DHS Software Supply Chain Risk Management Act of 2021

Bill: 117-hr-4611
Sponsor: full_name: Rep. Torres, Ritchie [D-NY-15]
Introduced: 2021-07-21
Policy area: Government Operations and Politics
Subjects: Administrative law and regulatory procedures

Computer security and identity theft

Computers and information technology

Congressional oversight

Department of Homeland Security

Government information and archives

Government studies and investigations

Public contracts and procurement
Latest action: action_date: 2021-10-21
text: Received in the Senate and Read twice and referred to the Committee on Homeland Security and Governmental Affairs.

Summaries:
action_date: 2021-07-21
action_desc: Introduced in House
text: <p><strong>DHS Software Supply Chain Risk Management Act of 2021</strong> </p> <p>This bill requires the Management Directorate of the Department of Homeland Security (DHS) to issue guidance regarding new and existing contracts relating to the procurement of information and communications technology or services.</p> <p>The bill requires contractors to submit to DHS a bill of materials, a certification that each item in the bill of materials is free from certain security vulnerabilities, a notification of any identified vulnerability, and a plan to mitigate any identified vulnerability.</p>

action_date: 2021-09-14
action_desc: Reported to House
text: <p><strong>DHS Software Supply Chain Risk Management Act of 2021</strong> </p> <p>This bill requires the Management Directorate of the Department of Homeland Security (DHS) to issue guidance regarding new and existing contracts relating to the procurement of information and communications technology or services.</p> <p>The bill requires contractors to submit to DHS a bill of materials, a certification that each item in the bill of materials is free from certain security vulnerabilities or defects affecting the security of the end product or service, a notification of any identified vulnerability or defect, and a plan to mitigate, repair, or resolve any identified vulnerability or defect.</p> <p>The Government Accountability Office must report to specified congressional committees with (1) a review of this bill's implementation; (2) information regarding DHS engagement with industry; (3) an assessment of how guidance issued pursuant to this bill complies with Executive Order 14208, relating to improving the nation's cybersecurity; and (4) any recommendations related to improving the supply chain for covered contracts.</p>

action_date: 2021-10-20
action_desc: Passed House
text: <p><strong>DHS Software Supply Chain Risk Management Act of 2021</strong> </p> <p>This bill requires the Management Directorate of the Department of Homeland Security (DHS) to issue guidance regarding new and existing contracts relating to the procurement of information and communications technology or services.</p> <p>The bill requires contractors to submit to DHS a bill of materials, a certification that each item in the bill of materials is free from certain security vulnerabilities or defects affecting the security of the end product or service, a notification of any identified vulnerability or defect, and a plan to mitigate, repair, or resolve any identified vulnerability or defect.</p> <p>The Government Accountability Office must report to specified congressional committees with (1) a review of this bill's implementation; (2) information regarding DHS engagement with industry; (3) an assessment of how guidance issued pursuant to this bill complies with Executive Order 14208, relating to improving the nation's cybersecurity; and (4) any recommendations related to improving the supply chain for covered contracts. </p>

tv_txt: I 117th CONGRESS 1st Session H. R. 4611 IN THE HOUSE OF REPRESENTATIVES July 21, 2021 Mr. Torres of New York (for himself and Mr. Garbarino ) introduced the following bill; which was referred to the Committee on Homeland Security A BILL To direct the Secretary of Homeland Security to issue guidance with respect to certain information and communications technology or services contracts, and for other purposes.

