S917-118

1. Short title This Act may be cited as the Securing Open Source Software Act of 2023.

2. Findings Congress finds that— open source software fosters technology development and is an integral part of overall cybersecurity; a secure, healthy, vibrant, and resilient open source software ecosystem is crucial for ensuring the national security and economic vitality of the United States; open source software is part of the foundation of digital infrastructure that promotes a free and open internet; due to both the unique strengths of open source software and inconsistent historical investment in open source software security, there exist unique challenges in securing open source software; and the Federal Government should play a supporting role in ensuring the long-term security of open source software.

3. Open source software security duties Title XXII of the Homeland Security Act of 2002 (6 U.S.C. 650 et seq.) is amended— in section 2200 (6 U.S.C. 650)— by redesignating paragraphs (22) through (28) as paragraphs (25) through (31), respectively; and by inserting after paragraph (21) the following: The term open source software means software for which the human-readable source code is made available to the public for use, study, re-use, modification, enhancement, and re-distribution. The term open source software community means the community of individuals, foundations, nonprofit organizations, corporations, and other entities that— develop, contribute to, maintain, and publish open source software; or otherwise work to ensure the security of the open source software ecosystem. The term open source software component means an individual repository of open source software that is made available to the public. in section 2202(c) (6 U.S.C. 652(c))— in paragraph (13), by striking and at the end; by redesignating paragraph (14) as paragraph (15); and by inserting after paragraph (13) the following: support, including by offering services, the secure usage and deployment of software, including open source software, in the software development lifecycle at Federal agencies in accordance with section 2220E; and by adding at the end the following: In this section, the term software bill of materials has the meaning given the term in the Minimum Elements for a Software Bill of Materials published by the Department of Commerce, or any superseding definition published by the Agency. The Director shall, to the greatest extent practicable, employ individuals in the Agency who— have expertise and experience participating in the open source software community; and perform the duties described in subsection (c). The Director shall— perform outreach and engagement to bolster the security of open source software; support Federal efforts to strengthen the security of open source software; coordinate, as appropriate, with non-Federal entities on efforts to ensure the long-term security of open source software; serve as a public point of contact regarding the security of open source software for non-Federal entities, including State, local, Tribal, and territorial partners, the private sector, international partners, open source software organizations, and open source software developers; and support Federal and non-Federal supply chain security efforts by encouraging efforts to bolster open source software security, such as— assisting in coordinated vulnerability disclosures in open source software components pursuant to section 2209(n); and supporting the activities of the Federal Acquisition Security Council. Not later than 1 year after the date of enactment of this section, the Director shall publicly publish a framework, incorporating government, industry, and open source software community frameworks and best practices, including those published by the National Institute of Standards and Technology, for assessing the risk of open source software components, including direct and indirect open source software dependencies, which shall incorporate, at a minimum— the security properties of code in a given open source software component, such as whether the code is written in a memory-safe programming language; the security practices of development, build, and release processes of a given open source software component, such as the use of multi-factor authentication by maintainers and cryptographic signing of releases; the number and severity of publicly known, unpatched vulnerabilities in a given open source software component; the breadth of deployment of a given open source software component; the level of risk associated with where a given open source software component is integrated or deployed, such as whether the component operates on a network boundary or in a privileged location; and the health of the community for a given open source software component, including, where applicable, the level of current and historical investment and maintenance in the open source software component, such as the number and activity of individual maintainers. Not less frequently than annually after the date on which the framework is published under subparagraph (A), the Director shall— determine whether updates are needed to the framework described in subparagraph (A), including the augmentation, addition, or removal of the elements described in clauses (i) through (vi) of such subparagraph; and if the Director determines that additional updates are needed under clause (i), make those updates to the framework. In developing the framework described in subparagraph (A), the Director shall consult with— appropriate Federal agencies, including the National Institute of Standards and Technology; individuals and nonprofit organizations from the open source software community; and private companies from the open source software community. The Director shall ensure, to the greatest extent practicable, that the framework described in subparagraph (A) is usable by the open source software community, including through