H.R. 5457 — Strengthening Agency Management and Oversight of Software Assets Act

This section defines 10 terms for purposes of the Act: (1) Administrator (i.e., Administrator of General Services); (2) agency (i.e., as defined in 44 U.S.C. §3502, excluding intelligence community elements); (3) cloud computing (i.e., per NIST Special Publication 800-145 or successor); (4) cloud service provider (i.e., as defined in 44 U.S.C. §3607(b)); (5) comprehensive assessment (i.e., as conducted under §3(a)); (6) Director (i.e., Director of the Office of Management and Budget); (7) intelligence community (i.e., as defined in 50 U.S.C. §3003); (8) plan (i.e., as developed under §4(a)); (9) software entitlement (i.e., agency-purchased, leased, licensed, or billed software subject to use limitations); and (10) software inventory (i.e., as required under the MEGABYTE Act of 2016, 40 U.S.C. 11302 note, or subsequent OMB guidance).

This section defines 10 terms for purposes of the Act: (1) Administrator (i.e., Administrator of General Services); (2) agency (i.e., as defined in 44 U.S.C. §3502, excluding intelligence community elements); (3) cloud computing (i.e., per NIST Special Publication 800-145 or successor); (4) cloud service provider (i.e., as defined in 44 U.S.C. §3607(b)); (5) comprehensive assessment (i.e., as conducted under §3(a)); (6) Director (i.e., Director of the Office of Management and Budget); (7) intelligence community (i.e., as defined in 50 U.S.C. §3003); (8) plan (i.e., as developed under §4(a)); (9) software entitlement (i.e., agency-purchased, leased, licensed, or billed software subject to use limitations); and (10) software inventory (i.e., as required under the MEGABYTE Act of 2016, 40 U.S.C. 11302 note, or subsequent OMB guidance).

This section defines 10 terms for purposes of the Act: (1) Administrator (i.e., Administrator of General Services); (2) agency (i.e., as defined in 44 U.S.C. §3502, excluding intelligence community elements); (3) cloud computing (i.e., per NIST Special Publication 800-145 or successor); (4) cloud service provider (i.e., as defined in 44 U.S.C. §3607(b)); (5) comprehensive assessment (i.e., as conducted under §3(a)); (6) Director (i.e., Director of the Office of Management and Budget); (7) intelligence community (i.e., as defined in 50 U.S.C. §3003); (8) plan (i.e., as developed under §4(a)); (9) software entitlement (i.e., agency-purchased, leased, licensed, or billed software subject to use limitations); and (10) software inventory (i.e., as required under the MEGABYTE Act of 2016, 40 U.S.C. 11302 note, or subsequent OMB guidance).

This section directs the Chief Information Officer (CIO) of each federal agency, in consultation with the agency's Chief Financial Officer, Chief Acquisition Officer, Chief Data Officer, and General Counsel (or equivalents), to complete—not later than 18 months after enactment—a comprehensive assessment of agency software, including (1) current inventory and largest entitlements by provider and category; (2) accounting of all used or deployed software, entitlements (including unused, duplicative, or unnecessary fees such as cloud costs), and interoperability efforts; (3) categorization by cost, volume, and type; (4) restrictive provisions on deployment, access, or use; and (5) analysis of assessment accuracy, contract compliance, total costs (including upgrades and maintenance), and license management policies. (Thus, the assessment identifies waste, duplication, and inefficiencies in federal software spending and use.) The section authorizes agencies to contract for assessment support, provided contractors have no organizational conflicts of interest under the Federal Acquisition Regulation and maintain operational independence from agency software operations. The CIO must submit the assessment to the agency head upon completion, and the head must submit it within 30 days to the Office of Management and Budget Director, General Services Administration Administrator, Comptroller General, Senate Committee on Homeland Security and Governmental Affairs, and House Committee on Oversight and Accountability. The OMB Director, in consultation with the GSA Administrator, must share related best practices across agencies. For intelligence community elements, the section requires separate assessments by a head-designated entity (protecting national security), with summary submissions within 30 days to the OMB Director, Senate Select Committee on Intelligence, and House Permanent Select Committee on Intelligence.