1. Short title This Act may be cited as the DHS Software Supply Chain Risk Management Act of 2021 . 2. Department of Homeland Security guidance with respect to certain information and communications technology or services contracts (a) Guidance The Secretary of Homeland Security, acting through the Under Secretary, shall issue guidance with respect to new and existing covered contracts. (b) New covered contracts In developing guidance under subsection (a), with respect to each new covered contract, as a condition on the award of such a contract, each contractor responding to a solicitation for such a contract shall submit to the covered officer— (1) a planned bill of materials when submitting a bid proposal; and (2) the certification and notifications described in subsection (e). (c) Existing covered contracts In developing guidance under subsection (a), with respect to each existing covered contract, each contractor with an existing covered contract shall submit to the covered officer— (1) the bill of materials used for such contract, upon the request of such officer; and (2) the certification and notifications described in subsection (e). (d) Updating bill of materials With respect to a covered contract, in the case of a change to the information included in a bill of materials submitted pursuant to subsections (b)(1) and (c)(1), each contractor shall submit to the covered officer the update to such bill of materials, in a timely manner. (e) Certification and notifications The certification and notifications referred to in subsections (b)(2) and (c)(2), with respect to a covered contract, are the following: (1) A certification that each item listed on the submitted bill of materials is free from all known security vulnerabilities or defects identified in— (A) the National Institute of Standards and Technology National Vulnerability Database; and (B) any database designated by the Under Secretary, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, that tracks security vulnerabilities and defects in open source or third-party developed software. (2) A notification of each security vulnerability or defect, if identified, through— (A) the certification of such submitted bill of materials required under paragraph (1); or (B) any other manner of identification. (3) A notification relating to the plan to mitigate, repair, or resolve each security vulnerability or defect listed in the notification required under paragraph (2). (f) Enforcement In developing guidance under subsection (a), the Secretary shall instruct covered officers with respect to— (1) the processes available to such officers enforcing subsections (b) and (c); and (2) when such processes should be used. (g) Effective date The guidance required under subsection (a) shall take effect on the date that is 180 days after the date of the enactment of this section. (h) Definitions In this section: (1) Bill of materials The term bill of materials means a list of the parts and components of an end product or service, including, with respect to each part and component, information relating to the origin, composition, integrity, and any other information as determined appropriate by the Under Secretary. (2) Covered contract The term covered contract means a contract relating to the procurement of covered information and communications technology or services for the Department of Homeland Security. (3) Covered information and communications technology or services The term covered information and communications technology or services means the terms— (A) information technology (as such term is defined in section 11101(6) of title 40, United States Code); (B) information system (as such term is defined in section 3502(8) of title 44, United States Code); (C) telecommunications equipment (as such term is defined in section 3(52) of the Communications Act of 1934 ( 47 U.S.C. 153(52) )); and (D) telecommunications service (as such term is defined in section 3(53) of the Communications Act of 1934 ( 47 U.S.C. 153(53) )). (4) Covered officer The term covered officer means— (A) a contracting officer of the Department; and (B) any other official of the Department as determined appropriate by the Under Secretary. (5) Software The term software means computer programs and associated data that may be dynamically written or modified during execution. (6) Under Secretary The term Under Secretary means the Under Secretary for Management of the Department of Homeland Security.

tv_txt: IB Union Calendar No. 85 117th CONGRESS 1st Session H. R. 4611 [Report No. 117–120] IN THE HOUSE OF REPRESENTATIVES July 21, 2021 Mr. Torres of New York (for himself and Mr. Garbarino ) introduced the following bill; which was referred to the Committee on Homeland Security September 14, 2021 Reported with an amendment, committed to the Committee of the Whole House on the State of the Union, and ordered to be printed Strike out all after the enacting clause and insert the part printed in italic For text of introduced bill, see copy of bill as introduced on July 21, 2021 A BILL To direct the Secretary of Homeland Security to issue guidance with respect to certain information and communications technology or services contracts, and for other purposes.

