Securing Open Source Software Act of 2023

IB Union Calendar No. 127 118TH CONGRESS 1ST SESSION H. R. 3286 [Report No. 118–160, Part I] To amend the Homeland Security Act of 2002 to establish the duties of the Director of the Cybersecurity and Infrastructure Security Agency regarding open source software security, and for other purposes. IN THE HOUSE OF REPRESENTATIVES MAY 15, 2023 Mr. GREEN of Tennessee (for himself, Mr. GARBARINO, and Mr. SWALWELL) introduced the following bill; which was referred to the Committee on Homeland Security, and in addition to the Committee on Oversight and Accountability, for a period to be subsequently determined by the Speak- er, in each case for consideration of such provisions as fall within the ju- risdiction of the committee concerned JULY 27, 2023 Additional sponsor: Mr. LALOTA JULY 27, 2023 Reported from the Committee on Homeland Security with an amendment [Strike out all after the enacting clause and insert the part printed in italic] JULY 27, 2023 Committee on Oversight and Accountability discharged; committed to the Committee of the Whole House on the State of the Union and ordered to be printed [For text of introduced bill, see copy of bill as introduced on May 15, 2023] VerDate Sep 11 2014 01:05 Jul 28, 2023 Jkt 039200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6652 E:\BILLS\H3286.RH H3286 kjohnson on DSK79L0C42PROD with BILLS 2 •HR 3286 RH A BILL To amend the Homeland Security Act of 2002 to establish the duties of the Director of the Cybersecurity and Infra- structure Security Agency regarding open source soft- ware security, and for other purposes. VerDate Sep 11 2014 01:05 Jul 28, 2023 Jkt 039200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6652 E:\BILLS\H3286.RH H3286 kjohnson on DSK79L0C42PROD with BILLS 3 •HR 3286 RH Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Securing Open Source 4 Software Act of 2023’’. 5 SEC. 2. OPEN SOURCE SOFTWARE SECURITY DUTIES. 6 (a) IN GENERAL.—Title XXII of the Homeland Secu- 7 rity Act of 2002 (6 U.S.C. 650 et seq.) is amended— 8 (1) in section 2200 (6 U.S.C. 650)— 9 (A) by redesignating paragraphs (22) 10 through (28) as paragraphs (25) through (31), 11 respectively; and 12 (B) by inserting after paragraph (21) the 13 following new paragraphs: 14 ‘‘(22) OPEN SOURCE SOFTWARE.—The term 15 ‘open source software’ means software for which the 16 human-readable source code is made available to the 17 public for use, study, re-use, modification, enhance- 18 ment, and re-distribution. 19 ‘‘(23) OPEN SOURCE SOFTWARE COMMUNITY.— 20 The term ‘open source software community’ means the 21 community of individuals, foundations, nonprofit or- 22 ganizations, corporations, and other entities that— 23 ‘‘(A) develop, contribute to, maintain, and 24 publish open source software; or 25 VerDate Sep 11 2014 01:05 Jul 28, 2023 Jkt 039200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6203 E:\BILLS\H3286.RH H3286 kjohnson on DSK79L0C42PROD with BILLS 4 •HR 3286 RH ‘‘(B) otherwise work to ensure the security 1 of the open source software ecosystem. 2 ‘‘(24) OPEN SOURCE SOFTWARE COMPONENT.— 3 The term ‘open source software component’ means an 4 individual repository of open source software that is 5 made available to the public.’’; 6 (2) in section 2202(c) (6 U.S.C. 652(c))— 7 (A) in paragraph (13), by striking ‘‘and’’ 8 at the end; 9 (B) by redesignating paragraph (14) as 10 paragraph (15); and 11 (C) by inserting after paragraph (13) the 12 following: 13 ‘‘(14) support, including by offering services, the 14 secure usage and deployment of software, including 15 open source software, in the software development 16 lifecycle at Federal agencies in accordance with sec- 17 tion 2220F; and’’; and 18 (3) by adding at the end the following: 19 ‘‘SEC. 2220F. OPEN SOURCE SOFTWARE SECURITY DUTIES. 