S 933 — Federal Data Center Enhancement Act of 2023

changes in existing law made by 
the bill, as reported, are shown as follows (existing law 
proposed to be omitted is enclosed in brackets, new matter is 
printed in italic, and existing law in which no change is 
proposed is shown in roman):

UNITED STATES CODE

 * * * * * * *

TITLE 44--PUBLIC PRINTING AND DOCUMENTS

 * * * * * * *

CHAPTER 36--MANAGEMENT AND PROMOTION OF ELECTRONIC GOVERNMENT SERVICES

 * * * * * * *

SEC. 3601. DEFINITIONS

 * * * * * * *

STATUTORY NOTES AND RELATED SUBSIDIARIES

 * * * * * * *

FEDERAL DATA CENTER CONSOLIDATION INITIATIVE

 * * * * * * *

 (a) * * *
 (1) * * *
 (2) * * *
 [(3) FDCCI.--The term `FDCCI' means the Federal Data 
 Center Consolidation Initiative described in the Office 
 of Management and Budget Memorandum on the Federal Data 
 Center Consolidation Initiative, dated February 26, 
 2010, or any successor thereto.
 [(4) Government-Wide Data Center Consolidation and 
 Optimization Metrics.--The term `Government-wide data 
 center consolidation and optimization metrics' means 
 the metrics established by the Administrator under 
 subsection (b)(2)(G).]
 (3) New data center.--The term `new data center' 
 means--
 (A)(i) a data center or a portion thereof 
 that is owned, operated, or maintained by a 
 covered agency; or
 (ii) to the extent practicable, a data center 
 or portion thereof--
 (I) that is owned, operated, or 
 maintained by a contractor on behalf of 
 a covered agency on the date on which 
 the contract between the covered agency 
 and the contractor expires; and
 (II) with respect to which the 
 covered agency extends the contract, or 
 enters into a new contract, with the 
 contractor; and
 (B) on or after the date that is 180 days 
 after the date of enactment of the Federal Data 
 Center Enhancement Act of 2023, a data center 
 or portion thereof that is--
 (i) established; or
 (ii) substantially upgraded or 
 expanded.
 [(b) Federal Data Center Consolidation Inventories and 
Strategies.--
 [(1) In general.--
 [(A) Annual reporting.--Except as provided in 
 subparagraph (C), each year, beginning in the 
 first fiscal year after the date of the 
 enactment of this Act [Dec. 19, 2014] and each 
 fiscal year thereafter, the head of each 
 covered agency, assisted by the Chief 
 Information Officer of the agency, shall submit 
 to the Administrator--
 [(i) a comprehensive inventory of the 
 data centers owned, operated, or 
 maintained by or on behalf of the 
 agency; and
 [(ii) a multi-year strategy to 
 achieve the consolidation and 
 optimization of the data centers 
 inventoried under clause (i), that 
 includes--
 [(I) performance metrics--
 [(aa) that are 
 consistent with the 
 Government-wide data 
 center consolidation 
 and optimization 
 metrics; and
 [(bb) by which the 
 quantitative and 
 qualitative progress of 
 the agency toward the 
 goals of the FDCCI can 
 be measured;
 [(II) a timeline for agency 
 activities to be completed 
 under the FDCCI, with an 
 emphasis on benchmarks the 
 agency can achieve by specific 
 dates;
 [(III) year-by-year 
 calculations of investment and 
 cost savings for the period 
 beginning on the date of the 
 enactment of this Act and 
 ending on the date set forth in 
 subsection (e), broken down by 
 each year, including a 
 description of any initial 
 costs for data center 
 consolidation and optimization 
 and life cycle cost savings and 
 other improvements, with an 
 emphasis on--
 [(aa) meeting the 
 Government-wide data 
 center consolidation 
 and optimization 
 metrics; and
 [(bb) demonstrating 
 the amount of agency-
 specific cost savings 
 each fiscal year 
 achieved through the 
 FDCCI; and
 [(IV) any additional 
 information required by the 
 Administrator.
 [(B) Use of other reporting structures.--The 
 Administrator may require a covered agency to 
 include the information required to be 
 submitted under this subsection through 
 reporting structures determined by the 
 Administrator to be appropriate.
 [(C) Department of defense reporting.--For 
 any year that the Department of Defense is 
 required to submit a performance plan for 
 reduction of resources required for data 
 servers and centers, as required under section 
 2867(b) of the National Defense Authorization 
 Act for Fiscal Year 2012 [Pub. L. 112-81] (10 
 U.S.C. 2223a note), the Department of Defense--
 [(i) may submit to the Administrator, 
 in lieu of the multi-year strategy 
 required under subparagraph (A)(ii)--
 [(I) the defense-wide plan 
 required under section 
 2867(b)(2) of the National 
 Defense Authorization Act for 
 Fiscal Year 2012 (10 U.S.C. 
 2223a note); and
 [(II) the report on cost 
 savings required under section 
 2867(d) of the National Defense 
 Authorization Act for Fiscal 
 Year 2012 (10 U.S.C. 2223a 
 note); and
 [(ii) shall submit the comprehensive 
 inventory required under subparagraph 
 (A)(i), unless the defense-wide plan 
 required under section 2867(b)(2) of 
 the National Defense Authorization Act 
 for Fiscal Year 2012 (10 U.S.C. 2223a 
 note)--
 [(I) contains a comparable 
 comprehensive inventory; and
 [(II) is submitted under 
 clause (i).
 [(D) Statement. --Each year, beginning in the 
 first fiscal year after the date of the 
