HR 4611 Passed in House - Software Supply Chain Risk Management

This afternoon the House voted on HR 4611, the DHS Software Supply Chain Risk Management Act of 2021. The bill passed by a near unanimous vote of 412 to 2. The bill was initially considered under the suspension of the rules process on September 29^th, 2021. At the end of the debate a recorded vote was demanded by Rep Posey (R,FL).

The bill would require DHS to develop guidance for new contracts for covered information and communications technology or services for the inclusion of a planned bill of materials and a certification that each item listed in the BOM is free from all known security vulnerabilities or defects.

The bill now goes to the Senate where, if it is to be considered as a standalone bill, it will have to be considered under the unanimous consent process.

Committee Hearings – Week of 10-17-21

This week, with both the House and Senate in Washington, there is a relatively light hearing schedule. There are two oversight hearings of potential interest here. There is one cybersecurity bill that may finally come up for a vote in the House.

Oversight Hearings

On Tuesday the Oceans, Fisheries, Climate Change, and Manufacturing Subcommittee of the Senate Commerce, Science and Transportation Committee will hold an oversight hearing on the Coast Guard. The witnesses include the Commandant and the senior enlisted person. According to the Committee’s web site, the hearing will look at “the Coast Guard’s role to safeguard our nation’s maritime interests to include budget oversight, oil spill response, marine safety, handling of sexual assault and harassment in the service, and diversity, equity, and inclusion.” I will be surprised if there are any cybersecurity questions raised.

On Thursday, the Senate Judiciary Committee will hold an oversight hearing on the Department of Homeland Security. The sole witness will be the Secretary. There is no information about the scope of the hearing. With this being the Judiciary Committee, I would not be surprised to see some questions on the Departments legal responsibilities with respect to cybersecurity.

On the Floor

According to the House Majority Leader’s ‘Weekly Leader’ site, we may finally see a vote on HR 4611, the DHS Software Supply Chain Risk Management Act of 2021. This bill was considered in the House on September 29^th under the suspension of the rules process. At the end of the debate a recorded vote was demanded. The bill has been on the list of potential bills for a vote on a couple of instances since that debate. I expect that the bill will pass when the vote is held.

Committee Hearings – Week of 9-27-21

This week with both the House and Senate in session, and the end of the fiscal year at week’s end, there is a full slate of hearings on both sides of the Capitol. Of interest here are oversight hearings for TSA, the CSB and DHS. Lots of important action on the floor of both the House and Senate. It will be a busy week.

Oversight Hearings

On Wednesday, the House Homeland Security Committee will hold a hearing on “20 Years After 9/11: The State of the Transportation Security Administration”. The witness list will include David Pekoske, the current TSA Administrator and three former Administrators. While this should be a wide ranging discussion, it will probably focus on air travel security as that has been the agency’s focus over its life, but pipeline security questions will be raised.

On Wednesday, the Oversight and Investigations Subcommittee of the House Energy and Commerce Committee will hold a hearing on “Protecting Communities from Industrial Accidents: Revitalizing the Chemical Safety Board”. No witness list is currently available.

On Thursday, the Oversight, Management, and Accountability Subcommittee of the House Homeland Security Committee will hold a hearing on “20 Years After 9/11: Transforming DHS to Meet the Homeland Security Mission”. The witness list includes:

• Chris Currie, Government Accountability Office,

• Randolph “Tex” Alles, DHS,

• Angela Bailey, DHS

Looking at the witness list, I suspect that this hearing will concentrate on personnel issues. Cybersecurity workforce issues could be addressed.

On the Floor in the Senate

A cloture vote on HR 5305, the Extending Government Funding and Delivering Emergency Assistance Act (FY 2022 Spending continuing resolution plus debt limit extension), is scheduled for early this evening. If this gets the necessary 60 votes to continue debate (not likely) then the Senate will approve the bill later this week. If it fails, the ball would be tossed back to the House for a clean continuing resolution. Plenty of time before the continued government funding is required by Midnight Thursday.