20 ‘‘(a) DEFINITION.—In this section, the term ‘software 21 bill of materials’ has the meaning given such term in the 22 Minimum Elements for a Software Bill of Materials pub- 23 lished by the Department of Commerce, or any superseding 24 definition published by the Agency. 25 VerDate Sep 11 2014 01:05 Jul 28, 2023 Jkt 039200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6203 E:\BILLS\H3286.RH H3286 kjohnson on DSK79L0C42PROD with BILLS 5 •HR 3286 RH ‘‘(b) EMPLOYMENT.—The Director shall, to the greatest 1 extent practicable, employ individuals in the Agency who— 2 ‘‘(1) have expertise and experience participating 3 in the open source software community; and 4 ‘‘(2) perform the duties described in subsection 5 (c). 6 ‘‘(c) DUTIES OF THE DIRECTOR.— 7 ‘‘(1) IN GENERAL.—The Director shall— 8 ‘‘(A) perform outreach and engagement to 9 bolster the security of open source software; 10 ‘‘(B) support Federal efforts to strengthen 11 the security of open source software; 12 ‘‘(C) coordinate, as appropriate, with non- 13 Federal entities on efforts to ensure the long-term 14 security of open source software; 15 ‘‘(D) serve as a public point of contact re- 16 garding the security of open source software for 17 non-Federal entities, including State, local, Trib- 18 al, and territorial partners, the private sector, 19 international partners, and open source software 20 communities; and 21 ‘‘(E) support Federal and non-Federal sup- 22 ply chain security efforts by encouraging efforts 23 to bolster open source software security, such 24 as— 25 VerDate Sep 11 2014 01:05 Jul 28, 2023 Jkt 039200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6203 E:\BILLS\H3286.RH H3286 kjohnson on DSK79L0C42PROD with BILLS 6 •HR 3286 RH ‘‘(i) assisting in coordinated vulner- 1 ability disclosures in open source software 2 components pursuant to section 2209(n); 3 and 4 ‘‘(ii) supporting the activities of the 5 Federal Acquisition Security Council. 6 ‘‘(2) ASSESSMENT OF CRITICAL OPEN SOURCE 7 SOFTWARE COMPONENTS.— 8 ‘‘(A) FRAMEWORK.—Not later than one 9 year after the date of the enactment of this sec- 10 tion, the Director shall publicly publish a frame- 11 work, incorporating government, private sector, 12 and open source software community frameworks 13 and best practices, including those published by 14 the National Institute of Standards and Tech- 15 nology, for assessing the risk of open source soft- 16 ware components, including direct and indirect 17 open source software dependencies, which shall 18 incorporate, at a minimum, the following with 19 respect to a given open source software compo- 20 nent: 21 ‘‘(i) The security properties of code, 22 such as whether the code is written in a 23 memory-safe programming language or suc- 24 cessor language. 25 VerDate Sep 11 2014 01:05 Jul 28, 2023 Jkt 039200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6203 E:\BILLS\H3286.RH H3286 kjohnson on DSK79L0C42PROD with BILLS 7 •HR 3286 RH ‘‘(ii) The security practices of develop- 1 ment, build, and release processes, such as 2 the use of multi-factor authentication by 3 maintainers and cryptographic signing of 4 releases. 5 ‘‘(iii) The number and severity of pub- 6 licly known, unpatched vulnerabilities. 7 ‘‘(iv) The breadth of deployment. 8 ‘‘(v) The level of risk associated with 9 where such component is integrated or de- 10 ployed, such as whether such component op- 11 erates on a network boundary or in a privi- 12 leged location. 13 ‘‘(vi) The health and sustainability of 14 the open source software community, in- 15 cluding, where applicable, the level of cur- 16 rent and historical investment and mainte- 17 nance in such component, such as the num- 18 ber and activity of individual maintainers. 