 enactment of this Act and each fiscal year 
 thereafter, the head of each covered agency, 
 acting through the Chief Information Officer of 
 the agency, shall--
 [(i)
 [(I) submit a statement to 
 the Administrator stating 
 whether the agency has complied 
 with the requirements of this 
 section; and
 [(II) make the statement 
 submitted under subclause (I) 
 publicly available; and
 [(ii) if the agency has not complied 
 with the requirements of this section, 
 submit a statement to the Administrator 
 explaining the reasons for not 
 complying with such requirements.
 [(E) Agency implementation of strategies.--
 [(i) In general.--Each covered 
 agency, under the direction of the 
 Chief Information Officer of the 
 agency, shall--
 [(I) implement the strategy 
 required under subparagraph 
 (A)(ii); and
 [(II) provide updates to the 
 Administrator, on a quarterly 
 basis, of--
 [(aa) the completion 
 of activities by the 
 agency under the FDCCI;
 [(bb) any progress of 
 the agency towards 
 meeting the Government-
 wide data center 
 consolidation and 
 optimization metrics; 
 and
 [(cc) the actual cost 
 savings and other 
 improvements realized 
 through the 
 implementation of the 
 strategy of the agency.
 [(ii) Department of defense.--For 
 purposes of clause (i)(I), 
 implementation of the defense-wide plan 
 required under section 2867(b)(2) of 
 the National Defense Authorization Act 
 for Fiscal Year 2012 [Pub. L. 112-81] 
 (10 U.S.C. 2223a note) by the 
 Department of Defense shall be 
 considered implementation of the 
 strategy required under subparagraph 
 (A)(ii).
 [(F) Rule of construction.--Nothing in this 
 section shall be construed to limit the 
 reporting of information by a covered agency to 
 the Administrator, the Director of the Office 
 of Management and Budget, or Congress.
 [(2) Administrator responsibilities.--The 
 Administrator shall--
 [(A) establish the deadline, on an annual 
 basis, for covered agencies to submit 
 information under this section;
 [(B) establish a list of requirements that 
 the covered agencies must meet to be considered 
 in compliance with paragraph (1);
 [(C) ensure that information relating to 
 agency progress towards meeting the Government-
 wide data center consolidation and optimization 
 metrics is made available in a timely manner to 
 the general public;
 [(D) review the inventories and strategies 
 submitted under paragraph (1) to determine 
 whether they are comprehensive and complete;
 [(E) monitor the implementation of the data 
 center strategy of each covered agency that is 
 required under paragraph (1)(A)(ii);
 [(F) update, on an annual basis, the 
 cumulative cost savings realized through the 
 implementation of the FDCCI; and
 [(G) establish metrics applicable to the 
 consolidation and optimization of data centers 
 Government-wide, including metrics with respect 
 to--
 [(i) costs;
 [(ii) efficiencies, including, at a 
 minimum, server efficiency; and
 [(iii) any other factors the 
 Administrator considers appropriate.
 [(3) Cost saving goal and updates for congress.--
 [(A) In general.--Not later than one year 
 after the date of the enactment of this Act, 
 the Administrator shall develop, and make 
 publicly available, a goal, broken down by 
 year, for the amount of planned cost savings 
 and optimization improvements achieved through 
 the FDCCI during the period beginning on the 
 date of the enactment of this Act and ending on 
 the date set forth in subsection (e).
 [(B) Annual update.--
 [(i) In general.--Not later than one 
 year after the date on which the goal 
 described in subparagraph (A) is made 
 publicly available, and each year 
 thereafter, the Administrator shall 
 aggregate the reported cost savings of 
 each covered agency and optimization 
 improvements achieved to date through 
 the FDCCI and compare the savings to 
 the projected cost savings and 
 optimization improvements developed 
 under subparagraph (A).
 [(ii) Update for congress.--The goal 
 required to be developed under 
 subparagraph (A) shall be submitted to 
 Congress and shall be accompanied by a 
 statement describing--
 [(I) the extent to which each 
 covered agency has developed 
 and submitted a comprehensive 
 inventory under paragraph 
 (1)(A)(i), including an 
 analysis of the inventory that 
 details specific numbers, use, 
 and efficiency level of data 
 centers in each inventory; and
 [(II) the extent to which 
 each covered agency has 
 submitted a comprehensive 
 strategy that addresses the 
 items listed in paragraph 
 (1)(A)(ii).
 [(4) GAO review.--
 [(A) In general.--Not later than one year 
 after the date of the enactment of this Act, 
 and each year thereafter, the Comptroller 
 General of the United States shall review and 
 verify the quality and completeness of the 
 inventory and strategy of each covered agency 
 required under paragraph (1)(A).
 [(B) Report.--The Comptroller General of the 
 United States shall, on an annual basis, 
 publish a report on each review conducted under 
 subparagraph (A).]
 (b) Minimum Requirements for New Data Centers.--
 (1) In general.--Not later than 180 days after the 
 date of enactment of the Federal Data Center 
 Enhancement Act of 2023, the Administrator shall 
