Legacy IT Reduction Act of 2023

II Calendar No. 383 118TH CONGRESS 2D SESSION S. 2032 [Report No. 118–172] To require the reduction of the reliance and expenditures of the Federal Government on legacy information technology systems, and for other purposes. IN THE SENATE OF THE UNITED STATES JUNE 15, 2023 Ms. HASSAN (for herself, Mr. CORNYN, and Mr. WYDEN) introduced the fol- lowing bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs MAY 9, 2024 Reported by Mr. PETERS, with an amendment [Strike out all after the enacting clause and insert the part printed in italic] A BILL To require the reduction of the reliance and expenditures of the Federal Government on legacy information tech- nology systems, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Legacy IT Reduction 4 Act of 2023’’. 5 VerDate Sep 11 2014 01:48 May 10, 2024 Jkt 049200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6401 E:\BILLS\S2032.RS S2032 kjohnson on DSK7ZCZBW3PROD with $$_JOB 2 •S 2032 RS SEC. 2. DEFINITIONS. 1 In this Act: 2 (1) ADMINISTRATOR.—The term ‘‘Adminis- 3 trator’’ means the Administrator of General Serv- 4 ices. 5 (2) AGENCY.—The term ‘‘agency’’ means an 6 agency described in paragraph (1) or (2) of section 7 901(b) of title 31, United States Code. 8 (3) CHIEF INFORMATION OFFICER.—The term 9 ‘‘Chief Information Officer’’ means a Chief Informa- 10 tion Officer designated under section 3506(a)(2) of 11 title 44, United States Code. 12 (4) COMPTROLLER GENERAL.—The term 13 ‘‘Comptroller General’’ means the Comptroller Gen- 14 eral of the United States. 15 (5) CONGRESSIONAL OVERSIGHT COMMITTEE.— 16 The term ‘‘congressional oversight committee’’ 17 means, with respect to a particular agency, a com- 18 mittee or subcommittee of the Senate and the House 19 of Representatives that provides oversight of the 20 agency. 21 (6) DIRECTOR.—The term ‘‘Director’’ means 22 the Director of the Office of Management and Budg- 23 et. 24 (7) INFORMATION TECHNOLOGY.—The term 25 ‘‘information technology’’ has the meaning given the 26 VerDate Sep 11 2014 01:48 May 10, 2024 Jkt 049200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6401 E:\BILLS\S2032.RS S2032 kjohnson on DSK7ZCZBW3PROD with $$_JOB 3 •S 2032 RS term in section 11101 of title 40, United States 1 Code. 2 (8) IT WORKING CAPITAL FUND; LEGACY IN- 3 FORMATION TECHNOLOGY SYSTEM.—The terms ‘‘IT 4 working capital fund’’ and ‘‘legacy information tech- 5 nology system’’ have the meaning given the terms in 6 section 1076 of the National Defense Authorization 7 Act for Fiscal Year 2018 (40 U.S.C. 11301 note; 8 Public Law 115–91). 9 (9) NATIONAL SECURITY SYSTEM.—The term 10 ‘‘national security system’’ has the meaning given 11 the term in section 11103 of title 40, United States 12 Code. 13 (10) TECHNOLOGY MODERNIZATION FUND.— 14 The term ‘‘Technology Modernization Fund’’ means 15 the fund established under section 1078(b)(1) of the 16 National Defense Authorization Act for Fiscal Year 17 2018 (40 U.S.C. 11301 note; Public Law 115–91). 18 SEC. 3. LEGACY INFORMATION TECHNOLOGY SYSTEM IN- 19 VENTORY. 20 (a) INVENTORY OF LEGACY INFORMATION TECH- 21 NOLOGY SYSTEMS.— 22 (1) IN GENERAL.—Not later than 1 year after 23 the date of enactment of this Act, and not later than 24 5 years thereafter, the Chief Information Officer of 25 VerDate Sep 11 2014 01:48 May 10, 2024 Jkt 049200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6401 E:\BILLS\S2032.RS S2032 kjohnson on DSK7ZCZBW3PROD with $$_JOB 4 •S 2032 RS each agency shall compile an inventory that lists 1 each legacy information technology system used, op- 2 erated, or maintained by the agency. 3 (2) CONTENTS.