II 115th CONGRESS 1st Session S. 990 IN THE SENATE OF THE UNITED STATES April 28, 2017 Mr. Moran (for himself, Mr. Udall , Mr. Daines , and Mr. Warner ) introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs A BILL To modernize Government information technology, and for other purposes.

1. Short title This Act may be cited as the Modernizing Government Technology Act of 2017 or the MGT Act . 2. Findings; purposes (a) Findings The Congress finds the following: (1) The Federal Government spends nearly 75 percent of its annual information technology funding on operating and maintaining existing legacy information technology systems. These systems can pose operational risks, including rising costs and inability to meet mission requirements. These systems also pose security risks, including the inability to use current security best practices, such as data encryption and multi-factor authentication, making these systems particularly vulnerable to malicious cyber activity. (2) In 2015, the Government Accountability Office designated improving the management of information technology acquisitions and operations to its biannual High Risk List and identified as a particular concern the increasing level of information technology spending on operations and maintenance, making less funding available for development or modernization. The Government Accountability Office also found that the Federal Government has spent billions on failed and poorly performing information technology investments due to a lack of effective oversight. (3) The Federal Government must modernize Federal information technology systems to mitigate existing operational and security risks. (4) The efficiencies, cost savings, and greater computing power offered by modernized solutions, such as cloud computing, have the potential to— (A) eliminate inappropriate duplication and reduce costs; (B) address the critical need for cybersecurity by design; and (C) move the Federal Government into a broad, digital-services delivery model that will transform the ability of the Federal Government to meet mission requirements and deliver services to the people of the United States. (b) Purposes The purposes of this Act are the following: (1) Assist the Federal Government in modernizing Federal information technology to mitigate current operational and security risks. (2) Incentivize cost savings in Federal information technology through modernization. (3) Accelerate the acquisition and deployment of modernized information technology solutions, such as cloud computing, by addressing impediments in the areas of funding, development, and acquisition practices. 3. Establishment of agency Information Technology Systems Modernization and Working Capital Funds (a) Information Technology System Modernization and Working Capital Funds (1) Establishment The head of a covered agency may establish within such agency an information technology system modernization and working capital fund (in this section referred to as the IT working capital fund ) for necessary expenses described in paragraph (3). (2) Source of funds The following amounts may be deposited into an IT working capital fund: (A) Reprogramming and transfer of funds made available in appropriations Acts subsequent to the date of the enactment of this Act, including transfer of any funds for the operation and maintenance of legacy information technology systems, in compliance with any applicable reprogramming law or guidelines of the Committees on Appropriations of the House of Representatives and the Senate. (B) Amounts made available to the IT working capital fund through discretionary appropriations made available subsequent to the date of the enactment of this Act. (3) Use of funds An IT working capital fund established under paragraph (1) may be used, subject to the availability of appropriations, only for the following: (A) To improve, retire, or replace existing information technology systems in the covered agency to enhance cybersecurity and to improve efficiency and effectiveness. (B) To transition legacy information technology at the covered agency to cloud computing and other innovative platforms and technologies, including those serving more than one covered agency with common requirements. (C) To assist and support covered agency efforts to provide adequate, risk-based, and cost-effective information technology capabilities that address evolving threats to information security. (D) To reimburse funds transferred to the covered agency from the Technology Modernization Fund established under section 4, with the approval of the Chief Information Officer of the covered agency. (4) Existing funds An IT working capital fund may not be used to supplant funds provided for the operation and maintenance of any system within an appropriation for the covered agency at the time of establishment of the IT working capital fund. (5) Prioritization of funds The head of each covered agency shall prioritize funds within the IT working capital fund to be used initially for cost savings activities approved by the Chief Information Officer of the covered agency, in consultation with the Administrator of the Office of Electronic Government. The head of each covered agency may reprogram and transfer any amounts saved as a direct result of such activities for deposit into the applicable IT working capital fund, consistent with paragraph (2)(A). (6) Return of funds Any funds deposited into an IT working capital fund shall be available for obligation for three years after the last day of the fiscal year in which such funds were deposited. (7) Agency CIO responsibilities In evaluating projects to be funded from the IT working capital fund, the Chief Information Officer of the covered agency shall consider, to the extent applicable, guidance issued pursuant to section 4(a)(1) to evaluate applications for funding from the Technology Modernization Fund established under that section that include factors such as a strong business case, technical design, procurement strategy (including adequate use of incremental software development practices), and program