II 114th CONGRESS 1st Session S. 1008 IN THE SENATE OF THE UNITED STATES April 20, 2015 Mr. Risch introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs A BILL To require certain agencies to conduct assessments of data centers and develop data center consolidation and optimization plans.

1. Federal data center consolidation (a) Definitions In this section: (1) Administrator The term Administrator means the Administrator for the Office of E-Government and Information Technology within the Office of Management and Budget. (2) Data center (A) Definition The term data center means a closet, room, floor, or building for the storage, management, and dissemination of data and information, as defined by the Administrator in the Implementation Guidance for the Federal Data Center Consolidation Initiative memorandum, issued on March 19, 2012. (B) Authority to modify definition The Administrator may promulgate guidance or other clarifications to modify the definition in subparagraph (A) in a manner consistent with this Act, as the Administrator determines necessary. (b) Federal data center consolidation inventories and plans (1) In general (A) Annual reports Each year, beginning in fiscal year 2015 through the end of fiscal year 2019, the head of each agency that is described in subparagraph (E), assisted by the chief information officer of the agency, shall submit to the Administrator— (i) a comprehensive asset inventory of the data centers owned, operated, or maintained by or on behalf of the agency, even if the center is administered by a third party; and (ii) an updated consolidation plan that includes— (I) a technical roadmap and approach for achieving the agency’s targets for infrastructure utilization, energy efficiency (including performance benchmarks such as Power Utilization Effectiveness and use of Energy Star-rated equipment), cost savings and efficiency; (II) a detailed timeline for implementation of the data center consolidation plan; (III) quantitative utilization and efficiency goals for reducing assets, improving energy and efficiency, and improving use of information technology infrastructure; (IV) performance metrics by which the progress of the agency toward data center consolidation goals can be measured, including metrics to track any gains in energy utilization as a result of this initiative; (V) an aggregation of year-by-year investment and cost savings calculations for 5 years past the date of submission of the cost saving assessment, including a description of any initial costs for data center consolidation and life cycle cost savings; (VI) quantitative progress towards previously stated goals including cost savings (including savings measured on a total cost of ownership basis) and increases in operational efficiencies and utilization; and (VII) any additional information required by the Administrator. (B) Use of existing reporting structures The Administrator may require agencies described in subparagraph (E) to submit any information required to be submitted under this subsection through reporting structures in use as of the date of enactment of this Act. (C) Certification Each year, beginning in fiscal year 2015 through the end of fiscal year 2019, the head of an agency, acting through the chief information officer of the agency, shall submit a statement to the Administrator certifying that the agency has complied with the requirements of this Act. (D) Inspector general report (i) In general The Inspector General for each agency described in subparagraph (E) shall release a public report not later than 6 months after the date on which the agency releases the first updated asset inventory in fiscal year 2015 under subparagraph (A)(i), which shall evaluate the completeness of the inventory of the agency. (ii) Agency response The head of each agency shall respond to the report completed by the Inspector General for the agency under clause (i), and complete any inventory identified by the Inspector General for the agency as incomplete, by the time the agency submits the required inventory update for fiscal year 2016. (E) Agencies described The agencies (including all associated components of the agency) described in this paragraph are the— (i) Department of Agriculture; (ii) Department of Commerce; (iii) Department of Defense; (iv) Department of Education; (v) Department of Energy; (vi) Department of Health and Human Services; (vii) Department of Homeland Security; (viii) Department of Housing and Urban Development; (ix) Department of the Interior; (x) Department of Justice; (xi) Department of Labor; (xii) Department of State; (xiii) Department of Transportation; (xiv) Department of Treasury; (xv) Department of Veterans Affairs; (xvi) Environmental Protection Agency; (xvii) General Services Administration; (xviii) National Aeronautics and Space Administration; (xix) National Science Foundation; (xx) Nuclear Regulatory Commission; (xxi) Office of Personnel Management; (xxii) Small Business Administration; (xxiii) Social Security Administration; and (xxiv) United States Agency for International Development. (F) Agency implementation of consolidation plans Each agency described in subparagraph (E), under the direction of the chief information officer of the agency shall— (i) implement the consolidation plan required under subparagraph (A)(ii); and (ii) provide to the Administrator annual updates on implementation and cost savings (including life cycle costs) and efficiency improvements realized through such consolidation plan. (2) Administrator responsibilities The Administrator shall— (A) establish the deadline, on an annual basis, for agencies to submit information under this section; (B) ensure that each certification submitted under paragraph (1)(C) and each agency consolidation plan submitted under paragraph (1)(A)(ii) is made available in a timely manner to the general public; (C) review the plans submitted under paragraph (1) to determine whether each plan is comprehensive and complete; (D) monitor the implementation of the data center consolidation plan of each agency described in paragraph (1)(A)(ii); and (E) update the cumulative cost savings projection on an annual basis as the savings are realized through the implementation of the agency plans. (3) Cost saving goal and updates for Congress (A) In general Not later than 180 days after the date of enactment of this Act, or by September 30th of fiscal year 2015, whichever is later, the Administrator shall develop and publish a goal for the total amount of planned cost savings by the Federal Government through the Federal Data Center Consolidation Initiative during the 5-year period beginning on the date of enactment of this Act, which shall include a breakdown on a year-by-year basis of the projected savings. (B) Annual update (i) In general Not later than 1 year after the date on which the goal described in subparagraph (A) is determined and each year thereafter until the end of 2019, the Administrator shall publish a report on the actual savings achieved through the Federal Data Center Consolidation Initiative as compared to the projected savings developed under subparagraph (A) (based on data collected from each affected agency under paragraph (1)). (ii) Update for Congress The report required under subparagraph (A) shall be submitted to Congress and shall include an update on the progress made by each agency described in subsection paragraph (1)(E) on— (I) whether each agency has in fact submitted a comprehensive asset inventory; (II) whether each agency has submitted a comprehensive consolidation plan with the key elements described in paragraph (1)(A)(ii); and (III) the progress, if any, of each agency on implementing the consolidation plan of the agency. (iii) Request for reports Upon request from the Committee on Homeland Security and Governmental Affairs of the Senate or the Committee on Oversight and Government Reform of the House of Representatives, the head of an agency described in paragraph (1)(E) or the Director of the Office of Management and Budget shall submit to the requesting committee any report or information submitted to the Office of Management and Budget for the purpose of preparing a report required under clause (i) or an updated progress report required under clause (ii). (4) GAO Review The Comptroller General of the United States shall, on an annual basis, publish a report on— (A) the quality and completeness of each agency’s asset inventory and consolidation plans required under paragraph (1)(A); (B) each agency’s progress on implementation of the consolidation plans submitted under paragraph (1)(A); (C) overall planned and actual cost savings realized through implementation of the consolidation plans submitted under paragraph (1)(A); (D) any steps that the Administrator could take to improve implementation of the data center consolidation initiative; and (E) any matters for Congressional consideration in order to improve or accelerate the implementation of the data center consolidation initiative. (5) Response to GAO (A) In general If a report required under paragraph (4) identifies any deficiencies or delays in any of the elements described in subparagraphs (A) through (E) of paragraph (4) for an agency, the head of the agency shall respond in writing to the Comptroller General of the United States, not later than 90 days after the date on which the report is published under paragraph (4), with a detailed explanation of how the agency will address the deficiency. (B) Additional requirements If the Comptroller General identifies an agency that has repeatedly lagged in implementing the data center consolidation initiative, the Comptroller General may require that the head of the agency submit a statement explaining— (i) why the agency is having difficulty implementing the initiative; and (ii) what structural or personnel changes are needed within the agency to address the problem. (c) Ensuring cybersecurity standards for data center consolidation and cloud computing An agency required to implement a data center consolidation plan under this Act and migrate to cloud computing shall do so in a manner that is consistent with Federal guidelines on cloud computing security, including— (1) applicable provisions found within the Federal Risk and Authorization Management Program of the General Service Administration; and (2) guidance published by the National Institute of Standards and Technology. (d) Classified information The Director of National Intelligence may waive the requirements of this Act for any element (or component of an element) of the intelligence community. (e) Sunset This Act is repealed effective on October 1, 2019.