,,ii #aaeth ,,congress #b;d ,session ,h4 ,r4 #gcbg ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,december #ai1 #bjah,received ,,an ,,act ,to require the ,secretary of ,homeland ,security to establish a security vulnerability disclosure policy1 to establish a bug bounty program for the ,department of ,homeland ,security1 to amend title #da1 ,united ,states ,code1 to provide for ,federal acquisition supply chain security1 and for other purposes4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,strengthening and ,enhancing ,cyber-capabilities by ,utilizing ,risk ,exposure ,technology ,act or the ,,secure ,technology ,act4 7b7 ,table of contents ,the table of contents for this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4 ,title ,i--,department of ,homeland ,security information security and other matters ,sec4 #aja4 ,department of ,homeland ,security disclosure of security vulnerabilities4 ,sec4 #ajb4 ,department of ,homeland ,security bug bounty pilot program4 ,sec4 #ajc4 ,congressional submittal of reports relating to certain special access programs and similar programs4 ,title ,,ii--,federal acquisition supply chain security ,sec4 #bja4 ,short title4 ,sec4 #bjb4 ,federal acquisition supply chain security4 ,sec4 #bjc4 ,authorities of executive agencies relating to mitigating supply chain risks in the procurement of covered articles4 ,sec4 #bjd4 ,federal ,information ,security ,modernization ,act4 ,sec4 #bje4 ,effective date4 ,i ,department of ,homeland ,security information security and other matters #aja4 ,department of ,homeland ,security disclosure of security vulnerabilities 7a7 ,vulnerability disclosure policy ,the ,secretary of ,homeland ,security shall establish a policy applicable to individuals1 organizations1 and companies that report security vulnerabilities on appropriate information systems of ,department of ,homeland ,security4 ,such policy shall include each of the following3 7#a7 ,the appropriate information systems of the ,department that individuals1 organizations1 and companies may use to discover and report security vulnerabilities on appropriate information systems4 7#b7 ,the conditions and criteria under which individuals1 organizations1 and companies may operate to discover and report security vulnerabilities4 7#c7 ,how individuals1 organizations1 and companies may disclose to the ,department security vulnerabilities discovered on appropriate information systems of the ,department4 7#d7 ,the ways in which the ,department may communicate with individuals1 organizations1 and companies that report security vulnerabilities4 7#e7 ,the process the ,department shall use for public disclosure of reported security vulnerabilities4 7b7 ,remediation process ,the ,secretary of ,homeland ,security shall develop a process for the ,department of ,homeland ,security to address the mitigation or remediation of the security vulnerabilities reported through the policy developed in subsection 7a74 7c7 ,consultation 7#a7 ,in general ,in developing the security vulnerability disclosure policy under subsection 7a71 the ,secretary of ,homeland ,security shall consult with each of the following3 7,a7 ,the ,attorney ,general regarding how to ensure that individuals1 organizations1 and companies that comply with the requirements of the policy developed under subsection 7a7 are protected from prosecution under section #ajcj of title #ah1 ,united ,states ,code1 civil lawsuits1 and similar provisions of law with respect to specific activities authorized under the policy4 7,b7 ,the ,secretary of ,defense and the ,administrator of ,general ,services regarding lessons that may be applied from existing vulnerability disclosure policies4 7,c7 ,non-governmental security researchers4 7#b7 ,nonapplicability of ,,faca ,the ,federal ,advisory ,committee ,act 7#e ,u4,s4,c4 ,app47 shall not apply to any consultation under this section4 7d7 ,public availability ,the ,secretary of ,homeland ,security shall make the policy developed under subsection 7a7 publicly available4 7e7 ,submission to ,congress 7#a7 ,disclosure policy and remediation process ,not later than #ij days after the date of the enactment of this ,act1 the ,secretary of ,homeland ,security shall submit to the appropriate congressional committees a copy of the policy required under subsection 7a7 and the remediation process required under subsection 7b74 7#b7 ,report and briefing 7,a7 ,report ,not later than one year after establishing the policy required under subsection 7a71 the ,secretary of ,homeland ,security shall submit to the appropriate congressional committees a report on such policy and the remediation process required