management. (b) Reporting requirement (1) In general Not later than one year after the date of the enactment of this Act, and every six months thereafter, the head of each covered agency shall submit to the Director the following, with respect to the IT working capital fund for the covered agency: (A) A list of each information technology investment funded with estimated cost and completion date for each such investment. (B) A summary by fiscal year of obligations, expenditures, and unused balances. (2) Public availability The Director shall make the information submitted under paragraph (1) publicly available on a website. (c) Covered agency defined In this section, the term covered agency means each agency listed in section 901(b) of title 31, United States Code. 4. Establishment of Technology Modernization Fund and Board (a) Technology Modernization Fund (1) Establishment There is established in the Treasury of the United States a Technology Modernization Fund (in this section referred to as the Fund ) for technology-related activities, to improve information technology, to enhance cybersecurity across the Federal Government, and to be administered in accordance with guidance issued by the Director. (2) Administration of Fund The Commissioner of the Technology Transformation Service of the General Services Administration, in consultation with the Chief Information Officers Council and with the approval of the Director, shall administer the Fund in accordance with this subsection. (3) Use of funds The Commissioner shall, in accordance with the recommendations of the Technology Modernization Board established under subsection (b), use amounts in the Fund for the following purposes: (A) To transfer such amounts, to remain available until expended, to the head of an agency to improve, retire, or replace existing Federal information technology systems to enhance cybersecurity and improve efficiency and effectiveness. (B) For the development, operation, and procurement of information technology products, services, and acquisition vehicles for use by agencies to improve Governmentwide efficiency and cybersecurity in accordance with the requirements of such agencies. (C) To provide services or work performed in support of the activities described under subparagraph (A) or (B). (4) Authorization of appropriations; credits; availability of funds (A) Authorization of appropriations There is authorized to be appropriated to the Fund $250,000,000 for each of fiscal years 2018 and 2019. (B) Credits In addition to any funds otherwise appropriated, the Fund shall be credited with all reimbursements, advances, or refunds or recoveries relating to information technology or services provided through the Fund. (C) Availability of funds Amounts deposited, credited, or otherwise made available to the Fund shall be available, as provided in appropriations Acts, until expended for the purposes described in paragraph (3). (5) Reimbursement (A) Payment by agency For a product or service developed under paragraph (3)(B), including any services or work performed in support of such development under paragraph (3)(C), the head of an agency that uses such product or service shall pay an amount fixed by the Commissioner in accordance with this paragraph. (B) Reimbursement by agency The head of an agency shall reimburse the Fund for any transfer made under paragraph (3)(A), including any services or work performed in support of such transfer under paragraph (3)(C), in accordance with the terms established in a written agreement described in paragraph (6). Notwithstanding any other provision of law, an agency may make a reimbursement required by this subparagraph from any appropriation made available subsequent to the date of the enactment of this Act for information technology activities, consistent with any applicable reprogramming law or guidelines of the Committees on Appropriations of the House of Representatives and the Senate. An obligation to make a payment under a written agreement described in paragraph (6) in a fiscal year after the date of the enactment of this Act shall be recorded pursuant to section 1501 of title 31, United States Code, in the fiscal year in which the payment is due. (C) Prices fixed by Commissioner The Commissioner, in consultation with the Director, shall establish amounts to be paid by an agency and terms of repayment for use of a product or service developed under paragraph (3)(B), including any services or work performed in support of such development under paragraph (3)(C), at levels sufficient to ensure the solvency of the Fund, including operating expenses. Before making any changes to the established amounts and terms of repayment, the Commissioner shall conduct a review and obtain approval from the Director. (D) Failure to make timely reimbursement The Commissioner may obtain reimbursement by the issuance of transfer and counterwarrants, or other lawful transfer documents, supported by itemized bills, if payment is not made by an agency— (i) within 90 days after the expiration of a repayment period described in a written agreement described in paragraph (6); or (ii) within 45 days after the expiration of the time period to make a payment under a payment schedule for a product or service developed under paragraph (3)(B). (6) Written agreement (A) In general Before the transfer of funds to an agency under paragraph (3)(A), the Commissioner (in consultation with the Director) and the head of the requisitioning agency shall enter into a written agreement documenting the purpose for which the funds will be used and the terms of repayment, which may not exceed five years unless approved by the Director. An agreement made pursuant to this subparagraph shall be recorded as an obligation as provided in paragraph (5)(B). (B) Requirement for use of incremental development practices For any funds transferred to an agency under paragraph (3)(A), in the absence of compelling circumstances documented by the Commissioner at the time of transfer, such funds shall be transferred only on an incremental basis, tied to metric-based development milestones achieved by the