H.R. 5457 — Strengthening Agency Management and Oversight of Software Assets Act

This section defines 10 terms for purposes of the Act: (1) Administrator (i.e., Administrator of General Services); (2) agency (i.e., as defined in 44 U.S.C. §3502, excluding intelligence community elements); (3) cloud computing (i.e., per NIST Special Publication 800-145 or successor); (4) cloud service provider (i.e., as defined in 44 U.S.C. §3607(b)); (5) comprehensive assessment (i.e., as conducted under §3(a)); (6) Director (i.e., Director of the Office of Management and Budget); (7) intelligence community (i.e., as defined in 50 U.S.C. §3003); (8) plan (i.e., as developed under §4(a)); (9) software entitlement (i.e., agency-purchased, leased, licensed, or billed software subject to use limitations); and (10) software inventory (i.e., as required under the MEGABYTE Act of 2016, 40 U.S.C. 11302 note, or subsequent OMB guidance).

This section directs the Chief Information Officer (CIO) of each federal agency, in consultation with the agency's Chief Financial Officer, Chief Acquisition Officer, Chief Data Officer, and General Counsel (or equivalents), to complete—not later than 18 months after enactment—a comprehensive assessment of agency software, including (1) current inventory and largest entitlements by provider and category; (2) accounting of all used or deployed software, entitlements (including unused, duplicative, or unnecessary fees such as cloud costs), and interoperability efforts; (3) categorization by cost, volume, and type; (4) restrictive provisions on deployment, access, or use; and (5) analysis of assessment accuracy, contract compliance, total costs (including upgrades and maintenance), and license management policies. (Thus, the assessment identifies waste, duplication, and inefficiencies in federal software spending and use.) The section authorizes agencies to contract for assessment support, provided contractors have no organizational conflicts of interest under the Federal Acquisition Regulation and maintain operational independence from agency software operations. The CIO must submit the assessment to the agency head upon completion, and the head must submit it within 30 days to the Office of Management and Budget Director, General Services Administration Administrator, Comptroller General, Senate Committee on Homeland Security and Governmental Affairs, and House Committee on Oversight and Accountability. The OMB Director, in consultation with the GSA Administrator, must share related best practices across agencies. For intelligence community elements, the section requires separate assessments by a head-designated entity (protecting national security), with summary submissions within 30 days to the OMB Director, Senate Select Committee on Intelligence, and House Permanent Select Committee on Intelligence.

This section directs the Chief Information Officer (CIO) of each covered agency, in consultation with the Chief Financial Officer, Chief Acquisition Officer, Chief Data Officer, and General Counsel (or equivalents), to develop a software modernization plan using information from the comprehensive assessment required under section 3. The plan must (1) consolidate agency software entitlements; (2) establish criteria and procedures for cost-effective acquisition strategies, including enterprise licensing, to reduce costs, eliminate excess licenses, and improve performance; and (3) restrict bureaus, programs, components, or operational entities from acquiring, using, developing, or leveraging software entitlements without CIO approval (in consultation with the Chief Acquisition Officer or equivalent). The plan must include a detailed strategy for remediating assessment-identified deficiencies, ongoing maintenance, process automation, employee training on software acquisition (including negotiation, commercial vs. custom software, and license costs), and maximizing software effectiveness through usage analytics, user segmentation, governance, and interoperability; identify software categories for conversion to cost-effective licenses upon renewal; estimate implementation costs, projected savings, efficiency gains, and performance improvements; identify mitigations for license restrictions (e.g., on deployment, access, or data ownership); ensure purchases use public, vendor-neutral criteria; identify needed resources; describe software prevalence across categories; and include other necessary information. Agencies must submit the plan within one year of submitting the section 3 assessment to the Director of the Office of Management and Budget (OMB), the Senate Committee on Homeland Security and Governmental Affairs, and the House Committee on Oversight and Accountability (intelligence community elements separately to the Director and congressional intelligence committees). The OMB Director, in coordination with the General Services Administration Administrator and specified chief officer councils, must establish processes to harmonize definitions, terms, requirements, and other elements across agencies.

This section directs the Comptroller General of the United States to submit to the Senate Committee on Homeland Security and Governmental Affairs and the House Committee on Oversight and Government Reform, not later than three years after enactment, a report on (1) government-wide trends in agency software asset management practices; (2) comparisons of such practices among agencies; (3) the Director's establishment of processes to identify, define, and harmonize common definitions, terms, and conditions under section 4(e); (4) agency compliance with restrictions on contract support under section 3(b); and (5) other analyses and findings regarding agency plans, as determined by the Comptroller General.