—The Director shall issue guid- 4 ance prescribing the information that the Chief In- 5 formation Officer of each agency shall include for 6 each legacy technology information system listed in 7 the inventory required under paragraph (1). In 8 issuing such guidance, the Director shall consider in- 9 cluding for each legacy technology information sys- 10 tem listed in the inventory— 11 (A) the name or an identification of the 12 legacy information technology system; 13 (B) the office or mission of the agency that 14 the legacy information technology system sup- 15 ports and how the office or mission uses the 16 legacy information technology system; 17 (C) to the extent that information is avail- 18 able— 19 (i) the date of the last update or re- 20 fresh of the legacy information technology 21 system; 22 (ii) the annual price, including recur- 23 ring subscription costs and any costs to 24 VerDate Sep 11 2014 01:48 May 10, 2024 Jkt 049200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6401 E:\BILLS\S2032.RS S2032 kjohnson on DSK7ZCZBW3PROD with $$_JOB 5 •S 2032 RS contract labor, to operate or maintain the 1 legacy information technology system; and 2 (iii) the name and contact information 3 of the vendor; and 4 (D) the date of the next expected update 5 or modernization, retirement, or disposal of the 6 legacy information technology system. 7 (b) TRANSPARENCY AND ACCOUNTABILITY.— 8 (1) IN GENERAL.—Upon request by a House of 9 Congress, a congressional oversight committee of an 10 agency, the Comptroller General of the United 11 States, or an inspector general of an agency, the 12 head of the agency shall make available the inven- 13 tory compiled under subsection (a)(1) or the relevant 14 portion of that inventory. 15 (2) REPORTING.—The Director may require an 16 agency to include the inventory compiled under sub- 17 section (a)(1) in a reporting structure determined by 18 the Director. 19 SEC. 4. AGENCY LEGACY INFORMATION TECHNOLOGY SYS- 20 TEMS MODERNIZATION PLANS. 21 (a) IN GENERAL.—Not later than 2 years after the 22 date of enactment of this Act, and every 5 years there- 23 after, the head of an agency shall develop and include as 24 part of the information resource management strategic 25 VerDate Sep 11 2014 01:48 May 10, 2024 Jkt 049200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6401 E:\BILLS\S2032.RS S2032 kjohnson on DSK7ZCZBW3PROD with $$_JOB 6 •S 2032 RS plan of the agency submitted under section 3506(b)(2) of 1 title 44, United States Code, a plan to modernize the leg- 2 acy information technology systems of the agency. 3 (b) CONTENTS.—A modernization plan of an agency 4 developed under subsection (a) shall include— 5 (1) an inventory of the legacy information tech- 6 nology systems of the agency; 7 (2) an identification of legacy information tech- 8 nology systems that the agency has prioritized for 9 updates, modernization, retirement, or disposal; 10 (3) steps the agency intends to make toward 11 updating, modernizing, retiring, or disposing of the 12 legacy information technology systems of the agency 13 prioritized under paragraph (2) during the 5-year 14 period beginning on the date of submission of the 15 plan; and 16 (4) any additional information that the Director 17 determines necessary or useful for the agency to 18 consider or include to effectively and efficiently exe- 19 cute the modernization plan, which may include— 20 (A) the capacity of the agency to operate 21 and maintain an updated or modernized legacy 22 information technology system; 23 VerDate Sep 11 2014 01:48 May 10, 2024 Jkt 049200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6401 E:\BILLS\S2032.RS S2032 kjohnson on DSK7ZCZBW3PROD with $$_JOB 7 •S 2032 RS (B) the estimated cost and sources of 1 funding required to execute the modernization 2 plan; and 3 (C) the ability of the agency to adapt an 4 updated or modernized legacy information tech- 5 nology system to changes in policy, technology, 6 or other user needs, as necessary. 