On the Floor of the House

Last month, Speaker Pelosi promised the moderate Democrats a vote on the Senate version of HR 3684, the bipartisan infrastructure bill, today. Instead, it looks like all they are going to get today is a one-hour debate on the bill. The vote is apparently being slipped to Thursday to perhaps give the progressive wing of the Party a chance to vote on their expensive Build Back Better Act. HR 3684 needs to pass before Thursday Midnight as the authorization for most transportation programs expires at that time. This would not be as drastic as a government shutdown, critical programs would continue to operate (if a spending measure is in place), but regulatory enforcement efforts would face legal hurdles.

The final version of the Build Back Better Act is still not completed. The bill was marked up by the House Budget Committee on Saturday, but final changes will take place in the House Rules Committee. No hearing for that consideration is currently scheduled according to the Rules Committee website. Which indicates that horse trading is still going on behind closed doors. This bill is likely to come to the floor with limited debate and no amendments. The progressive Democrats want a floor vote on this bill before HR 3684 is considered.

According to Majority Leader Hoyer’s (D,MD) Weekly Leader site the House should take up two cyber security related bills (along with 10 other bills) under the suspension of the rules process. As I wrote last week, these were also potentially on the schedule last week, but were never taken up. The two bills are:

• HR 4611 – DHS Software Supply Chain Risk Management Act of 2021, and

• S 1917 – K-12 Cybersecurity Act of 2021

House to Consider 2 Cybersecurity Bills – 9-21-21

Majority Leader Hoyer (D,MD) announced last night that the House could be taking up five bills today under the suspension of the rules process that were not included in the weekly plan for House action this week. Those bills include two pieces of cybersecurity legislation covered here in this blog:

• HR 4611 – DHS Software Supply Chain Risk Management Act of 2021, and

• S 1917 – K-12 Cybersecurity Act of 2021

The suspension of the rules process in the House provides for limited debate, no floor amendments and requires a super-majority to pass. Bills are offered under this process when the House Leadership feels that there should be sufficient bipartisan support for a bill for it to achieve that supermajority approval.

There is a possibility that these bills will not be considered today as there is a bit of turmoil in the House. The House is also supposed to consider a continuing resolution, but the language of that bill has not yet been officially produced. That bill is supposed to be considered under a rule that was supposed to be developed yesterday, but as of this morning, the House Rules Committee web site did not have that rule published. These five bills may have been added as legislative filler material while backroom negotiations continue on the CR.

Review - HR 4611 Introduced - Software Supply Chain Risk Management Act

Last week, Rep Torres (D,NY) introduced HR 4611, the DHS Software Supply Chain Risk Management Act of 2021. The bill would require DHS to develop contract guidance to require that proposed contract bids would include a planned bill of materials for covered information and communications technology or service and a certification that such materials are free of known security vulnerabilities. The guidance would go into effect 180 days after the enactment of this bill.

NOTE: This review is based upon a Committee Print of the bill provided by the House Homeland Security Committee. The official GPO version has not yet been printed.

As I mentioned yesterday, this bill will be marked-up by the House Homeland Security Committee tomorrow. I expect that the bill will pass with significant bipartisan support. That would allow the bill to be considered by the full House under the suspension of the rules process.

For more details about the provisions of the bill and my look at its relation to software-bill-of-materials as defined by NIST, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-4611-introduced - subscription required.

Committee Hearings – Week of 7-26-21

With both the House and Senate in Washington and looking forward to the summer recess, there is a full slate of hearings this week. They include two Rules Committee hearings of spending bills, NDAA markups, two other mark-up hearings, CSB Nominations, and five cybersecurity related hearings.

Spending Bill Rules

In order to get the spending bills passed in the House before the summer recess, the House is, once again, combining spending bills into minibus bills. The House Rules Committee will be meeting twice this week to formulate the rules for consideration of the first two minibus bills.

Monday – HR 4452 First Minibus (LHHS, ARD, EW, FSG, IER, MC, VA, THUD), and

Tuesday – HR 4336 2^nd Minibus ( Leg, State, CJS)

NDAA Markups

The various subcommittees of the House Armed Services Committee will be meeting this week to mark-up their respective portions of HR 4350, the National Defense Authorization Act for Fiscal Year 2022. The full Committee mark-up is currently scheduled for September 1^st, 2021. The one subcommittee hearing of note here will be the Wednesday mark-up hearing of the Subcommittee on Cyber, Innovative Technologies, and Information Systems.