This section requires the Chief Information Officer of each agency, in consultation with the Chief Financial Officer, Chief Acquisition Officer, Chief Data Officer, and General Counsel (or equivalent officials), to complete a comprehensive assessment of all software paid for by, in use at, or deployed throughout the agency not later than 18 months after the date of enactment of this Act. The assessment must include the current software inventory and largest entitlements by provider and category; a detailed accounting of all software in use or deployed (including agency-developed or shared services software), entitlements with associated fees and costs (including cloud services), unnecessary or duplicative entitlements, and interoperability of software assets; a categorization of entitlements by cost, volume, and type; a list of any contractual restrictions on deployment, access, hardware, cloud services, or data ownership; and an analysis of the assessment’s accuracy, contract compliance, total lifecycle costs, and adherence to agency software license management policies. This section authorizes the head of an agency to enter into contracts to support the assessment, provided the contractors have no organizational conflicts of interest and maintain operational independence from the agency’s software management and operations. The Chief Information Officer must submit the completed assessment to the agency head, who must transmit it within 30 days to the Director, the Administrator, the Comptroller General, the Senate Committee on Homeland Security and Governmental Affairs, and the House Committee on Oversight and Accountability. The Director, in consultation with the Administrator, must share information, best practices, and recommendations across agencies to promote standardization. For each element of the intelligence community, the assessment must be conducted separately by a designated entity, protect classified information, and be submitted in summary form within 30 days to the Director and the congressional intelligence committees.

This section directs the Chief Information Officer (CIO) of each federal agency, in consultation with the agency's Chief Financial Officer, Chief Acquisition Officer, Chief Data Officer, and General Counsel (or equivalents), to complete—not later than 18 months after enactment—a comprehensive assessment of agency software, including (1) current inventory and largest entitlements by provider and category; (2) accounting of all used or deployed software, entitlements (including unused, duplicative, or unnecessary fees such as cloud costs), and interoperability efforts; (3) categorization by cost, volume, and type; (4) restrictive provisions on deployment, access, or use; and (5) analysis of assessment accuracy, contract compliance, total costs (including upgrades and maintenance), and license management policies. (Thus, the assessment identifies waste, duplication, and inefficiencies in federal software spending and use.) The section authorizes agencies to contract for assessment support, provided contractors have no organizational conflicts of interest under the Federal Acquisition Regulation and maintain operational independence from agency software operations. The CIO must submit the assessment to the agency head upon completion, and the head must submit it within 30 days to the Office of Management and Budget Director, General Services Administration Administrator, Comptroller General, Senate Committee on Homeland Security and Governmental Affairs, and House Committee on Oversight and Accountability. The OMB Director, in consultation with the GSA Administrator, must share related best practices across agencies. For intelligence community elements, the section requires separate assessments by a head-designated entity (protecting national security), with summary submissions within 30 days to the OMB Director, Senate Select Committee on Intelligence, and House Permanent Select Committee on Intelligence.

This section directs the Chief Information Officer (CIO) of each covered agency, in consultation with the Chief Financial Officer, Chief Acquisition Officer, Chief Data Officer, and General Counsel (or equivalents), to develop a software modernization plan using information from the comprehensive assessment required under section 3. The plan must (1) consolidate agency software entitlements; (2) establish criteria and procedures for cost-effective acquisition strategies, including enterprise licensing, to reduce costs, eliminate excess licenses, and improve performance; and (3) restrict bureaus, programs, components, or operational entities from acquiring, using, developing, or leveraging software entitlements without CIO approval (in consultation with the Chief Acquisition Officer or equivalent). The plan must include a detailed strategy for remediating assessment-identified deficiencies, ongoing maintenance, process automation, employee training on software acquisition (including negotiation, commercial vs. custom software, and license costs), and maximizing software effectiveness through usage analytics, user segmentation, governance, and interoperability; identify software categories for conversion to cost-effective licenses upon renewal; estimate implementation costs, projected savings, efficiency gains, and performance improvements; identify mitigations for license restrictions (e.g., on deployment, access, or data ownership); ensure purchases use public, vendor-neutral criteria; identify needed resources; describe software prevalence across categories; and include other necessary information. Agencies must submit the plan within one year of submitting the section 3 assessment to the Director of the Office of Management and Budget (OMB), the Senate Committee on Homeland Security and Governmental Affairs, and the House Committee on Oversight and Accountability (intelligence community elements separately to the Director and congressional intelligence committees). The OMB Director, in coordination with the General Services Administration Administrator and specified chief officer councils, must establish processes to harmonize definitions, terms, requirements, and other elements across agencies.