 establish minimum requirements for new data centers in 
 consultation with the Administrator of General Services 
 and the Federal Chief Information Officers Council.
 (2) Contents.--
 (A) In general.--The minimum requirements 
 established under paragraph (1) shall include 
 requirements relating to--
 (i) the availability of new data 
 centers;
 (ii) the use of new data centers;
 (iii) the use of sustainable energy 
 sources;
 (iv) uptime percentage;
 (v) protections against power 
 failures, including on-site energy 
 generation and access to multiple 
 transmission paths;
 (vi) protections against physical 
 intrusions and natural disasters;
 (vii) information security 
 protections required by subchapter II 
 of chapter 35 of title 44, United 
 States Code, and other applicable law 
 and policy; and
 (viii) any other requirements the 
 Administrator determines appropriate.
 (B) Consultation.--In establishing the 
 requirements described in subparagraph 
 (A)(vii), the Administrator shall consult with 
 the Director of the Cybersecurity and 
 Infrastructure Security Agency and the National 
 Cyber Director.
 (3) Incorporation of minimum requirements into 
 current data centers.--As soon as practicable, and in 
 any case not later than 90 days after the Administrator 
 establishes the minimum requirements pursuant to 
 paragraph (1), the Administrator shall issue guidance 
 to ensure, as appropriate, that covered agencies 
 incorporate the minimum requirements established under 
 that paragraph into the operations of any data center 
 of a covered agency existing as of the date of 
 enactment of the Federal Data Center Enhancement Act of 
 2023.
 (4) Review of requirements.--The Administrator, in 
 consultation with the Administrator of General Services 
 and the Federal Chief Information Officers Council, 
 shall review, update, and modify the minimum 
 requirements established under paragraph (1), as 
 necessary.
 (5) Report on new data centers.--During the 
 development and planning lifecycle of a new data 
 center, if the head of a covered agency determines that 
 the covered agency is likely to make a management or 
 financial decision relating to any data center, the 
 head of the covered agency shall--
 (A) notify--
 (i) the Administrator;
 (ii) Committee on Homeland Security 
 and Governmental Affairs of the Senate; 
 and
 (iii) Committee on Oversight and 
 Accountability of the House of 
 Representatives; and
 (B) describe in the notification with 
 sufficient detail how the covered agency 
 intends to comply with the minimum requirements 
 established under paragraph (1).
 (6) Use of technology.--In determining whether to 
 establish or continue to operate an existing data 
 center, the head of a covered agency shall--
 (A) regularly assess the application 
 portfolio of the covered agency and ensure that 
 each at risk legacy application is updated, 
 replaced, or modernized, as appropriate, to 
 take advantage of modern technologies; and
 (B) prioritize and, to the greatest extent 
 possible, leverage commercial cloud 
 environments rather than acquiring, overseeing, 
 or managing custom data center infrastructure.
 (7) Public website.--
 (A) In general.--The Administrator shall 
 maintain a public-facing website that includes 
 information, data, and explanatory statements 
 relating to the compliance of covered agencies 
 with the requirements of this section.
 (B) Processes and procedures.--In maintaining 
 the website described in subparagraph (A), the 
 Administrator shall--
 (i) ensure covered agencies 
 regularly, and not less frequently than 
 biannually, update the information, 
 data, and explanatory statements posed 
 on the website, pursuant to guidance 
 issued by the Administrator, relating 
 to any new data centers and, as 
 appropriate, each existing data center 
 of the covered agency; and
 (ii) ensure that all information, 
 data, and explanatory statements on the 
 website are maintained as open 
 Government data assets.
 (c) Ensuring Cybersecurity Standards for Data Center 
Consolidation and Cloud Computing.--
 [(1) In general.--In implementing a data center 
 consolidation and optimization strategy under this 
 section, a covered agency shall do so in a manner that 
 is consistent with Federal guidelines on cloud 
 computing security, including--
 [(A) applicable provisions found within the 
 Federal Risk and Authorization Management 
 Program (FedRAMP); and
 [(B) guidance published by the National 
 Institute of Standards and Technology.]
 (1) In general.--The head of a covered agency shall 
 oversee and manage the data center portfolio and the 
 information technology strategy of the covered agency 
 in accordance with Federal cybersecurity guidelines and 
 directives, including--
 (A) information security standards and 
 guidelines promulgated by the Director of the 
 National Institute of Standards and Technology;
 (B) applicable requirements and guidance 
 issued by the Director of the Office of 
 Management and Budget pursuant to section 3614 
 of title 44, United States Code; and
 (C) directives issued by the Secretary of 
 Homeland Security under section 3553 of title 
 44, United States Code.
 (2) * * *
 (d) * * *
 (e) Sunset.--This section is repealed effective on October 
1, [2022] 2026.