The draft amendment to the Code itself is just 10 pages long (pp. 123-133), pp. 1-123 are the analysis, a total of 133 pages [1]. § 226.2 Applicability (12) on

The draft amendment to the Code itself is just 10 pages long (pp. 123-133), pp. 1-123 are the analysis, a total of 133 pages [1]. § 226.2 Applicability (12) on p. 125 covers most IT/SaaS companies (any SW that has an OAuth2 client lib dependency seems to hit sub-clauses (ii)(C) and (ii)(D)) (emphasis mine): (12) Information technology entities. The entity meets one or more of the following criteria: (i) Knowingly provides or supports information technology hardware, software, systems, or services to the Federal government; (ii) Has developed and continues to sell, license, or maintain any software that has, or has direct software dependencies upon, one or more components with at least one of these attributes: (A) Is designed to run with elevated privilege or manage privileges; (B) Has direct or privileged access to networking or computing resources; (C) Is designed to control access to data or operational technology; (D) Performs a function critical to trust; or (E) Operates outside of normal trust boundaries with privileged access; (iii) Is an original equipment manufacturer, vendor, or integrator of operational technology hardware or software components; (iv) Performs functions related to domain name operations; Also, would not hurt if the draft was written in the BLUF fashion [2], with the 10 pages of the proposed law followed by 123 pages of the analysis. [1]: https://www.govinfo.gov/content/pkg/FR-2024-04-04/pdf/2024-06526.pdf https://www.govinfo.gov/content/pkg/FR-2024-04-04/pdf/2024-0... [2]: https://en.wikipedia.org/wiki/BLUF_(communication) https://en.wikipedia.org/wiki/BLUF_(communication)