H.R. 2417 — Strengthening Agency Management and Oversight of Software Assets Act

This section defines key terms used in the Act, including "(1) Administrator" as the Administrator of General Services; "(2) agency" as having the meaning given in 44 U.S.C. §3502, excluding intelligence community elements; "(3) cloud computing" as defined in NIST Special Publication 800-145 or successor; "(4) cloud service provider" as defined in 44 U.S.C. §3607(b); "(5) comprehensive assessment" as an assessment under section 3(a); "(6) Director" as the Director of the Office of Management and Budget; "(7) intelligence community" as defined in 50 U.S.C. §3003; "(8) plan" as a plan developed by a Chief Information Officer or equivalent under section 4(a); "(9) software entitlement" as agency-purchased, leased, licensed, or billed software subject to use limitations; and "(10) software inventory" as required under section 2(b)(2)(A) of the MEGABYTE Act of 2016 (40 U.S.C. 11302 note) or subsequent OMB guidance.

This section requires the Chief Information Officer of each federal agency, in consultation with the agency's Chief Financial Officer, Chief Acquisition Officer, Chief Data Officer, and General Counsel (or equivalents), to complete a comprehensive software assessment not later than 18 months after enactment. The assessment must inventory all agency software (including entitlements, contracts, and largest providers by category); detail software in use or deployed (including shared services, extra fees like cloud costs, unused or duplicative licenses, and interoperability efforts); categorize entitlements by cost, volume, and type; identify deployment/use restrictions; and analyze assessment accuracy, contract compliance, total costs (including upgrades and maintenance), and license management policies. Agencies may contract for support (without organizational conflicts of interest under the Federal Acquisition Regulation and ensuring contractor independence); the CIO submits the assessment to the agency head upon completion, who must forward it within 30 days to the Office of Management and Budget Director, General Services Administration Administrator, Comptroller General, Senate Homeland Security and Governmental Affairs Committee, and House Oversight and Accountability Committee. The OMB Director, consulting the GSA Administrator, must share related best practices across agencies. For intelligence community elements, assessments are conducted separately by a designated entity (protecting national security), with heads submitting summaries within 30 days to the OMB Director and congressional intelligence committees.

This section directs the Chief Information Officer (CIO) of each agency, in consultation with the Chief Financial Officer, Chief Acquisition Officer, Chief Data Officer, and General Counsel (or equivalents), to develop a software modernization plan based on the comprehensive assessment required under section 3. The plan must (1) consolidate software entitlements; (2) establish criteria and procedures for cost-effective acquisition strategies, including enterprise licensing, to reduce costs, eliminate excess licenses, and improve performance; and (3) restrict sub-agency entities from acquiring or using software without CIO approval (in consultation with the Chief Acquisition Officer or equivalent). The plan must include a detailed strategy for remediating software asset management deficiencies, ongoing maintenance, process automation, employee training on software acquisition (including negotiation, commercial vs. custom software, and license costs), and maximizing software effectiveness through usage analytics, user segmentation, governance, and interoperability; identify software categories for conversion to cost-effective licenses upon renewal; estimate implementation costs, projected savings, and performance improvements; identify mitigations for license restrictions; ensure purchases use public, vendor-neutral criteria; provide resource estimates and software prevalence data; and include other necessary information. The CIO may request support from the Office of Management and Budget (OMB) Director and General Services Administration (GSA) Administrator. Agency heads must submit plans to the OMB Director and relevant congressional committees not later than 1 year after submitting the section 3 assessment (with separate submissions by intelligence community elements to intelligence committees). The OMB Director, in coordination with the GSA Administrator and various chief officer councils, must establish processes to harmonize software-related definitions, terms, standardized requirements, and other elements across government.

This section directs the Comptroller General of the United States to submit to the Senate Committee on Homeland Security and Governmental Affairs and the House Committee on Oversight and Accountability, not later than 3 years after enactment, a report on (1) government-wide trends in agency software asset management practices; (2) comparisons of software asset management practices among agencies; (3) the establishment by the Director of processes to identify, define, and harmonize common definitions, terms, and conditions under section 4(e); (4) agency compliance with the restrictions on contract support under section 3(b); and (5) other analyses of and findings regarding agency plans, as determined by the Comptroller General.