This section directs the Chief Information Officer of each agency, in consultation with the Chief Financial Officer, Chief Acquisition Officer, Chief Data Officer, and General Counsel (or equivalent officials), to develop a plan to consolidate software entitlements, adopt cost-effective acquisition strategies including enterprise licensing, and restrict bureau, program, or component-level software acquisitions without CIO approval. The plan must include a detailed strategy for remediating software asset management deficiencies, automating license management with discovery tools, training personnel on acquisition policies and license cost structures, and maximizing software effectiveness through usage analytics, user segmentation, governance tools, and interoperability; identify software categories for conversion to enterprise or open-source licenses at renewal; estimate implementation costs, projected savings, and performance improvements across the software lifecycle; identify mitigations for deployment, access, and data ownership restrictions; ensure purchases rely on publicly available, vendor-neutral criteria; and include estimates for any additional resources required. The head of each agency must submit the plan to the Director of the Office of Management and Budget and the specified congressional committees not later than one year after submitting the comprehensive assessment under section 3 (or, for intelligence community elements, after submitting the summary assessment under section 3(f)(4)). The Director must establish processes, in coordination with the Administrator, relevant chief officer councils, and government and industry representatives, to harmonize common definitions, terms, conditions, and standardized requirements for software entitlements.

This section directs the Chief Information Officer (CIO) of each covered agency, in consultation with the Chief Financial Officer, Chief Acquisition Officer, Chief Data Officer, and General Counsel (or equivalents), to develop a software modernization plan using information from the comprehensive assessment required under section 3. The plan must (1) consolidate agency software entitlements; (2) establish criteria and procedures for cost-effective acquisition strategies, including enterprise licensing, to reduce costs, eliminate excess licenses, and improve performance; and (3) restrict bureaus, programs, components, or operational entities from acquiring, using, developing, or leveraging software entitlements without CIO approval (in consultation with the Chief Acquisition Officer or equivalent). The plan must include a detailed strategy for remediating assessment-identified deficiencies, ongoing maintenance, process automation, employee training on software acquisition (including negotiation, commercial vs. custom software, and license costs), and maximizing software effectiveness through usage analytics, user segmentation, governance, and interoperability; identify software categories for conversion to cost-effective licenses upon renewal; estimate implementation costs, projected savings, efficiency gains, and performance improvements; identify mitigations for license restrictions (e.g., on deployment, access, or data ownership); ensure purchases use public, vendor-neutral criteria; identify needed resources; describe software prevalence across categories; and include other necessary information. Agencies must submit the plan within one year of submitting the section 3 assessment to the Director of the Office of Management and Budget (OMB), the Senate Committee on Homeland Security and Governmental Affairs, and the House Committee on Oversight and Accountability (intelligence community elements separately to the Director and congressional intelligence committees). The OMB Director, in coordination with the General Services Administration Administrator and specified chief officer councils, must establish processes to harmonize definitions, terms, requirements, and other elements across agencies.

This section directs the Comptroller General of the United States to submit to the Senate Committee on Homeland Security and Governmental Affairs and the House Committee on Oversight and Government Reform, not later than three years after enactment, a report on (1) government-wide trends in agency software asset management practices; (2) comparisons of such practices among agencies; (3) the Director's establishment of processes to identify, define, and harmonize common definitions, terms, and conditions under section 4(e); (4) agency compliance with restrictions on contract support under section 3(b); and (5) other analyses and findings regarding agency plans, as determined by the Comptroller General.

This section directs the Comptroller General of the United States to submit a report, not later than 3 years after the date of enactment of this Act, to the Senate Committee on Homeland Security and Governmental Affairs and the House Committee on Oversight and Accountability on government-wide trends in agency software asset management practices, comparisons of such practices among agencies, the Director’s establishment of common definitions and processes under section 4(e), agency compliance with contract support restrictions under section 3(b), and other related analyses.

This section directs the Comptroller General of the United States to submit to the Senate Committee on Homeland Security and Governmental Affairs and the House Committee on Oversight and Government Reform, not later than three years after enactment, a report on (1) government-wide trends in agency software asset management practices; (2) comparisons of such practices among agencies; (3) the Director's establishment of processes to identify, define, and harmonize common definitions, terms, and conditions under section 4(e); (4) agency compliance with restrictions on contract support under section 3(b); and (5) other analyses and findings regarding agency plans, as determined by the Comptroller General.