Other Mark-Up Hearings

On Tuesday the House Science, Space, and Technology Committee will be holding a mark-up hearing considering five bills. One of the bills may be (I have not seen the language yet) of interest here: HR 4609, the National Institute of Standards and Technology for the Future Act of 2021.

On Wednesday the House Homeland Security Committee will be holding a mark-up hearing considering ten bills. Two of those bills will be of interest here (based upon the committee prints available on the hearing web site):

HR 4611, The “DHS Software Supply Chain Risk Management Act of 2021

HR ____, The “K-12 Cybersecurity Act"

HR 4611 is a software bill-of-materials bill. I will try to review this in more detail before Wednesday. The K-12 cybersecurity bill will probably be introduced today. The committee print shows that it is very similar to S 1917 not the previously introduced house bill, HR 4005.

CSB Nominations

On Thursday, the Senate Environment and Public Works Committee will be holding a confirmation hearing for the three nominees for Board membership on the U.S. Chemical Safety and Hazard Investigations Board.

Cybersecurity Hearings

On Tuesday the Subcommittee on National Security of the House Oversight and Reform Committee will hold a hearing on “Defending the U.S. Electric Grid Against Cyber Threats”. The witness list includes:

• Eric Goldstein, CISA,

• Puesh M. Kumar, CESER,

• Joseph H. McClelland, FERC

On Tuesday the Senate Judiciary Committee will be holding a hearing on “America Under Cyber Siege: Preventing and Responding to Ransomware Attacks”. The witness list includes:

• Richard Downing, DOJ,

• Bryan Vorndran, FBI,

• Eric Goldstein, CISA,

• Jeremy Sheridan, Secret Service

On Tuesday the Senate Homeland Security and Governmental Affairs Committee will be holding a hearing on “Resources and Authorities Needed to Protect and Secure the Homeland”. The sole witness will be Secretary Alejandro N. Mayorkas.

On Tuesday the Senate Commerce, Science, and Transportation Committee will be holding a hearing on “Pipeline Cybersecurity: Protecting Critical Infrastructure”. The witness list includes:

• David Pekoske, TSA,

• Polly Trottenberg, DOT,

• Leslie Gordon, GAO

On Thursday the Cybersecurity, Infrastructure Protection, & Innovation Subcommittee of the House Homeland Security Committee will be holding a hearing on “The Cyber Talent Pipeline: Educating a Workforce to Match Today’s Threats”. The witness list includes:

• Kevin Nolten, CYBER.ORG,

• Ralph Ley, Idaho National Laboratory,

• Tony Coulson, California State University, San Bernardino

Bills Introduced – 7-21-21

Yesterday, with both the House and Senate in session, there were 60 bills introduced. Four of those bills may receive additional coverage in this blog:

HR 4597 To amend the Federal Water Pollution Control Act to make certain projects and activities eligible for financial assistance under a State water pollution control revolving fund, and for other purposes. Rep. Garamendi, John [D-CA-3]

HR 4609 To reauthorize the National Institute of Standards and Technology, and for other purposes. Rep. Stevens, Haley M. [D-MI-11]

HR 4611 To direct the Secretary of Homeland Security to issue guidance with respect to certain information and communications technology or services contracts, and for other purposes. Rep. Torres, Ritchie [D-NY-15]

S 2407 A bill to ensure timely Federal Government awareness of cyber intrusions that pose a threat to national security, enable the development of a common operating picture of national-level cyber threats, and to make appropriate, actionable cyber threat information available to the relevant government and private sector entities, as well as the public, and for other purposes. Sen. Warner, Mark [D-VA] 

I will be watching HR 4597 and HR 4611 for language and definitions that would include industrial control systems within the coverage of the bill.

I will be covering HR 4609 as NIST has become an important cybersecurity standards setting organization for the US Government.

S 2407 is the long awaited and much publicized Senate Intelligence Committee bill on reporting of cyber incidents. It has an impressive list of cosponsors. See Warner’s press release of the bill here. A draft version of the bill (GPO version will be out sometime) has been provided by Warner’s office. After a quick scan I see one thing of importance (certainly there will be more as I look at it in more depth), the bill kicks down to CISA the responsibility for defining what ‘critical infrastructure’ organizations will be required to report cyber breaches. This could become the de facto list of what constitutes critical infrastructure.