the consultation described in subparagraph (C). Not later than 1 year after the publication of the framework described in subparagraph (A), and not less frequently than every 2 years thereafter, the Director shall, to the greatest extent practicable and using the framework described in subparagraph (A)— perform an assessment of open source software components used directly or indirectly by Federal agencies based on readily available, and, to the greatest extent practicable, machine readable, information, such as— software bills of material that are, at the time of the assessment, made available to the Agency or are otherwise accessible via the internet; software inventories, available to the Director at the time of the assessment, from the Continuous Diagnostics and Mitigation program of the Agency; and other publicly available information regarding open source software components; and develop 1 or more ranked lists of components described in clause (i) based on the assessment, such as ranked by the criticality, level of risk, or usage of the components, or a combination thereof. The Director shall, to the greatest extent practicable, automate the assessment conducted under subparagraph (E). The Director shall publicly publish and maintain any tools developed to conduct the assessment described in subparagraph (E) as open source software. The Director shall facilitate the sharing of the results of the assessment described in subparagraph (E) with appropriate Federal and non-Federal entities working to support the security of open source software, including by offering means for appropriate Federal and non-Federal entities to download the assessment in an automated manner. The Director may publicly publish, as appropriate, any datasets or versions of the datasets developed or consolidated as a result of the assessment described in subparagraph (E). Not later than 2 years after the publication of the framework described in subparagraph (A), the Director shall conduct a study regarding the feasibility of the Director conducting the assessment described in subparagraph (E) for critical infrastructure entities. If the Director determines that the assessment described in clause (i) is feasible, the Director may conduct a pilot assessment on a voluntary basis with 1 or more critical infrastructure sectors, in coordination with the Sector Risk Management Agency and the sector coordinating council of each participating sector. If the Director proceeds with the pilot described in clause (ii), the pilot shall terminate on the date that is 2 years after the date on which the Director begins the pilot. Not later than 180 days after the date on which the Director completes the study conducted under clause (i), the Director shall submit to the appropriate congressional committees a report that— summarizes the study; and states whether the Director plans to proceed with the pilot described in clause (ii). If the Director proceeds with the pilot described in clause (ii), not later than 1 year after the date on which the Director begins the pilot, the Director shall submit to the appropriate congressional committees a report that includes— a summary of the results of the pilot; and a recommendation as to whether the activities carried out under the pilot should be continued after the termination of the pilot described in clause (ii)(II). The Director shall— brief the National Cyber Director on the activities described in this subsection; and coordinate activities with the National Cyber Director, as appropriate. Not later than 1 year after the date of enactment of this section, and every 2 years thereafter, the Director shall submit to the appropriate congressional committees a report that includes— a summary of the work on open source software security performed by the Director during the period covered by the report, including a list of the Federal and non-Federal entities with which the Director interfaced; the framework developed under paragraph (2)(A); a summary of any updates made to the framework developed under paragraph (2)(A) pursuant to paragraph (2)(B) since the last report submitted under this subparagraph; a summary of the assessment conducted pursuant to paragraph (2)(E); a summary of changes made to the assessment conducted pursuant to paragraph (2)(E) since the last report submitted under this subparagraph, including overall security trends; and a summary of the types of entities with which the assessment was shared pursuant to paragraph (2)(H), including a list of the Federal and non-Federal entities with which the assessment was shared. Not later than 30 days after the date on which the Director submits a report required under subparagraph (A), the Director shall make a version of the report publicly available on the website of the Agency. The table of contents in section 1(b) of the Homeland Security Act of 2002 (Public Law 107–296; 116 Stat. 2135) is amended by inserting after the item relating to section 2220E the following: (22)Open source softwareThe term open source software means software for which the human-readable source code is made available to the public for use, study, re-use, modification, enhancement, and re-distribution.(23)Open source software communityThe term open source software community means the community of individuals, foundations, nonprofit organizations, corporations, and other entities that—(A)develop, contribute to, maintain, and publish open source software; or(B)otherwise work to ensure the security of the open source software ecosystem.