1. Short title This Act may be cited as the DHS Software Supply Chain Risk Management Act of 2021 . 2. Department of Homeland Security guidance with respect to certain information and communications technology or services contracts (a) Guidance The Secretary of Homeland Security, acting through the Under Secretary, shall issue guidance with respect to new and existing covered contracts. (b) New covered contracts In developing guidance under subsection (a), with respect to each new covered contract, as a condition on the award of such a contract, each contractor responding to a solicitation for such a contract shall submit to the covered officer— (1) a planned bill of materials when submitting a bid proposal; and (2) the certification and notifications described in subsection (e). (c) Existing covered contracts In developing guidance under subsection (a), with respect to each existing covered contract, each contractor with an existing covered contract shall submit to the covered officer— (1) the bill of materials used for such contract, upon the request of such officer; and (2) the certification and notifications described in subsection (e). (d) Updating bill of materials With respect to a covered contract, in the case of a change to the information included in a bill of materials submitted pursuant to subsections (b)(1) and (c)(1), each contractor shall submit to the covered officer the update to such bill of materials, in a timely manner. (e) Certification and notifications The certification and notifications referred to in subsections (b)(2) and (c)(2), with respect to a covered contract, are the following: (1) A certification that each item listed on the submitted bill of materials is free from all known vulnerabilities or defects affecting the security of the end product or service identified in— (A) the National Institute of Standards and Technology National Vulnerability Database; and (B) any database designated by the Under Secretary, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, that tracks security vulnerabilities and defects in open source or third-party developed software. (2) A notification of each vulnerability or defect affecting the security of the end product or service, if identified, through— (A) the certification of such submitted bill of materials required under paragraph (1); or (B) any other manner of identification. (3) A notification relating to the plan to mitigate, repair, or resolve each security vulnerability or defect listed in the notification required under paragraph (2). (f) Enforcement In developing guidance under subsection (a), the Secretary shall instruct covered officers with respect to— (1) the processes available to such officers enforcing subsections (b) and (c); and (2) when such processes should be used. (g) Effective date The guidance required under subsection (a) shall take effect on the date that is 180 days after the date of the enactment of this section. (h) GAO report Not later than 1 year after the date of the enactment of this Act, the Comptroller General of the United States shall submit to the Secretary, the Committee on Homeland Security of the House of Representatives, and the Committee on Homeland Security and Governmental Affairs of the Senate a report that includes— (1) a review of the implementation of this section; (2) information relating to the engagement of the Department of Homeland Security with industry; (3) an assessment of how the guidance issued pursuant to subsection (a) complies with Executive Order 14208 (86 Fed. Reg. 26633; relating to improving the nation’s cybersecurity); and (4) any recommendations relating to improving the supply chain with respect to covered contracts. (i) Definitions In this section: (1) Bill of materials The term bill of materials means a list of the parts and components (whether new or reused) of an end product or service, including, with respect to each part and component, information relating to the origin, composition, integrity, and any other information as determined appropriate by the Under Secretary. (2) Covered contract The term covered contract means a contract relating to the procurement of covered information and communications technology or services for the Department of Homeland Security. (3) Covered information and communications technology or services The term covered information and communications technology or services means the terms— (A) information technology (as such term is defined in section 11101(6) of title 40, United States Code); (B) information system (as such term is defined in section 3502(8) of title 44, United States Code); (C) telecommunications equipment (as such term is defined in section 3(52) of the Communications Act of 1934 ( 47 U.S.C. 153(52) )); and (D) telecommunications service (as such term is defined in section 3(53) of the Communications Act of 1934 ( 47 U.S.C. 153(53) )). (4) Covered officer The term covered officer means— (A) a contracting officer of the Department; and (B) any other official of the Department as determined appropriate by the Under Secretary. (5) Software The term software means computer programs and associated data that may be dynamically written or modified during execution. (6) Under Secretary The term Under Secretary means the Under Secretary for Management of the Department of Homeland Security.

September 14, 2021 Reported with an amendment, committed to the Committee of the Whole House on the State of the Union, and ordered to be printed

tv_txt: I 117th CONGRESS 1st Session H. R. 4611 IN THE HOUSE OF REPRESENTATIVES AN ACT To direct the Secretary of Homeland Security to issue guidance with respect to certain information and communications technology or services contracts, and for other purposes.

