Cyber Supply Chain Management and Transparency Act of 2014
Latest action. Referred to the House Committee on oversightCongress's review of how the executive branch carries out the laws it passed: hearings, document demands, investigations, and the spending power behind them.Read the full definition (opens a new tab) and Government Reform.
Cyber Supply Chain Management and Transparency Act of 2014 - Requires the Office of Management and Budget (OMB) to issue guidelines for agencies that contract to acquire software, firmware, or products containing a third party or open source binary component.
Requires binary component contracts to include clauses requiring:
a confidentially supplied list, or a bill of materials, of each binary component that is used in the software, firmware, or product;
the contractor to verify that products do not contain known security vulnerabilities and to notify the purchasing agency of any known vulnerabilities or defects;
the contractor to obtain a waiver from the purchasing agency for components known to be vulnerable;
an agency approving a vulnerability waiver to accept all risk associated with component use;
product designs to allow fixes with patches, updates, or replacements; and
the contractor to provide timely repairs for discovered vulnerabilities.
Directs the OMB to issue guidance requiring agencies: (1) to replace components with currently known vulnerabilities and to remove or repair any new vulnerable components that become known; and (2) to migrate to patchable, repairable, and fixable products.
Requires agencies to provide the Department of Homeland Security (DHS) with a list of each known vulnerable component in any product in use by the agencies.
Directs DHS to issue an annual confidential report describing the security vulnerabilities of projects that created any known vulnerable component. Requires the report to assess the integrity of component suppliers for the incidence of security vulnerabilities for use by other agencies.
Requires agencies, within 30 months after enactment of this Act, to report to Congress regarding the completion of the removal of each known vulnerable or defective component.
Directs other entities of the U.S. government to replace vulnerable components with less vulnerable alternatives.
Written by analysts at the Congressional Research Service and published on Congress.gov, not by Civibrief. Summarized at the "Introduced in House" stage on December 4, 2014. It describes the bill, it is not the legal text.
Where is it in the process, and what happens next?
4 steps remain before this bill could become law.
The record's latest action, on December 4, 2014: Referred to the House Committee on Oversight and Government Reform.
- Clearing the committees it was referred to, and being scheduled for a floor vote
- Passage by the House
- Passage by the Senate
- The President's signature. If the President vetoes it, two-thirds of both chambers must vote to override.
How likely is it to become law?
Civibrief does not forecast outcomes and this page has no opinion about this one. What the record supports is a base rate, which is a fact about the whole pile, not a prediction about this measure.
In the 113th Congress (2013-14), 296 of the 9,091 bills and joint resolutions introduced became law, about 3.3 percent. That count covers every measure at every stage, including the many that never left committee.
This one is not there yet: 4 steps are still outstanding, listed above.
Has anyone actually voted on it?
No. No roll call in this Congress cites this measure. That is the ordinary outcome: most measures never reach a recorded floor vote, and a committee ends most of them simply by not acting.
A vote is not the only thing that happens to a measure. Hearings, markups, and referrals are all recorded actions, and none of them is a vote of the full chamber.
Who is behind it?
ED ROYCE (R-CA) introduced it on December 4, 2014, and 1 member has since signed on as a cosponsor.
They are 1 Republican.
Cosponsoring is a formal signature on the text. It is not a commitment to vote for the measure, it does not bind anyone's party, and a long list of cosponsors is a measure of attention rather than of prospects.
How long has it been in play?
It was introduced on December 4, 2014, 4345 days ago. The most recent recorded action was 4345 days ago, on December 4, 2014.
Measures do not carry over. Anything the 113th Congress has not finished by January 3, 2015 dies when the term ends, and has to be introduced again from the start in the next Congress.
Every answer above is assembled from this measure's own record on Congress.gov and from published counts of what Congress has passed before. Civibrief does not predict outcomes and takes no position on any measure.
Vote history
- HouseIn committee, no floor vote yet
- SenateAwaits House passage
- PresidentAwaits both chambers