7 (c) PUBLICATION AND SUBMISSION TO CONGRESS.— 8 Not later than 30 days after the date on which the head 9 of an agency submits the modernization plan developed 10 under subsection (a) as part of the information resource 11 management strategic plan of the agency submitted under 12 section 3506(b)(2) of title 44, United States Code, the 13 head of the agency shall submit the modernization plan 14 to the Committee on Homeland Security and Govern- 15 mental Affairs of the Senate, the Committee on Oversight 16 and Accountability of the House of Representatives, and 17 each congressional oversight committee of the agency. 18 SEC. 5. ROLE OF THE OFFICE OF MANAGEMENT AND BUDG- 19 ET. 20 Not later than 180 days after the date of enactment 21 of this Act, the Director, in coordination with the Adminis- 22 trator of the Office of Electronic Government, shall issue 23 guidance on the implementation of this Act and the 24 amendments made by this Act, which shall include— 25 VerDate Sep 11 2014 01:48 May 10, 2024 Jkt 049200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6401 E:\BILLS\S2032.RS S2032 kjohnson on DSK7ZCZBW3PROD with $$_JOB 8 •S 2032 RS (1) criteria to determine whether information 1 technology qualifies as a ‘‘legacy information tech- 2 nology system’’ for the purposes of compiling the in- 3 ventory required under section 3(a)(1); 4 (2) instructions and templates to inform the 5 compilation of the inventory required under section 6 3(a)(1), as necessary; 7 (3) instructions and templates to inform the 8 compilation and publication of, and any subsequent 9 updates to, the modernization plans required under 10 section 4(a), as necessary; and 11 (4) any other guidance determined necessary 12 for the implementation of this Act or the amend- 13 ments made by this Act, including how the imple- 14 mentation of this Act or those amendments com- 15 plements laws, regulations, and guidance relating to 16 information technology modernization. 17 SEC. 6. COMPTROLLER GENERAL REVIEW. 18 (a) IN GENERAL.—Not later than 3 years after the 19 date of enactment of this Act, the Comptroller General 20 shall submit to the Committee on Homeland Security and 21 Governmental Affairs of the Senate and the Committee 22 on Oversight and Accountability of the House of Rep- 23 resentatives a report on— 24 VerDate Sep 11 2014 01:48 May 10, 2024 Jkt 049200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6401 E:\BILLS\S2032.RS S2032 kjohnson on DSK7ZCZBW3PROD with $$_JOB 9 •S 2032 RS (1) the implementation of this Act and the 1 amendments made by this Act; and 2 (2) how this Act and the amendments made by 3 this Act function alongside other information tech- 4 nology modernization offices, policies, and programs, 5 such as— 6 (A) the Technology Modernization Fund 7 and the IT working capital fund; 8 (B) the Federal Risk and Authorization 9 Management Program, the 18F program, and 10 the 10X program of the General Services Ad- 11 ministration; 12 (C) programs and policies of the Office of 13 Management and Budget, including the Office 14 of Electronic Government and the United 15 States Digital Service; and 16 (D) any other office, policy, or program of 17 the Federal Government determined relevant by 18 the Comptroller General. 19 SEC. 7. PROTECTION OF SENSITIVE INFORMATION; EXEMP- 20 TION OF NATIONAL SECURITY SYSTEMS. 21 (a) IN GENERAL.