(24)Open source software componentThe term open source software component means an individual repository of open source software that is made available to the public.; (14)support, including by offering services, the secure usage and deployment of software, including open source software, in the software development lifecycle at Federal agencies in accordance with section 2220E; and; and 2220F.Open source software security duties(a)DefinitionIn this section, the term software bill of materials has the meaning given the term in the Minimum Elements for a Software Bill of Materials published by the Department of Commerce, or any superseding definition published by the Agency. (b)EmploymentThe Director shall, to the greatest extent practicable, employ individuals in the Agency who—(1)have expertise and experience participating in the open source software community; and(2)perform the duties described in subsection (c).(c)Duties of the Director(1)In generalThe Director shall—(A)perform outreach and engagement to bolster the security of open source software;(B)support Federal efforts to strengthen the security of open source software;(C)coordinate, as appropriate, with non-Federal entities on efforts to ensure the long-term security of open source software;(D)serve as a public point of contact regarding the security of open source software for non-Federal entities, including State, local, Tribal, and territorial partners, the private sector, international partners, open source software organizations, and open source software developers; and(E)support Federal and non-Federal supply chain security efforts by encouraging efforts to bolster open source software security, such as—(i) assisting in coordinated vulnerability disclosures in open source software components pursuant to section 2209(n); and(ii)supporting the activities of the Federal Acquisition Security Council.(2)Assessment of critical open source software components(A)FrameworkNot later than 1 year after the date of enactment of this section, the Director shall publicly publish a framework, incorporating government, industry, and open source software community frameworks and best practices, including those published by the National Institute of Standards and Technology, for assessing the risk of open source software components, including direct and indirect open source software dependencies, which shall incorporate, at a minimum—(i)the security properties of code in a given open source software component, such as whether the code is written in a memory-safe programming language;(ii)the security practices of development, build, and release processes of a given open source software component, such as the use of multi-factor authentication by maintainers and cryptographic signing of releases;(iii)the number and severity of publicly known, unpatched vulnerabilities in a given open source software component;(iv)the breadth of deployment of a given open source software component;(v)the level of risk associated with where a given open source software component is integrated or deployed, such as whether the component operates on a network boundary or in a privileged location; and(vi)the health of the community for a given open source software component, including, where applicable, the level of current and historical investment and maintenance in the open source software component, such as the number and activity of individual maintainers.(B)Updating frameworkNot less frequently than annually after the date on which the framework is published under subparagraph (A), the Director shall—(i)determine whether updates are needed to the framework described in subparagraph (A), including the augmentation, addition, or removal of the elements described in clauses (i) through (vi) of such subparagraph; and (ii)if the Director determines that additional updates are needed under clause (i), make those updates to the framework.(C)Developing frameworkIn developing the framework described in subparagraph (A), the Director shall consult with—(i)appropriate Federal agencies, including the National Institute of Standards and Technology;(ii)individuals and nonprofit organizations from the open source software community; and(iii)private companies from the open source software community.(D)UsabilityThe Director shall ensure, to the greatest extent practicable, that the framework described in subparagraph (A) is usable by the open source software community, including through the consultation described in subparagraph (C).(E)Federal open source software assessmentNot later than 1 year after the publication of the framework described in subparagraph (A), and not less frequently than every 2 years thereafter, the Director shall, to the greatest extent practicable and using the framework described in subparagraph (A)—(i)perform an assessment of open source software components used directly or indirectly by Federal agencies based on readily available, and, to the greatest extent practicable, machine readable, information, such as—(I)software bills of material that are, at the time of the assessment, made available to the Agency or are otherwise accessible via the internet; (II)software inventories, available to the Director at the time of the assessment, from the Continuous Diagnostics and Mitigation program of the Agency; and(III)other publicly available information regarding open source software components; and (ii)develop 1 or more ranked lists of components described in clause (i) based on the assessment, such as ranked by the criticality, level of risk, or usage of the components, or a combination thereof.(F)AutomationThe Director shall, to the greatest extent practicable, automate the assessment conducted under subparagraph (E).(G)PublicationThe Director shall publicly publish and maintain any tools developed to conduct the assessment described in subparagraph (E) as open source software.(H)Sharing(i)ResultsThe Director shall facilitate the sharing of the results of the assessment described in subparagraph (E) with appropriate Federal and non-Federal entities working to support the security of open source software, including by offering means for appropriate Federal and non-Federal entities to download the assessment in an automated manner. (ii)DatasetsThe Director may publicly publish, as appropriate, any datasets or versions of the datasets developed or consolidated as a result of the assessment described in subparagraph (E).