agency, to be described in a written agreement required under subparagraph (A). (7) Reporting requirement Not later than six months after the date of the enactment of this Act, the Director shall publish and maintain a list of each project funded by the Fund on a public website, to be updated not less than quarterly, that includes a description of the project, project status (including any schedule delay and cost overruns), and financial expenditure data related to the project. (b) Technology Modernization Board (1) Establishment There is established a Technology Modernization Board (in this section referred to as the Board ) to evaluate proposals submitted by agencies for funding authorized under the Fund. (2) Responsibilities The responsibilities of the Board are the following: (A) Provide input to the Director for the development of processes for agencies to submit modernization proposals to the Board and to establish the criteria by which such proposals are evaluated, which shall include addressing the greatest security and operational risks, having the greatest Governmentwide impact, and having a high probability of success based on factors such as a strong business case, technical design, procurement strategy (including adequate use of incremental software development practices), and program management. (B) Make recommendations to the Commissioner to assist agencies in the further development and refinement of select submitted modernization proposals, based on an initial evaluation performed with the assistance of the Commissioner. (C) Review and prioritize, with the assistance of the Commissioner and the Director, modernization proposals based on criteria established pursuant to subparagraph (A). (D) Identify, with the assistance of the Commissioner, opportunities to improve or replace multiple information technology systems with a smaller number of information technology systems common to multiple agencies. (E) Recommend the funding of modernization projects, in accordance with the uses described in subsection (a)(3), to the Commissioner. (F) Monitor, in consultation with the Commissioner, progress and performance in executing approved projects and, if necessary, recommend the suspension or termination of funding for projects based on factors such as failure to meet the terms of a written agreement described in subsection (a)(6). (G) Monitor operating costs of the Fund. (3) Membership The Board shall consist of eight voting members. (4) Chair The Chair of the Board shall be the Administrator of the Office of Electronic Government. (5) Permanent members The permanent members of the Board shall be the following: (A) The Administrator of the Office of Electronic Government. (B) A senior official from the General Services Administration having technical expertise in information technology development, appointed by the Administrator of General Services, with the approval of the Director. (6) Additional members of the Board (A) Appointment The other members of the Board shall be appointed as follows: (i) One employee of the National Protection and Programs Directorate of the Department of Homeland Security, appointed by the Secretary of Homeland Security. (ii) One employee of the Department of Defense, appointed by the Secretary of Defense. (iii) Four Federal employees primarily having technical expertise in information technology development, financial management, cybersecurity and privacy, and acquisition, appointed by the Director. (B) Term Each member of the Board described in subparagraph (A) shall serve a term of one year, which shall be renewable up to three times, at the discretion of the appointing Secretary or Director, as applicable. (7) Prohibition on compensation Members of the Board may not receive additional pay, allowances, or benefits by reason of their service on the Board. (8) Staff Upon request of the Chair of the Board, the Director and the Administrator of General Services may detail, on a nonreimbursable basis, any of the personnel of the Office of Management and Budget or the General Services Administration (as the case may be) to the Board to assist the Board in carrying out its functions under this Act. (c) Responsibilities of Commissioner (1) In general In addition to the responsibilities described in subsection (b), the Commissioner shall support the activities of the Board and provide technical support to, and, with the concurrence of the Director, oversight of, agencies that receive transfers from the Fund. (2) Responsibilities The responsibilities of the Commissioner are the following: (A) Provide direct technical support in the form of personnel services or otherwise to agencies transferred amounts under subsection (a)(3)(A) and for products, services, and acquisition vehicles funded under subsection (a)(3)(B). (B) Assist the Board with the evaluation, prioritization, and development of agency modernization proposals. (C) Perform regular project oversight and monitoring of approved agency modernization projects, in consultation with the Board and the Director, to increase the likelihood of successful implementation and reduce waste. (D) Provide the Director with information necessary to meet the requirements of subsection (a)(7). (d) Agency defined In this section, the term agency has the meaning given that term in section 551 of title 5, United States Code. 5. Definitions In this Act: (1) Cloud computing The term cloud computing has the meaning given that term by the National Institute of Standards and Technology in NIST Special Publication 800–145 and any amendatory or superseding document thereto. (2) Commissioner The term Commissioner means the Commissioner of the Technology Transformation Service of the General Services Administration. (3) Director The term Director means the Director of the Office of Management and Budget. (4) Information technology The term information technology has the meaning given that term in section 3502 of title 44, United States Code. (5) Legacy information technology system The term legacy information technology system means an outdated or obsolete system of information technology.