—Nothing in this Act or the amend- 22 ments made by this Act shall be construed to require the 23 head of an agency to disclose sensitive information that— 24 VerDate Sep 11 2014 01:48 May 10, 2024 Jkt 049200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6401 E:\BILLS\S2032.RS S2032 kjohnson on DSK7ZCZBW3PROD with $$_JOB 10 •S 2032 RS (1) is protected from disclosure under any other 1 law; or 2 (2) would compromise the security of any infor- 3 mation technology system of the Federal Govern- 4 ment. 5 (b) EXEMPTION.—Nothing in this Act or the amend- 6 ments made by this Act shall be construed to authorize 7 or require the head of an agency to inventory, develop a 8 report relating to, or transfer, a national security system. 9 SECTION 1. SHORT TITLE. 10 This Act may be cited as the ‘‘Legacy IT Reduction 11 Act of 2023’’. 12 SEC. 2. DEFINITIONS. 13 In this Act: 14 (1) ADMINISTRATOR.—The term ‘‘Adminis- 15 trator’’ means the Administrator of General Services. 16 (2) AGENCY.—The term ‘‘agency’’ means an 17 agency described in paragraph (1) or (2) of section 18 901(b) of title 31, United States Code. 19 (3) CHIEF INFORMATION OFFICER.—The term 20 ‘‘Chief Information Officer’’ means a Chief Informa- 21 tion Officer designated under section 3506(a)(2) of 22 title 44, United States Code. 23 VerDate Sep 11 2014 01:48 May 10, 2024 Jkt 049200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6203 E:\BILLS\S2032.RS S2032 kjohnson on DSK7ZCZBW3PROD with $$_JOB 11 •S 2032 RS (4) COMPTROLLER GENERAL.—The term ‘‘Comp- 1 troller General’’ means the Comptroller General of the 2 United States. 3 (5) CONGRESSIONAL OVERSIGHT COMMITTEE.— 4 The term ‘‘congressional oversight committee’’ means, 5 with respect to a particular agency, a committee or 6 subcommittee of the Senate or the House of Represent- 7 atives that provides oversight of the agency. 8 (6) DIRECTOR.—The term ‘‘Director’’ means the 9 Director of the Office of Management and Budget. 10 (7) INFORMATION TECHNOLOGY.—The term ‘‘in- 11 formation technology’’ has the meaning given the term 12 in section 11101 of title 40, United States Code. 13 (8) IT WORKING CAPITAL FUND; LEGACY INFOR- 14 MATION TECHNOLOGY SYSTEM.—The terms ‘‘IT work- 15 ing capital fund’’ and ‘‘legacy information technology 16 system’’ have the meanings given the terms in section 17 1076 of the National Defense Authorization Act for 18 Fiscal Year 2018 (40 U.S.C. 11301 note; Public Law 19 115–91). 20 (9) NATIONAL SECURITY SYSTEM.—The term 21 ‘‘national security system’’ has the meaning given the 22 term in section 11103 of title 40, United States Code. 23 (10) TECHNOLOGY MODERNIZATION FUND.—The 24 term ‘‘Technology Modernization Fund’’ means the 25 VerDate Sep 11 2014 01:48 May 10, 2024 Jkt 049200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6203 E:\BILLS\S2032.RS S2032 kjohnson on DSK7ZCZBW3PROD with $$_JOB 12 •S 2032 RS fund established under section 1078(b)(1) of the Na- 1 tional Defense Authorization Act for Fiscal Year 2018 2 (40 U.S.C. 11301 note; Public Law 115–91). 3 SEC. 3. LEGACY INFORMATION TECHNOLOGY SYSTEM IN- 4 VENTORY. 5 (a) INVENTORY OF LEGACY INFORMATION TECH- 6 NOLOGY SYSTEMS.— 7 (1) IN GENERAL.—Not later than 1 year after 8 the date of enactment of this Act, and not later than 9 5 years thereafter, the Chief Information Officer of 10 each agency shall compile an inventory that lists each 11 legacy information technology system used, operated, 12 or maintained by the agency. 13 (2) CONTENTS.—The Director shall issue guid- 14 ance prescribing the information that the Chief Infor- 15 mation Officer of each agency shall include for each 16 legacy technology information system listed in the in- 17 ventory required under paragraph (1). In issuing 18 such guidance, [Text truncated for display. Full text available on Congress.gov.]