(I)Critical infrastructure assessment study and pilot(i)StudyNot later than 2 years after the publication of the framework described in subparagraph (A), the Director shall conduct a study regarding the feasibility of the Director conducting the assessment described in subparagraph (E) for critical infrastructure entities.(ii)Pilot(I)In generalIf the Director determines that the assessment described in clause (i) is feasible, the Director may conduct a pilot assessment on a voluntary basis with 1 or more critical infrastructure sectors, in coordination with the Sector Risk Management Agency and the sector coordinating council of each participating sector.(II)TerminationIf the Director proceeds with the pilot described in clause (ii), the pilot shall terminate on the date that is 2 years after the date on which the Director begins the pilot.(iii)Reports(I)StudyNot later than 180 days after the date on which the Director completes the study conducted under clause (i), the Director shall submit to the appropriate congressional committees a report that—(aa)summarizes the study; and (bb)states whether the Director plans to proceed with the pilot described in clause (ii).(II)PilotIf the Director proceeds with the pilot described in clause (ii), not later than 1 year after the date on which the Director begins the pilot, the Director shall submit to the appropriate congressional committees a report that includes—(aa)a summary of the results of the pilot; and(bb)a recommendation as to whether the activities carried out under the pilot should be continued after the termination of the pilot described in clause (ii)(II). (3)Coordination with National Cyber DirectorThe Director shall—(A)brief the National Cyber Director on the activities described in this subsection; and(B)coordinate activities with the National Cyber Director, as appropriate.(4)Reports(A)In generalNot later than 1 year after the date of enactment of this section, and every 2 years thereafter, the Director shall submit to the appropriate congressional committees a report that includes—(i)a summary of the work on open source software security performed by the Director during the period covered by the report, including a list of the Federal and non-Federal entities with which the Director interfaced;(ii)the framework developed under paragraph (2)(A);(iii)a summary of any updates made to the framework developed under paragraph (2)(A) pursuant to paragraph (2)(B) since the last report submitted under this subparagraph;(iv)a summary of the assessment conducted pursuant to paragraph (2)(E);(v)a summary of changes made to the assessment conducted pursuant to paragraph (2)(E) since the last report submitted under this subparagraph, including overall security trends; and(vi)a summary of the types of entities with which the assessment was shared pursuant to paragraph (2)(H), including a list of the Federal and non-Federal entities with which the assessment was shared.(B)Public reportNot later than 30 days after the date on which the Director submits a report required under subparagraph (A), the Director shall make a version of the report publicly available on the website of the Agency.. Sec. 2220F. Open source software security duties..

2220F. Open source software security duties In this section, the term software bill of materials has the meaning given the term in the Minimum Elements for a Software Bill of Materials published by the Department of Commerce, or any superseding definition published by the Agency. The Director shall, to the greatest extent practicable, employ individuals in the Agency who— have expertise and experience participating in the open source software community; and perform the duties described in subsection (c). The Director shall— perform outreach and engagement to bolster the security of open source software; support Federal efforts to strengthen the security of open source software; coordinate, as appropriate, with non-Federal entities on efforts to ensure the long-term security of open source software; serve as a public point of contact regarding the security of open source software for non-Federal entities, including State, local, Tribal, and territorial partners, the private sector, international partners, open source software organizations, and open source software developers; and support Federal and non-Federal supply chain security efforts by encouraging efforts to bolster open source software security, such as— assisting in coordinated vulnerability disclosures in open source software components pursuant to section 2209(n); and supporting the activities of the Federal Acquisition Security Council. Not later than 1 year after the date of enactment of this section, the Director shall publicly publish a framework, incorporating government, industry, and open source software community frameworks and best practices, including those published by the National Institute of Standards and Technology, for assessing the risk of open source software components, including direct and indirect open source software dependencies, which shall incorporate, at a minimum— the security properties of code in a given open source software component, such as whether the code is written in a memory-safe programming language; the security practices of development, build, and release processes of a given open source software component, such as the use of multi-factor authentication by maintainers and cryptographic signing of releases; the number and severity of publicly known, unpatched vulnerabilities in a given open source software component; the breadth of deployment of a given open source software component; the level of risk associated with where a given open source software component is integrated or deployed, such as whether the component operates on a network boundary or in a privileged location; and the health of the community for a given open source software