; and (ii) supporting the activities of the Federal Acquisition Security Council. (2) Assessment of critical open source software components (A) Framework Not later than 1 year after the date of enactment of this section, the Director shall publicly publish a framework, incorporating government, industry, and open source software community frameworks and best practices, including those published by the National Institute of Standards and Technology, for assessing the risk of open source software components, including direct and indirect open source software dependencies, which shall incorporate, at a minimum— (i) the security properties of code in a given open source software component, such as whether the code is written in a memory-safe programming language; (ii) the security practices of development, build, and release processes of a given open source software component, such as the use of multi-factor authentication by maintainers and cryptographic signing of releases; (iii) the number and severity of publicly known, unpatched vulnerabilities in a given open source software component; (iv) the breadth of deployment of a given open source software component; (v) the level of risk associated with where a given open source software component is integrated or deployed, such as whether the component operates on a network boundary or in a privileged location; and (vi) the health of the open source software community for a given open source software component, including, where applicable, the level of current and historical investment and maintenance in the open source software component, such as the number and activity of individual maintainers. (B) Updating framework Not less frequently than annually after the date on which the framework is published under subparagraph (A), the Director shall— (i) determine whether updates are needed to the framework described in subparagraph (A), including the augmentation, addition, or removal of the elements described in clauses (i) through (vi) of such subparagraph