[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 933 Reported in Senate (RS)]
<DOC>
Calendar No. 39
118th CONGRESS
1st Session
S. 933
[Report No. 118-15]
To amend the Carl Levin and Howard P. ``Buck'' McKeon National Defense
Authorization Act for Fiscal Year 2015 to modify requirements relating
to data centers of certain Federal agencies, and for other purposes.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
March 22, 2023
Ms. Rosen (for herself, Mr. Cornyn, and Mr. Peters) introduced the
following bill; which was read twice and referred to the Committee on
Homeland Security and Governmental Affairs
April 27, 2023
Reported by Mr. Peters, without amendment
_______________________________________________________________________
A BILL
To amend the Carl Levin and Howard P. ``Buck'' McKeon National Defense
Authorization Act for Fiscal Year 2015 to modify requirements relating
to data centers of certain Federal agencies, and for other purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Federal Data Center Enhancement Act
of 2023''.
SEC. 2. FEDERAL DATA CENTER CONSOLIDATION INITIATIVE AMENDMENTS.
(a) Findings.--Congress finds the following:
(1) The statutory authorization for the Federal Data Center
Optimization Initiative under section 834 of the Carl Levin and
Howard P. ``Buck'' McKeon National Defense Authorization Act
for Fiscal Year 2015 (44 U.S.C. 3601 note; Public Law 113-291)
expires at the end of fiscal year 2022.
(2) The expiration of the authorization described in
paragraph (1) presents Congress with an opportunity to review
the objectives of the Federal Data Center Optimization
Initiative to ensure that the initiative is meeting the current
needs of the Federal Government.
(3) The initial focus of the Federal Data Center
Optimization Initiative, which was to consolidate data centers
and create new efficiencies, has resulted in, since 2010--
(A) the consolidation of more than 6,000 Federal
data centers; and
(B) cost savings and avoidance of $5,800,000,000.
(4) The need of the Federal Government for access to data
and data processing systems has evolved since the date of
enactment in 2014 of subtitle D of title VIII of the Carl Levin
and Howard P. ``Buck'' McKeon National Defense Authorization
Act for Fiscal Year 2015.
(5) Federal agencies and employees involved in mission
critical functions increasingly need reliable access to secure,
reliable, sustainable, and protected facilities to house
mission critical data and data operations to meet the immediate
needs of the people of the United States.
(6) As of the date of enactment of this Act, there is a
growing need for Federal agencies to use data centers and cloud
applications that meet high standards for cybersecurity,
resiliency, availability, and sustainability.
(b) Minimum Requirements for New Data Centers.--Section 834 of the
Carl Levin and Howard P. ``Buck'' McKeon National Defense Authorization
Act for Fiscal Year 2015 (44 U.S.C. 3601 note; Public Law 113-291) is
amended--
(1) in subsection (a), by striking paragraphs (3) and (4)
and inserting the following:
``(3) New data center.--The term `new data center' means--
``(A)(i) a data center or a portion thereof that is
owned, operated, or maintained by a covered agency; or
``(ii) to the extent practicable, a data center or
portion thereof--
``(I) that is owned, operated, or
maintained by a contractor on behalf of a
covered agency on the date on which the
contract between the covered agency and the
contractor expires; and
``(II) with respect to which the covered
agency extends the contract, or enters into a
new contract, with the contractor; and
``(B) on or after the date that is 180 days after
the date of enactment of the Federal Data Center
Enhancement Act of 2023, a data center or portion
thereof that is--
``(i) established; or
``(ii) substantially upgraded or
expanded.'';
(2) by striking subsection (b) and inserting the following:
``(b) Minimum Requirements for New Data Centers.--
``(1) In general.--Not later than 180 days after the date
of enactment of the Federal Data Center Enhancement Act of
2023, the Administrator shall establish minimum requirements
for new data centers in consultation with the Administrator of
General Services and the Federal Chief Information Officers
Council.
``(2) Contents.--
``(A) In general.--The minimum requirements
established under paragraph (1) shall include
requirements relating to--
``(i) the availability of new data centers;
``(ii) the use of new data centers;
``(iii) the use of sustainable energy
sources;
``(iv) uptime percentage;
``(v) protections against power failures,
including on-site energy generation and access
to multiple transmission paths;
``(vi) protections against physical
intrusions and natural disasters;
``(vii) information security protections
required by subchapter II of chapter 35 of
title 44, United States Code, and other
applicable law and policy; and
``(viii) any other requirements the
Administrator determines appropriate.