19 ‘‘(B) UPDATING FRAMEWORK.—Not less fre- 20 quently than annually after the date on which 21 the framework is published under subparagraph 22 (A), the Director shall— 23 ‘‘(i) determine whether updates are 24 needed to such framework, including the 25 VerDate Sep 11 2014 01:05 Jul 28, 2023 Jkt 039200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6203 E:\BILLS\H3286.RH H3286 kjohnson on DSK79L0C42PROD with BILLS 8 •HR 3286 RH augmentation, addition, or removal of the 1 elements described in clauses (i) through 2 (vi) of such subparagraph; and 3 ‘‘(ii) if the Director so determines that 4 such additional updates are needed, make 5 such updates. 6 ‘‘(C) DEVELOPING FRAMEWORK.—In devel- 7 oping the framework described in subparagraph 8 (A), the Director shall consult with the following: 9 ‘‘(i) Appropriate Federal agencies, in- 10 cluding the National Institute of Standards 11 and Technology. 12 ‘‘(ii) The open source software commu- 13 nity. 14 ‘‘(D) USABILITY.—The Director shall en- 15 sure, to the greatest extent practicable, that the 16 framework described in subparagraph (A) is usa- 17 ble by the open source software community, in- 18 cluding through the consultation required under 19 subparagraph (C). 20 ‘‘(E) FEDERAL OPEN SOURCE SOFTWARE 21 ASSESSMENT.—Not later than one year after the 22 publication of the framework under subpara- 23 graph (A) and not less frequently than every two 24 years thereafter, the Director shall, to the great- 25 VerDate Sep 11 2014 01:05 Jul 28, 2023 Jkt 039200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6203 E:\BILLS\H3286.RH H3286 kjohnson on DSK79L0C42PROD with BILLS 9 •HR 3286 RH est extent practicable and using such frame- 1 work— 2 ‘‘(i) perform an assessment of each 3 open source software component deployed on 4 high value assets, as described in Office of 5 Management and Budget memorandum M- 6 19-03 (issued December 10, 2018) or suc- 7 cessor guidance, at Federal agencies based 8 on readily available, and, to the greatest ex- 9 tent practicable, machine readable, informa- 10 tion, such as— 11 ‘‘(I) software bills of material that 12 are, at the time of the assessment, 13 made available to the Agency or are 14 otherwise accessible via the internet; 15 ‘‘(II) software inventories, avail- 16 able to the Director at the time of the 17 assessment, from the Continuous 18 Diagnostics and Mitigation program of 19 the Agency; and 20 ‘‘(III) other publicly available in- 21 formation regarding open source soft- 22 ware components; and 23 ‘‘(ii) develop, in consultation with the 24 Federal agency at which an open source 25 VerDate Sep 11 2014 01:05 Jul 28, 2023 Jkt 039200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6203 E:\BILLS\H3286.RH H3286 kjohnson on DSK79L0C42PROD with BILLS 10 •HR 3286 RH software component is deployed, one or 1 more ranked lists of components described 2 in clause (i) based on such assessment, such 3 as ranked by the criticality, level of risk, or 4 usage of the components, or a combination 5 thereof. 6 ‘‘(F) AUTOMATION.—The Director shall, to 7 the greatest extent practicable, automate the as- 8 sessment performed pursuant to subparagraph 9 (E). 10 ‘‘(G) PUBLICATION.—The Director shall 11 publicly publish and maintain any tools devel- 12 oped to perform the assessment under subpara- 13 graph (E) as open source software. 14 ‘‘(H) SHARING.— 15 ‘‘(i) RESULTS.