component, including, where applicable, the level of current and historical investment and maintenance in the open source software component, such as the number and activity of individual maintainers. Not less frequently than annually after the date on which the framework is published under subparagraph (A), the Director shall— determine whether updates are needed to the framework described in subparagraph (A), including the augmentation, addition, or removal of the elements described in clauses (i) through (vi) of such subparagraph; and if the Director determines that additional updates are needed under clause (i), make those updates to the framework. In developing the framework described in subparagraph (A), the Director shall consult with— appropriate Federal agencies, including the National Institute of Standards and Technology; individuals and nonprofit organizations from the open source software community; and private companies from the open source software community. The Director shall ensure, to the greatest extent practicable, that the framework described in subparagraph (A) is usable by the open source software community, including through the consultation described in subparagraph (C). Not later than 1 year after the publication of the framework described in subparagraph (A), and not less frequently than every 2 years thereafter, the Director shall, to the greatest extent practicable and using the framework described in subparagraph (A)— perform an assessment of open source software components used directly or indirectly by Federal agencies based on readily available, and, to the greatest extent practicable, machine readable, information, such as— software bills of material that are, at the time of the assessment, made available to the Agency or are otherwise accessible via the internet; software inventories, available to the Director at the time of the assessment, from the Continuous Diagnostics and Mitigation program of the Agency; and other publicly available information regarding open source software components; and develop 1 or more ranked lists of components described in clause (i) based on the assessment, such as ranked by the criticality, level of risk, or usage of the components, or a combination thereof. The Director shall, to the greatest extent practicable, automate the assessment conducted under subparagraph (E). The Director shall publicly publish and maintain any tools developed to conduct the assessment described in subparagraph (E) as open source software. The Director shall facilitate the sharing of the results of the assessment described in subparagraph (E) with appropriate Federal and non-Federal entities working to support the security of open source software, including by offering means for appropriate Federal and non-Federal entities to download the assessment in an automated manner. The Director may publicly publish, as appropriate, any datasets or versions of the datasets developed or consolidated as a result of the assessment described in subparagraph (E). Not later than 2 years after the publication of the framework described in subparagraph (A), the Director shall conduct a study regarding the feasibility of the Director conducting the assessment described in subparagraph (E) for critical infrastructure entities. If the Director determines that the assessment described in clause (i) is feasible, the Director may conduct a pilot assessment on a voluntary basis with 1 or more critical infrastructure sectors, in coordination with the Sector Risk Management Agency and the sector coordinating council of each participating sector. If the Director proceeds with the pilot described in clause (ii), the pilot shall terminate on the date that is 2 years after the date on which the Director begins the pilot. Not later than 180 days after the date on which the Director completes the study conducted under clause (i), the Director shall submit to the appropriate congressional committees a report that— summarizes the study; and states whether the Director plans to proceed with the pilot described in clause (ii). If the Director proceeds with the pilot described in clause (ii), not later than 1 year after the date on which the Director begins the pilot, the Director shall submit to the appropriate congressional committees a report that includes— a summary of the results of the pilot; and a recommendation as to whether the activities carried out under the pilot should be continued after the termination of the pilot described in clause (ii)(II). The Director shall— brief the National Cyber Director on the activities described in this subsection; and coordinate activities with the National Cyber Director, as appropriate. Not later than 1 year after the date of enactment of this section, and every 2 years thereafter, the Director shall submit to the appropriate congressional committees a report that includes— a summary of the work on open source software security performed by the Director during the period covered by the report, including a list of the Federal and non-Federal entities with which the Director interfaced; the framework developed under paragraph (2)(A); a summary of any updates made to the framework developed under paragraph (2)(A) pursuant to paragraph (2)(B) since the last report submitted under this subparagraph; a summary of the assessment conducted pursuant to paragraph (2)(E); a summary of changes made to the assessment conducted pursuant to paragraph (2)(E) since the last report submitted under this subparagraph, including overall security trends; and a summary of the types of entities with which the assessment was shared pursuant to paragraph (2)(H), including a list of the Federal and non-Federal entities with which the assessment was shared. Not later than 30 days after the date on which the Director submits a report required under subparagraph (A), the Director shall make a version of the report publicly available on the website of the Agency.