1. Short title This Act may be cited as the DHS Software Supply Chain Risk Management Act of 2021 . 2. Department of Homeland Security guidance with respect to certain information and communications technology or services contracts (a) Guidance The Secretary of Homeland Security, acting through the Under Secretary, shall issue guidance with respect to new and existing covered contracts. (b) New covered contracts In developing guidance under subsection (a), with respect to each new covered contract, as a condition on the award of such a contract, each contractor responding to a solicitation for such a contract shall submit to the covered officer— (1) a planned bill of materials when submitting a bid proposal; and (2) the certification and notifications described in subsection (e). (c) Existing covered contracts In developing guidance under subsection (a), with respect to each existing covered contract, each contractor with an existing covered contract shall submit to the covered officer— (1) the bill of materials used for such contract, upon the request of such officer; and (2) the certification and notifications described in subsection (e). (d) Updating bill of materials With respect to a covered contract, in the case of a change to the information included in a bill of materials submitted pursuant to subsections (b)(1) and (c)(1), each contractor shall submit to the covered officer the update to such bill of materials, in a timely manner. (e) Certification and notifications The certification and notifications referred to in subsections (b)(2) and (c)(2), with respect to a covered contract, are the following: (1) A certification that each item listed on the submitted bill of materials is free from all known vulnerabilities or defects affecting the security of the end product or service identified in— (A) the National Institute of Standards and Technology National Vulnerability Database; and (B) any database designated by the Under Secretary, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, that tracks security vulnerabilities and defects in open source or third-party developed software. (2) A notification of each vulnerability or defect affecting the security of the end product or service, if identified, through— (A) the certification of such submitted bill of materials required under paragraph (1); or (B) any other manner of identification. (3) A notification relating to the plan to mitigate, repair, or resolve each security vulnerability or defect listed in the notification required under paragraph (2). (f) Enforcement In developing guidance under subsection (a), the Secretary shall instruct covered officers with respect to— (1) the processes available to such officers enforcing subsections (b) and (c); and (2) when such processes should be used. (g) Effective date The guidance required under subsection (a) shall take effect on the date that is 180 days after the date of the enactment of this section. (h) GAO report Not later than 1 year after the date of the enactment of this Act, the Comptroller General of the United States shall submit to the Secretary, the Committee on Homeland Security of the House of Representatives, and the Committee on Homeland Security and Governmental Affairs of the Senate a report that includes— (1) a review of the implementation of this section; (2) information relating to the engagement of the Department of Homeland Security with industry; (3) an assessment of how the guidance issued pursuant to subsection (a) complies with Executive Order 14208 (86 Fed. Reg. 26633; relating to improving the nation’s cybersecurity); and (4) any recommendations relating to improving the supply chain with respect to covered contracts. (i) Definitions In this section: (1) Bill of materials The term bill of materials means a list of the parts and components (whether new or reused) of an end product or service, including, with respect to each part and component, information relating to the origin, composition, integrity, and any other information as determined appropriate by the Under Secretary. (2) Covered contract The term covered contract means a contract relating to the procurement of covered information and communications technology or services for the Department of Homeland Security. (3) Covered information and communications technology or services The term covered information and communications technology or services means the terms— (A) information technology (as such term is defined in section 11101(6) of title 40, United States Code); (B) information system (as such term is defined in section 3502(8) of title 44, United States Code); (C) telecommunications equipment (as such term is defined in section 3(52) of the Communications Act of 1934 ( 47 U.S.C. 153(52) )); and (D) telecommunications service (as such term is defined in section 3(53) of the Communications Act of 1934 ( 47 U.S.C. 153(53) )). (4) Covered officer The term covered officer means— (A) a contracting officer of the Department; and (B) any other official of the Department as determined appropriate by the Under Secretary. (5) Software The term software means computer programs and associated data that may be dynamically written or modified during execution. (6) Under Secretary The term Under Secretary means the Under Secretary for Management of the Department of Homeland Security. 3. Determination of budgetary effects The budgetary effects of this Act, for the purpose of complying with the Statutory Pay-As-You-Go Act of 2010, shall be determined by reference to the latest statement titled Budgetary Effects of PAYGO Legislation for this Act, submitted for printing in the Congressional Record by the Chairman of the House Budget Committee, provided that such statement has been submitted prior to the vote on passage.

Passed the House of Representatives October 20, 2021. Cheryl L. Johnson, Clerk.

tv_txt: IIB 117th CONGRESS 1st Session H. R. 4611 IN THE SENATE OF THE UNITED STATES October 21, 2021 Received; read twice and referred to the Committee on Homeland Security and Governmental Affairs AN ACT To direct the Secretary of Homeland Security to issue guidance with respect to certain information and communications technology or services contracts, and for other purposes.