``(B) Consultation.--In establishing the
requirements described in subparagraph (A)(vii), the
Administrator shall consult with the Director of the
Cybersecurity and Infrastructure Security Agency and
the National Cyber Director.
``(3) Incorporation of minimum requirements into current
data centers.--As soon as practicable, and in any case not
later than 90 days after the Administrator establishes the
minimum requirements pursuant to paragraph (1), the
Administrator shall issue guidance to ensure, as appropriate,
that covered agencies incorporate the minimum requirements
established under that paragraph into the operations of any
data center of a covered agency existing as of the date of
enactment of the Federal Data Center Enhancement Act of 2023.
``(4) Review of requirements.--The Administrator, in
consultation with the Administrator of General Services and the
Federal Chief Information Officers Council, shall review,
update, and modify the minimum requirements established under
paragraph (1), as necessary.
``(5) Report on new data centers.--During the development
and planning lifecycle of a new data center, if the head of a
covered agency determines that the covered agency is likely to
make a management or financial decision relating to any data
center, the head of the covered agency shall--
``(A) notify--
``(i) the Administrator;
``(ii) Committee on Homeland Security and
Governmental Affairs of the Senate; and
``(iii) Committee on Oversight and
Accountability of the House of Representatives;
and
``(B) describe in the notification with sufficient
detail how the covered agency intends to comply with
the minimum requirements established under paragraph
(1).
``(6) Use of technology.--In determining whether to
establish or continue to operate an existing data center, the
head of a covered agency shall--
``(A) regularly assess the application portfolio of
the covered agency and ensure that each at-risk legacy
application is updated, replaced, or modernized, as
appropriate, to take advantage of modern technologies;
and
``(B) prioritize and, to the greatest extent
possible, leverage commercial cloud environments rather
than acquiring, overseeing, or managing custom data
center infrastructure.
``(7) Public website.--
``(A) In general.--The Administrator shall maintain
a public-facing website that includes information,
data, and explanatory statements relating to the
compliance of covered agencies with the requirements of
this section.
``(B) Processes and procedures.--In maintaining the
website described in subparagraph (A), the
Administrator shall--
``(i) ensure covered agencies regularly,
and not less frequently than biannually, update
the information, data, and explanatory
statements posed on the website, pursuant to
guidance issued by the Administrator, relating
to any new data centers and, as appropriate,
each existing data center of the covered
agency; and
``(ii) ensure that all information, data,
and explanatory statements on the website are
maintained as open Government data assets.'';
and
(3) in subsection (c), by striking paragraph (1) and
inserting the following:
``(1) In general.--The head of a covered agency shall
oversee and manage the data center portfolio and the
information technology strategy of the covered agency in
accordance with Federal cybersecurity guidelines and
directives, including--
``(A) information security standards and guidelines
promulgated by the Director of the National Institute
of Standards and Technology;
``(B) applicable requirements and guidance issued
by the Director of the Office of Management and Budget
pursuant to section 3614 of title 44, United States
Code; and
``(C) directives issued by the Secretary of
Homeland Security under section 3553 of title 44,
United States Code.''.
(c) Extension of Sunset.--Section 834(e) of the Carl Levin and
Howard P. ``Buck'' McKeon National Defense Authorization Act for Fiscal
Year 2015 (44 U.S.C. 3601 note; Public Law 113-291) is amended by
striking ``2022'' and inserting ``2026''.
(d) GAO Review.--Not later than 1 year after the date of the
enactment of this Act, and annually thereafter, the Comptroller General
of the United States shall review, verify, and audit the compliance of
covered agencies with the minimum requirements established pursuant to
section 834(b)(1) of the Carl Levin and Howard P. ``Buck'' McKeon
National Defense Authorization Act for Fiscal Year 2015 (44 U.S.C. 3601
note; Public Law 113-291) for new data centers and subsection (b)(3) of
that Act for existing data centers, as appropriate.
Calendar No. 39
118th CONGRESS
1st Session
S. 933
[Report No. 118-15]
_______________________________________________________________________
A BILL
To amend the Carl Levin and Howard P. ``Buck'' McKeon National Defense
Authorization Act for Fiscal Year 2015 to modify requirements relating
to data centers of certain Federal agencies, and for other purposes.
_______________________________________________________________________
April 27, 2023
Reported without amendment