; and (ii) supporting the activities of the Federal Acquisition Security Council. (2) Assessment of critical open source software components (A) Framework Not later than one year after the date of the enactment of this section, the Director shall publicly publish a framework, incorporating government, private sector, and open source software community frameworks and best practices, including those published by the National Institute of Standards and Technology, for assessing the risk of open source software components, including direct and indirect open source software dependencies, which shall incorporate, at a minimum, the following with respect to a given open source software component: (i) The security properties of code, such as whether the code is written in a memory-safe programming language or successor language. (ii) The security practices of development, build, and release processes, such as the use of multi-factor authentication by maintainers and cryptographic signing of releases. (iii) The number and severity of publicly known, unpatched vulnerabilities. (iv) The breadth of deployment. (v) The level of risk associated with where such component is integrated or deployed, such as whether such component operates on a network boundary or in a privileged location. (vi) The health and sustainability of the open source software community, including, where applicable, the level of current and historical investment and maintenance in such component, such as the number and activity of individual maintainers. (B) Updating framework Not less frequently than annually after the date on which the framework is published under subparagraph (A), the Director shall— (i) determine whether updates are needed to such framework, including the augmentation, addition, or removal of the elements described in clauses (i) through (vi) of such subparagraph