1. Short title This Act may be cited as the DHS Software Supply Chain Risk Management Act of 2021 . 2. Department of Homeland Security guidance with respect to certain information and communications technology or services contracts (a) Guidance The Secretary of Homeland Security, acting through the Under Secretary, shall issue guidance with respect to new and existing covered contracts. (b) New covered contracts In developing guidance under subsection (a), with respect to each new covered contract, as a condition on the award of such a contract, each contractor responding to a solicitation for such a contract shall submit to the covered officer— (1) a planned bill of materials when submitting a bid proposal; and (2) the certification and notifications described in subsection (e). (c) Existing covered contracts In developing guidance under subsection (a), with respect to each existing covered contract, each contractor with an existing covered contract shall submit to the covered officer— (1) the bill of materials used for such contract, upon the request of such officer; and (2) the certification and notifications described in subsection (e). (d) Updating bill of materials With respect to a covered contract, in the case of a change to the information included in a bill of materials submitted pursuant to subsections (b)(1) and (c)(1), each contractor shall submit to the covered officer the update to such bill of materials, in a timely manner. (e) Certification and notifications The certification and notifications referred to in subsections (b)(2) and (c)(2), with respect to a covered contract, are the following: (1) A certification that each item listed on the submitted bill of materials is free from all known vulnerabilities or defects affecting the security of the end product or service identified in— (A) the National Institute of Standards and Technology National Vulnerability Database; and (B) any database designated by the Under Secretary, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, that tracks security vulnerabilities and defects in open source or third-party developed software. (2) A notification of each vulnerability or defect affecting the security of the end product or service, if identified, through— (A) the certification of such submitted bill of materials required under paragraph (1); or (B) any other manner of identification. (3) A notification relating to the plan to mitigate, repair, or resolve each security vulnerability or defect listed in the notification required under paragraph (2). (f) Enforcement In developing guidance under subsection (a), the Secretary shall instruct covered officers with respect to— (1) the processes available to such officers enforcing subsections (b) and (c); and (2) when such processes should be used. (g) Effective date The guidance required under subsection (a) shall take effect on the date that is 180 days after the date of the enactment of this section. (h) GAO report Not later than 1 year after the date of the enactment of this Act, the Comptroller General of the United States shall submit to the Secretary, the Committee on Homeland Security of the House of Representatives, and the Committee on Homeland Security and Governmental Affairs of the Senate a report that includes— (1) a review of the implementation of this section; (2) information relating to the engagement of the Department of Homeland Security with industry; (3) an assessment of how the guidance issued pursuant to subsection (a) complies with Executive Order 14208 (86 Fed. Reg. 26633; relating to improving the nation’s cybersecurity); and (4) any recommendations relating to improving the supply chain with respect to covered contracts. (i) Definitions In this section: (1) Bill of materials The term bill of materials means a list of the parts and components (whether new or reused) of an end product or service, including, with respect to each part and component, information relating to the origin, composition, integrity, and any other information as determined appropriate by the Under Secretary. (2) Covered contract The term covered contract means a contract relating to the procurement of covered information and communications technology or services for the Department of Homeland Security. (3) Covered information and communications technology or services The term covered information and communications technology or services means the terms— (A) information technology (as such term is defined in section 11101(6) of title 40, United States Code); (B) information system (as such term is defined in section 3502(8) of title 44, United States Code); (C) telecommunications equipment (as such term is defined in section 3(52) of the Communications Act of 1934 ( 47 U.S.C. 153(52) )); and (D) telecommunications service (as such term is defined in section 3(53) of the Communications Act of 1934 ( 47 U.S.C. 153(53) )). (4) Covered officer The term covered officer means— (A) a contracting officer of the Department; and (B) any other official of the Department as determined appropriate by the Under Secretary. (5) Software The term software means computer programs and associated data that may be dynamically written or modified during execution. (6) Under Secretary The term Under Secretary means the Under Secretary for Management of the Department of Homeland Security. 3. Determination of budgetary effects The budgetary effects of this Act, for the purpose of complying with the Statutory Pay-As-You-Go Act of 2010, shall be determined by reference to the latest statement titled Budgetary Effects of PAYGO Legislation for this Act, submitted for printing in the Congressional Record by the Chairman of the House Budget Committee, provided that such statement has been submitted prior to the vote on passage.

Passed the House of Representatives October 20, 2021. Cheryl L. Johnson, Clerk.