Skip to main content
HR 3286 118th Congress House Government Operations and Politics Computer security and identity theft Computers and information technology Congressional oversight Department of Homeland Security Federal officials Government information and archives Government studies and investigations Performance measurement

Securing Open Source Software Act of 2023

Introduced: May 15, 2023 See on congress.gov
Sign in to write a letter Sign in to watch
 Everywhere this bill has been 7 steps
Introduced
In committee
Reported out
Passed House
Passed Senate
To President
Became law
Jul 27, 2023
Placed on the Union Calendar, Calendar No. 127.
Jul 27, 2023
Committee on Oversight and Accountability discharged.
Jul 27, 2023
Reported (Amended) by the Committee on Homeland Security. H. Rept. 118-160, Part I.
May 17, 2023
Ordered to be Reported (Amended) by Voice Vote.
May 17, 2023
Committee Consideration and Mark-up Session Held.
May 15, 2023
Referred to the Committee on Homeland Security, and in addition to the Committee on Oversight and Accountability, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
May 15, 2023
Introduced in House
 Plain-English summary Congressional Research Service

Securing Open Source Software Act of 2023

This bill sets forth the duties of the Cybersecurity and Infrastructure Security Agency (CISA) regarding open source software security.

Open source software means software for which the human-readable source code is made available to the public for use, study, reuse, modification, enhancement, and redistribution.

Specifically, CISA must

  • perform outreach and engagement to bolster the security of open source software;
  • support federal efforts to strengthen open source software security;
  • coordinate with nonfederal entities on efforts to ensure long-term open source software security;
  • serve as a public point of contact regarding open source software security for nonfederal entities; and
  • support federal and nonfederal supply chain security efforts by encouraging efforts to bolster open source software security.

CISA must (1) publish a framework, incorporating government, private sector, and open source software community frameworks and best practices, for assessing the risk of open source software components; (2) update the framework at least annually; and (3) ensure, to the greatest extent practicable, that the framework is usable by the open source software community.

The bill requires CISA to assess open source software components deployed on high value assets at federal agencies based on the framework and provides for a pilot assessment of critical infrastructure.

CISA's Cybersecurity Advisory Committee may establish a software security subcommittee.

What's happening now July 27, 2023

Placed on the Union Calendar, Calendar No. 127.

 Committees of jurisdiction 2
 Cosponsors 2
All 2 Republican 2