[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 2032 Introduced in Senate (IS)]

<DOC>






118th CONGRESS
  1st Session
                                S. 2032

   To require the reduction of the reliance and expenditures of the 
 Federal Government on legacy information technology systems, and for 
                            other purposes.


_______________________________________________________________________


                   IN THE SENATE OF THE UNITED STATES

                             June 15, 2023

Ms. Hassan (for herself and Mr. Cornyn) introduced the following bill; 
which was read twice and referred to the Committee on Homeland Security 
                        and Governmental Affairs

_______________________________________________________________________

                                 A BILL


 
   To require the reduction of the reliance and expenditures of the 
 Federal Government on legacy information technology systems, and for 
                            other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Legacy IT Reduction Act of 2023''.

SEC. 2. DEFINITIONS.

    In this Act:
            (1) Administrator.--The term ``Administrator'' means the 
        Administrator of General Services.
            (2) Agency.--The term ``agency'' means an agency described 
        in paragraph (1) or (2) of section 901(b) of title 31, United 
        States Code.
            (3) Chief information officer.--The term ``Chief 
        Information Officer'' means a Chief Information Officer 
        designated under section 3506(a)(2) of title 44, United States 
        Code.
            (4) Comptroller general.--The term ``Comptroller General'' 
        means the Comptroller General of the United States.
            (5) Congressional oversight committee.--The term 
        ``congressional oversight committee'' means, with respect to a 
        particular agency, a committee or subcommittee of the Senate 
        and the House of Representatives that provides oversight of the 
        agency.
            (6) Director.--The term ``Director'' means the Director of 
        the Office of Management and Budget.
            (7) Information technology.--The term ``information 
        technology'' has the meaning given the term in section 11101 of 
        title 40, United States Code.
            (8) IT working capital fund; legacy information technology 
        system.--The terms ``IT working capital fund'' and ``legacy 
        information technology system'' have the meaning given the 
        terms in section 1076 of the National Defense Authorization Act 
        for Fiscal Year 2018 (40 U.S.C. 11301 note; Public Law 115-91).
            (9) National security system.--The term ``national security 
        system'' has the meaning given the term in section 11103 of 
        title 40, United States Code.
            (10) Technology modernization fund.--The term ``Technology 
        Modernization Fund'' means the fund established under section 
        1078(b)(1) of the National Defense Authorization Act for Fiscal 
        Year 2018 (40 U.S.C. 11301 note; Public Law 115-91).

SEC. 3. LEGACY INFORMATION TECHNOLOGY SYSTEM INVENTORY.

    (a) Inventory of Legacy Information Technology Systems.--
            (1) In general.--Not later than 1 year after the date of 
        enactment of this Act, and not later than 5 years thereafter, 
        the Chief Information Officer of each agency shall compile an 
        inventory that lists each legacy information technology system 
        used, operated, or maintained by the agency.
            (2) Contents.--The Director shall issue guidance 
        prescribing the information that the Chief Information Officer 
        of each agency shall include for each legacy technology 
        information system listed in the inventory required under 
        paragraph (1). In issuing such guidance, the Director shall 
        consider including for each legacy technology information 
        system listed in the inventory--
                    (A) the name or an identification of the legacy 
                information technology system;
                    (B) the office or mission of the agency that the 
                legacy information technology system supports and how 
                the office or mission uses the legacy information 
                technology system;
                    (C) to the extent that information is available--
                            (i) the date of the last update or refresh 
                        of the legacy information technology system;
                            (ii) the annual price, including recurring 
                        subscription costs and any costs to contract 
                        labor, to operate or maintain the legacy 
                        information technology system; and
                            (iii) the name and contact information of 
                        the vendor; and
                    (D) the date of the next expected update or 
                modernization, retirement, or disposal of the legacy 
                information technology system.
    (b) Transparency and Accountability.--
            (1) In general.--Upon request by a House of Congress, a 
        congressional oversight committee of an agency, the Comptroller 
        General of the United States, or an inspector general of an 
        agency, the head of the agency shall make available the 
        inventory compiled under subsection (a)(1) or the relevant 
        portion of that inventory.
            (2) Reporting.--The Director may require an agency to 
        include the inventory compiled under subsection (a)(1) in a 
        reporting structure determined by the Director.

SEC. 4. AGENCY LEGACY INFORMATION TECHNOLOGY SYSTEMS MODERNIZATION 
              PLANS.