4. Software security advisory subcommittee Section 2219(d)(1) of the Homeland Security Act of 2002 (6 U.S.C. 665e(d)(1)) is amended by adding at the end the following: Software security, including open source software security. (E)Software security, including open source software security..

5. Open source software guidance In this section: The term appropriate congressional committee has the meaning given the term in section 2 of the Homeland Security Act of 2002 (6 U.S.C. 101). The term covered agency means an agency described in section 901(b) of title 31, United States Code. The term Director means the Director of the Office of Management and Budget. The term national security system has the meaning given the term in section 3552 of title 44, United States Code. The terms open source software and open source software community have the meanings given those terms in section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650), as amended by section 3 of this Act. Not later than 1 year after the date of enactment of this Act, the Director, in coordination with the National Cyber Director, the Director of the Cybersecurity and Infrastructure Security Agency, and the Administrator of General Services, shall issue guidance on the responsibilities of the chief information officer at each covered agency regarding open source software, which shall include— how chief information officers at each covered agency should, considering industry and open source software community best practices— manage and reduce risks of using open source software; and guide contributing to and releasing open source software; how chief information officers should enable, rather than inhibit, the secure usage of open source software at each covered agency; any relevant updates to the Memorandum M–16–21 issued by the Office of Management and Budget on August 8, 2016, entitled, Federal Source Code Policy: Achieving Efficiency, Transparency, and Innovation through Reusable and Open Source Software; and how covered agencies may contribute publicly to open source software that the covered agency uses, including how chief information officers should encourage those contributions. The guidance issued under paragraph (1) shall not apply to national security systems. Not later than 1 year after the date of enactment of this Act, the chief information officer of each covered agency selected under paragraph (2), in coordination with the Director, the National Cyber Director, the Director of the Cybersecurity and Infrastructure Security Agency, and the Administrator of General Services, shall establish a pilot open source function at the covered agency that— is modeled after open source program offices, such as those in the private sector, the nonprofit sector, academia, and other non-Federal entities; and shall— support the secure usage of open source software at the covered agency; develop policies and processes for contributions to and releases of open source software at the covered agency, in consultation, as appropriate, with the offices of general counsel and procurement of the covered agency; interface with the open source software community; and manage and reduce risks of using open source software at the covered agency. The Director, in coordination with the National Cyber Director, the Director of the Cybersecurity and Infrastructure Security Agency, and the Administrator of General Services, shall select not less than 1 and not more than 5 covered agencies to conduct the pilot described in paragraph (1). Not later than 1 year after the establishment of the pilot open source functions described in paragraph (1), the Director, in coordination with the National Cyber Director, the Director of the Cybersecurity and Infrastructure Security Agency, and the Administrator of General Services, shall assess whether open source functions should be established at some or all covered agencies, including— how to organize those functions within covered agencies, such as the creation of open source program offices; and appropriate roles and responsibilities for those functions. Notwithstanding the termination of the pilot open source functions under paragraph (5), if the Director determines, based on the assessment described in paragraph (3), that some or all of the open source functions should be established at some or all covered agencies, the Director, in coordination with the National Cyber Director, the Director of the Cybersecurity and Infrastructure Security Agency, and the Administrator of General Services, shall issue guidance on the implementation of those functions. The pilot open source functions described in paragraph (1) shall terminate not later than 4 years after the establishment of the pilot open source functions. The Director shall— not later than 1 year after the date of enactment of this Act, brief the appropriate congressional committees on the guidance issued under subsection (b); and not later than 540 days after the establishment of the pilot open source functions under subsection (c)(1), submit to the appropriate congressional committees a report on— the pilot open source functions; and the results of the assessment conducted under subsection (c)(3). Section 3554(b) of title 44, United States Code, is amended— in paragraph (7), by striking and at the end; in paragraph (8), by striking the period at the end and inserting ; and; and by adding at the end the following: plans and procedures to ensure the secure usage and development of software, including open source software. (9)plans and procedures to ensure the secure usage and development of software, including open source software..

6. Rule of construction Nothing in this Act or the amendments made by this Act shall be construed to provide any additional regulatory authority to any Federal agency described therein.