source software that 
is made available to the public.’’; 
(2) in section 2202(c) (6 U.S.C. 652(c))— 
(A) in paragraph (13), by striking ‘‘and’’ 
at the end; 
(B) by redesignating paragraph (14) as 
paragraph (15); and 
(C) by inserting after paragraph (13) the 
following: 
‘‘(14) support, including by offering services, 
the secure usage and deployment of software, includ-
ing open source software, in the software develop-
ment lifecycle at Federal agencies in accordance with 
section 2220F; and’’; and 
(3) by adding at the end the following: 
‘‘SEC. 2220F. OPEN SOURCE SOFTWARE SECURITY DUTIES. 
‘‘(a) DEFINITION.—In this section, the term ‘soft-
ware bill of materials’ has the meaning given such term 
in the Minimum Elements for a Software Bill of Materials 
published by the Department of Commerce, or any super-
seding definition published by the Agency. 
‘‘(b) EMPLOYMENT.—The Director shall, to the 
greatest extent practicable, employ individuals in the 
Agency who— 
VerDate Sep 11 2014 
00:17 May 27, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3286.IH
H3286
kjohnson on DSK79L0C42PROD with BILLS
‘‘(1) have expertise and experience participating 
in the open source software community; and 
‘‘(2) perform the duties described in subsection 
(c). 
‘‘(c) DUTIES OF THE DIRECTOR.— 
‘‘(1) IN GENERAL.—The Director shall— 
‘‘(A) perform outreach and engagement to 
bolster the security of open source software; 
‘‘(B) support Federal efforts to strengthen 
the security of open source software; 
‘‘(C) coordinate, as appropriate, with non- 
Federal entities on efforts to ensure the long- 
term security of open source software; 
‘‘(D) serve as a public point of contact re-
garding the security of open source software for 
non-Federal entities, including State, local, 
Tribal, and territorial partners, the private sec-
tor, international partners, and open source 
software communities; and 
‘‘(E) support Federal and non-Federal 
supply chain security efforts by encouraging ef-
forts to bolster open source software security, 
such as— 
‘‘(i) assisting in coordinated vulner-
ability disclosures in open source software 
VerDate Sep 11 2014 
00:17 May 27, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3286.IH
H3286
kjohnson on DSK79L0C42PROD with BILLS
components pursuant to section 2209(n); 
and 
‘‘(ii) supporting the activities of the 
Federal Acquisition Security Council. 
‘‘(2) ASSESSMENT OF CRITICAL OPEN SOURCE 
SOFTWARE COMPONENTS.— 
‘‘(A) FRAMEWORK.—Not later than one 
year after the date of the enactment of this sec-
tion, the Director shall publicly publish a 
framework, incorporating government, private 
sector, and open source software community 
frameworks and best practices, including those 
published by the National Institute of Stand-
ards and Technology, for assessing the risk of 
open source software components, including di-
rect and indirect open source software depend-
encies, which shall incorporate, at a minimum, 
the following with respect to a given open 
source software component: 
‘‘(i) The security properties of code, 
such as whether the code is written in a 
memory-safe programming language. 
‘‘(ii) The security practices of develop-
ment, build, and release processes, such as 
the use of multi-factor authentication by 
VerDate Sep 11 2014 
00:17 May 27, 2023
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3286.IH
H3286
kjohnson on DSK79L0C42PROD with BILLS
maintainers and cryptographic signing of 
releases. 
‘‘(iii) The number and severity of pub-
licly known, unpatched vulnerabilities. 
‘‘(iv) The breadth of deployment. 
‘‘(v) The level of risk associated with 
where such component is integrated or de-
ployed, such as whether such component 
operates on a network boundary or in a 
privileged location. 
‘‘(vi) The health of the open source 
software community, including, where ap-
plicable, the level of current and historical 
investment and maintenance in such com-
ponent, such as the number and activity of 
individual maintainers. 
‘‘(B) UPDATING
FRAMEWORK.—Not less 
frequently than annually after the date on 
which the framework is published under sub-
paragraph (A), the Director shall— 
‘‘(i) determine whether updates are 
needed to such framework, including the 
augmentation, addition, or removal of the 
elements described in clauses (i) through 
(vi) of such subparagraph; and 
VerDate Sep 11 2014 
00:17 May 27, 2023
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3286.IH
H3286
kjohnson on DSK79L0C42PROD with BILLS
‘‘(ii) if the Director so determines 
that such additional updates are needed, 
make such updates. 
‘‘(C) DEVELOPING
FRAMEWORK.—In de-
veloping the framework described in subpara-
graph (A), the Director shall consult with the 
following: 
‘‘(i) Appropriate Federal agencies, in-
cluding the National Institute of Standards 
and Technology. 
‘‘(ii) Individuals and nonprofit organi-
zations from the open source software com-
munity. 
‘‘(iii) Private sector entities from the 
open source software community. 
‘‘(D) USABILITY.—The Director shall en-
sure, to the greatest extent practicable, that the 
framework described in subparagraph (A) is us-
able by the open source software community, 
including through the consultation required 
under subparagraph (C). 