    (a) In General.--Not later than 2 years after the date of enactment 
of this Act, and every 5 years thereafter, the head of an agency shall 
develop and include as part of the information resource management 
strategic plan of the agency submitted under section 3506(b)(2) of 
title 44, United States Code, a plan to modernize the legacy 
information technology systems of the agency.
    (b) Contents.--A modernization plan of an agency developed under 
subsection (a) shall include--
            (1) an inventory of the legacy information technology 
        systems of the agency;
            (2) an identification of legacy information technology 
        systems that the agency has prioritized for updates, 
        modernization, retirement, or disposal;
            (3) steps the agency intends to make toward updating, 
        modernizing, retiring, or disposing of the legacy information 
        technology systems of the agency prioritized under paragraph 
        (2) during the 5-year period beginning on the date of 
        submission of the plan; and
            (4) any additional information that the Director determines 
        necessary or useful for the agency to consider or include to 
        effectively and efficiently execute the modernization plan, 
        which may include--
                    (A) the capacity of the agency to operate and 
                maintain an updated or modernized legacy information 
                technology system;
                    (B) the estimated cost and sources of funding 
                required to execute the modernization plan; and
                    (C) the ability of the agency to adapt an updated 
                or modernized legacy information technology system to 
                changes in policy, technology, or other user needs, as 
                necessary.
    (c) Publication and Submission to Congress.--Not later than 30 days 
after the date on which the head of an agency submits the modernization 
plan developed under subsection (a) as part of the information resource 
management strategic plan of the agency submitted under section 
3506(b)(2) of title 44, United States Code, the head of the agency 
shall submit the modernization plan to the Committee on Homeland 
Security and Governmental Affairs of the Senate, the Committee on 
Oversight and Accountability of the House of Representatives, and each 
congressional oversight committee of the agency.

SEC. 5. ROLE OF THE OFFICE OF MANAGEMENT AND BUDGET.

    Not later than 180 days after the date of enactment of this Act, 
the Director, in coordination with the Administrator of the Office of 
Electronic Government, shall issue guidance on the implementation of 
this Act and the amendments made by this Act, which shall include--
            (1) criteria to determine whether information technology 
        qualifies as a ``legacy information technology system'' for the 
        purposes of compiling the inventory required under section 
        3(a)(1);
            (2) instructions and templates to inform the compilation of 
        the inventory required under section 3(a)(1), as necessary;
            (3) instructions and templates to inform the compilation 
        and publication of, and any subsequent updates to, the 
        modernization plans required under section 4(a), as necessary; 
        and
            (4) any other guidance determined necessary for the 
        implementation of this Act or the amendments made by this Act, 
        including how the implementation of this Act or those 
        amendments complements laws, regulations, and guidance relating 
        to information technology modernization.

SEC. 6. COMPTROLLER GENERAL REVIEW.

    (a) In General.--Not later than 3 years after the date of enactment 
of this Act, the Comptroller General shall submit to the Committee on 
Homeland Security and Governmental Affairs of the Senate and the 
Committee on Oversight and Accountability of the House of 
Representatives a report on--
            (1) the implementation of this Act and the amendments made 
        by this Act; and
            (2) how this Act and the amendments made by this Act 
        function alongside other information technology modernization 
        offices, policies, and programs, such as--
                    (A) the Technology Modernization Fund and the IT 
                working capital fund;
                    (B) the Federal Risk and Authorization Management 
                Program, the 18F program, and the 10X program of the 
                General Services Administration;
                    (C) programs and policies of the Office of 
                Management and Budget, including the Office of 
                Electronic Government and the United States Digital 
                Service; and
                    (D) any other office, policy, or program of the 
                Federal Government determined relevant by the 
                Comptroller General.

SEC. 7. PROTECTION OF SENSITIVE INFORMATION; EXEMPTION OF NATIONAL 
              SECURITY SYSTEMS.

    (a) In General.--Nothing in this Act or the amendments made by this 
Act shall be construed to require the head of an agency to disclose 
sensitive information that--
            (1) is protected from disclosure under any other law; or
            (2) would compromise the security of any information 
        technology system of the Federal Government.
    (b) Exemption.--Nothing in this Act or the amendments made by this 
Act shall be construed to authorize or require the head of an agency to 
inventory, develop a report relating to, or transfer, a national 
security system.
                                 <all>