—The Director, to the 16 greatest extent practicable, and taking into 17 account the sensitivity of the information 18 contained in the assessment performed pur- 19 suant to subparagraph (E), shall facilitate 20 the sharing of the results of each assessment 21 under subparagraph (E)(i) with appro- 22 priate Federal and non-Federal entities 23 working to support the security of open 24 source software, including by offering means 25 VerDate Sep 11 2014 01:05 Jul 28, 2023 Jkt 039200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6203 E:\BILLS\H3286.RH H3286 kjohnson on DSK79L0C42PROD with BILLS 11 •HR 3286 RH for appropriate Federal and non-Federal 1 entities to download the assessment in an 2 automated manner. 3 ‘‘(ii) DATASETS.—The Director may 4 publicly publish, as appropriate, any 5 datasets or versions of the datasets developed 6 or consolidated as a result of an assessment 7 under subparagraph (E)(i). 8 ‘‘(I) CRITICAL INFRASTRUCTURE ASSESS- 9 MENT STUDY AND PILOT.— 10 ‘‘(i) STUDY.—Not later than two years 11 after the publication of the framework under 12 subparagraph (A), the Director shall con- 13 duct a study regarding the feasibility of the 14 Director conducting the assessment under 15 subparagraph (E) for critical infrastructure 16 entities. 17 ‘‘(ii) PILOT.— 18 ‘‘(I) IN GENERAL.—If the Director 19 determines that the assessment de- 20 scribed in clause (i) is feasible, the Di- 21 rector may conduct a pilot assessment 22 on a voluntary basis with one or more 23 critical infrastructure sectors, in co- 24 ordination with the Sector Risk Man- 25 VerDate Sep 11 2014 01:05 Jul 28, 2023 Jkt 039200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6203 E:\BILLS\H3286.RH H3286 kjohnson on DSK79L0C42PROD with BILLS 12 •HR 3286 RH agement Agency and the sector coordi- 1 nating council of each participating 2 sector. 3 ‘‘(II) TERMINATION.—If the Di- 4 rector proceeds with the pilot assess- 5 ment described in subclause (I), such 6 pilot assessment shall terminate not 7 later than two years after the date on 8 which the Director begins such pilot 9 assessment. 10 ‘‘(iii) REPORTS.— 11 ‘‘(I) STUDY.—Not later than 180 12 days after the date on which the Direc- 13 tor completes the study conducted 14 under clause (i), the Director shall sub- 15 mit to the appropriate congressional 16 committees a report that— 17 ‘‘(aa) summarizes the study; 18 ‘‘(bb) states whether the Di- 19 rector plans to proceed with the 20 pilot assessment described in 21 clause (ii)(I); and 22 ‘‘(cc) if the Director proceeds 23 with such pilot assessment, de- 24 scribes— 25 VerDate Sep 11 2014 01:05 Jul 28, 2023 Jkt 039200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6203 E:\BILLS\H3286.RH H3286 kjohnson on DSK79L0C42PROD with BILLS 13 •HR 3286 RH ‘‘(AA) the methodology 1 for selecting the critical in- 2 frastructure sector or sectors 3 to participate in the pilot; 4 and 5 ‘‘(BB) the resources re- 6 quired to carry out the pilot. 7 ‘‘(II) PILOT.—If the Director pro- 8 ceeds with the pilot assessment de- 9 scribed in clause (ii), not later than 10 one year after the date on which the 11 Director begins such pilot assessment, 12 the Director shall submit to the appro- 13 priate congressional committees a re- 14 port that includes the following: 15 ‘‘(aa) A summary of the re- 16 sults of such pilot assessment. 17 ‘‘(bb) A recommendation as 18 to whether the activities carried 19 out under such pilot assessment 20 should be continued after the ter- 21 mination of such pilot assessment 22 in accordance with clause (ii)(II). 23 ‘‘(3) CONSULTATION WITH NATIONAL CYBER DI- 24 RECTOR.—The Director shall— 25 VerDate Sep 11 2014 01:05 Jul 28, 2023 Jkt 039200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6203 E:\BILLS\H3286.RH H3286 kjohnson on DSK79L0C42PROD with BILLS 14 •HR 3286 RH ‘‘(A) brief the National Cyber Director on 1 the activities described in this subsec [Text truncated for display. Full text available on Congress.gov.]