‘‘(E) FEDERAL OPEN SOURCE SOFTWARE 
ASSESSMENT.—Not later than one year after 
the publication of the framework under sub-
paragraph (A) and not less frequently than 
VerDate Sep 11 2014 
00:17 May 27, 2023
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3286.IH
H3286
kjohnson on DSK79L0C42PROD with BILLS
every two years thereafter, the Director shall, to 
the greatest extent practicable and using such 
framework— 
‘‘(i) perform an assessment of each 
open source software component used di-
rectly or indirectly by Federal agencies 
based on readily available, and, to the 
greatest extent practicable, machine read-
able, information, such as— 
‘‘(I) software bills of material 
that are, at the time of the assess-
ment, made available to the Agency or 
are otherwise accessible via the inter-
net; 
‘‘(II) software inventories, avail-
able to the Director at the time of the 
assessment, 
from 
the 
Continuous 
Diagnostics and Mitigation program 
of the Agency; and 
‘‘(III) other publicly available in-
formation regarding open source soft-
ware components; and 
‘‘(ii) develop one or more ranked lists 
of components described in clause (i) based 
on the assessment, such as ranked by the 
VerDate Sep 11 2014 
00:17 May 27, 2023
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H3286.IH
H3286
kjohnson on DSK79L0C42PROD with BILLS
‘‘(I) CRITICAL INFRASTRUCTURE ASSESS-
MENT STUDY AND PILOT.— 
‘‘(i) STUDY.—Not later than two 
years after the publication of the frame-
work under subparagraph (A), the Director 
shall conduct a study regarding the feasi-
bility of the Director conducting the as-
sessment under subparagraph (E) for crit-
ical infrastructure entities. 
‘‘(ii) PILOT.— 
‘‘(I) IN GENERAL.—If the Direc-
tor determines that the assessment 
described in clause (i) is feasible, the 
Director may conduct a pilot assess-
ment on a voluntary basis with one or 
more critical infrastructure sectors, in 
coordination with the Sector Risk 
Management Agency and the sector 
coordinating council of each partici-
pating sector. 
‘‘(II) TERMINATION.—If the Di-
rector proceeds with the pilot assess-
ment described in subclause (I), such 
pilot assessment shall terminate not 
later than two years after the date on 
VerDate Sep 11 2014 
00:17 May 27, 2023
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H3286.IH
H3286
kjohnson on DSK79L0C42PROD with BILLS
which the Director begins such pilot 
assessment. 
‘‘(iii) REPORTS.— 
‘‘(I) STUDY.—Not later than 180 
days after the date on which the Di-
rector completes the study conducted 
under clause (i), the Director shall 
submit to the appropriate congres-
sional committees a report that— 
‘‘(aa) summarizes the study; 
and 
‘‘(bb) states whether the Di-
rector plans to proceed with the 
pilot assessment described in 
clause (ii)(I). 
‘‘(II) PILOT.—If the Director 
proceeds with the pilot assessment de-
scribed in clause (ii), not later than 
one year after the date on which the 
Director begins such pilot assessment, 
the Director shall submit to the ap-
propriate congressional committees a 
report that includes the following: 
‘‘(aa) A summary of the re-
sults of such pilot assessment. 
VerDate Sep 11 2014 
00:17 May 27, 2023
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H3286.IH
H3286
kjohnson on DSK79L0C42PROD with BILLS
‘‘(bb) A recommendation as 
to whether the activities carried 
out under such pilot assessment 
should be continued after the ter-
mination of such pilot assessment 
in accordance with clause (ii)(II). 
‘‘(3) COORDINATION WITH NATIONAL CYBER DI-
RECTOR.—The Director shall— 
‘‘(A) brief the National Cyber Director on 
the activities described in this subsection; and 
‘‘(B) consult with the National Cyber Di-
rector regarding such activities, as appropriate. 
‘‘(4) REPORTS.— 
‘‘(A) IN
GENERAL.—Not later than one 
year after the date of the enactment of this sec-
tion and every two years thereafter, the Direc-
tor shall submit to the appropriate congres-
sional committees a report that includes for the 
period covered by each such report the fol-
lowing: 
‘‘(i) A summary of the work on open 
source software security performed by the 
Director, including a list of the Federal 
and non-Federal entities with which the 
Director interfaced. 
VerDate Sep 11 2014 
00:17 May 27, 2023
Jkt 039200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H3286.IH
H3286
kjohnson on DSK79L0C42PROD with BILLS
‘‘(ii) The framework under paragraph 
(2)(A) or a summary of any updates to 
such framework pursuant to paragraph 
(2)(B), as the case may be. 
‘‘(iii) A summary of each assessment 
under paragraph (2)(E)(i). 
‘‘(iv) A summary of changes made to 
each such assessment, including overall se-
curity trends. 
‘‘(v) A summary of the types of enti-
ties with which each such assessment was 
shared pursuant to paragraph (2)(H), in-
cluding a list of the Federal and non-Fed-
eral entities with which such assessment 
was shared. 
‘‘(B) PUBLIC REPORT.—Not later than 30 
days after the date on which the Director sub-
mits each report required under subparagraph 
(A), the Director shall make a version of each 
such report publicly available on the website of 
the Agency.’’. 
(b) TECHNICAL AND CONFORMING AMENDMENT.— 
The table of contents in section 1(b) of the Homeland Se-
curity Act of 2002 is amended by inserting after the item 
relating to section 2220E the following new item: 
‘‘Sec. 2220F. Open source software security duties.’’. 
VerDate Sep 11 2014 
00:17 May 27, 2023
Jkt 039200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6211
E:\BILLS\H3286.IH
H3286
kjohnson on DSK79L0C42PROD with BILLS
(c) 
SOFTWARE
SECURITY
ADVISORY
SUB-
COMMITTEE.—Section 2219(d)(1) of the Homeland Secu-
rity Act of 2002 (6 U.S.C. 665e(d)(1)) is amended by add-
ing at the end the following: 
‘‘(E) Software security, including open 
source software security.’’. 
(d) RULE OF CONSTRUCTION.—Nothing in this Act 
or the amendments made by this Act may be construed 
to provide any additional regulatory authority to any Fed-
eral agency described therein. 
Æ 
VerDate Sep 11 2014 
00:17 May 27, 2023
Jkt 039200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6301
E:\BILLS\H3286.IH
H3286
kjohnson on DSK79L0C42PROD with BILLS