3.0.0 5793 2023-01-11T13:25:14Z 2023-01-11T13:25:14Z House H HR 2014-12-04 113 From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]By Mr. ROYCE:H.R. 5793.Congress has the power to enact this legislation pursuantto the following:Article I, Section 8, Clause 18[Page H8669]]]> hsgo00 Oversight and Accountability Committee House Standing Referred to 2014-12-04T14:01:05Z 2014-12-04 Referred to the House Committee on Oversight and Government Reform. IntroReferral H11100 2 House floor actions hsgo00 Oversight and Accountability Committee 2014-12-04 Sponsor introductory remarks on measure. (CR E1743-1745) IntroReferral B00100 9 Library of Congress 2014-12-04 Introduced in House IntroReferral Intro-H 9 Library of Congress 2014-12-04 Introduced in House IntroReferral 1000 9 Library of Congress R000487 Rep. Royce, Edward R. [R-CA-39] ED ROYCE R CA 39 N J000290 Rep. Jenkins, Lynn [R-KS-2] Lynn Jenkins R KS 2 2014-12-04 True Government Operations and Politics Administrative law and regulatory procedures Computer security and identity theft Computers and information technology Government information and archives Homeland security Office of Management and Budget (OMB) Public contracts and procurement Government Operations and Politics 00 2014-12-04 Introduced in House 2015-01-14T16:08:57Z Cyber Supply Chain Management and Transparency Act of 2014 - Requires the Office of Management and Budget (OMB) to issue guidelines for agencies that contract to acquire software, firmware, or products containing a third party or open source binary component.

Requires binary component contracts to include clauses requiring:

  • a confidentially supplied list, or a bill of materials, of each binary component that is used in the software, firmware, or product;
  • the contractor to verify that products do not contain known security vulnerabilities and to notify the purchasing agency of any known vulnerabilities or defects;
  • the contractor to obtain a waiver from the purchasing agency for components known to be vulnerable;
  • an agency approving a vulnerability waiver to accept all risk associated with component use;
  • product designs to allow fixes with patches, updates, or replacements; and
  • the contractor to provide timely repairs for discovered vulnerabilities.

Directs the OMB to issue guidance requiring agencies: (1) to replace components with currently known vulnerabilities and to remove or repair any new vulnerable components that become known; and (2) to migrate to patchable, repairable, and fixable products.

Requires agencies to provide the Department of Homeland Security (DHS) with a list of each known vulnerable component in any product in use by the agencies.

Directs DHS to issue an annual confidential report describing the security vulnerabilities of projects that created any known vulnerable component. Requires the report to assess the integrity of component suppliers for the incidence of security vulnerabilities for use by other agencies.

Requires agencies, within 30 months after enactment of this Act, to report to Congress regarding the completion of the removal of each known vulnerable or defective component.

Directs other entities of the U.S. government to replace vulnerable components with less vulnerable alternatives.

]]> Cyber Supply Chain Management and Transparency Act of 2014 Display Title Cyber Supply Chain Management and Transparency Act of 2014 Official Title as Introduced To ensure the integrity of any software, firmware, or product developed for or purchased by the United States Government that uses a third party or open source component, and for other purposes. Introduced in House IH Short Titles as Introduced Cyber Supply Chain Management and Transparency Act of 2014 Introduced in House 2014-12-04T05:00:00Z https://www.govinfo.gov/content/pkg/BILLS-113hr5793ih/xml/BILLS-113hr5793ih.xml 2014-12-04 Referred to the House Committee on Oversight and Government Reform. text/xml EN Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain. Congressional Research Service, Library of Congress This file contains bill summaries and statuses for federal legislation. A bill summary describes the most significant provisions of a piece of legislation and details the effects the legislative text may have on current law and federal programs. Bill summaries are authored by the Congressional Research Service (CRS) of the Library of Congress. As stated in Public Law 91-510 (2 USC 166 (d)(6)), one of the duties of CRS is "to prepare summaries and digests of bills and resolutions of a public general nature introduced in the Senate or House of Representatives". For more information, refer to the User Guide that accompanies this file.