under subsection 7b74 7,b7 ,annual briefings ,one year after the date of the submission of the report under subparagraph 7,a71 and annually thereafter for each of the next three years1 the ,secretary of ,homeland ,security shall provide to the appropriate congressional committees a briefing on the policy required under subsection 7a7 and the process required under subsection 7b74 7,c7 ,matters for inclusion ,the report required under subparagraph 7,a7 and the briefings required under subparagraph 7,b7 shall include each of the following with respect to the policy required under subsection 7a7 and the process required under subsection 7b7 for the period covered by the report or briefing1 as the case may be3 7i7 ,the number of unique security vulnerabilities reported4 7ii7 ,the number of previously unknown security vulnerabilities mitigated or remediated4 7iii7 ,the number of unique individuals1 organizations1 and companies that reported security vulnerabilities4 7iv7 ,the average length of time between the reporting of security vulnerabilities and mitigation or remediation of such vulnerabilities4 7f7 ,definitions ,in this section3 7#a7 ,the term security vulnerability has the meaning given that term in section #ajb7ag7 of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja7ag771 in information technology4 7#b7 ,the term information system has the meaning given that term by section #cejb of title #dd1 ,united ,states ,code4 7#c7 ,the term appropriate information system means an information system that the ,secretary of ,homeland ,security selects for inclusion under the vulnerability disclosure policy required by subsection 7a74 7#d7 ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,homeland ,security1 the ,committee on ,armed ,services1 the ,committee on ,energy and ,commerce1 and the ,permanent ,select ,committee on ,intelligence of the ,house of ,representatives2 and 7,b7 the ,committee on ,homeland ,security and ,governmental ,affairs1 the ,committee on ,armed ,services1 the ,committee on ,commerce1 ,science1 and ,transportation1 and the ,select ,committee on ,intelligence of the ,senate4 #ajb4 ,department of ,homeland ,security bug bounty pilot program 7a7 ,definitions ,in this section3 7#a7 ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7,b7 the ,select ,committee on ,intelligence of the ,senate2 7,c7 the ,committee on ,homeland ,security of the ,house of ,representatives2 and 7,d7 ,permanent ,select ,committee on ,intelligence of the ,house of ,representatives4 7#b7 ,the term bug bounty program means a program under which-- 7,a7 individuals1 organizations1 and companies are temporarily authorized to identify and report vulnerabilities of appropriate information systems of the ,department2 and 7,b7 eligible individuals1 organizations1 and companies receive compensation in exchange for such reports4 7#c7 ,the term ,department means the ,department of ,homeland ,security4 7#d7 ,the term eligible individual1 organization1 or company means an individual1 organization1 or company that meets such criteria as the ,secretary determines in order to receive compensation in compliance with ,federal laws4 7#e7 ,the term information system has the meaning given the term in section #cejb of title #dd1 ,united ,states ,code4 7#f7 ,the term pilot program means the bug bounty pilot program required to be established under subsection 7b77#a74 7#g7 ,the term ,secretary means the ,secretary of ,homeland ,security4 7b7 ,bug bounty pilot program 7#a7 ,establishment ,not later than #ahj days after the date of enactment of this ,act1 the ,secretary shall establish1 within the ,office of the ,chief ,information ,officer1 a bug bounty pilot program to minimize vulnerabilities of appropriate information systems of the ,department4 7#b7 ,responsibilities of ,secretary ,in establishing and conducting the pilot program1 the ,secretary shall-- 7,a7 designate appropriate information systems to be included in the pilot program2 7,b7 provide compensation to eligible individuals1 organizations1 and companies for reports of previously unidentified security vulnerabilities within the information systems designated under subparagraph 7,a72 7,c7 establish criteria for individuals1 organizations1 and companies to be considered eligible for compensation under the pilot program in compliance with ,federal laws2 7,d7 consult with the ,attorney ,general on how to ensure that approved individuals1 organizations1 or companies that comply with the requirements of the pilot program are protected from prosecution under section #ajcj of title #ah1 ,united ,states ,code1 and similar provisions of law1 and civil lawsuits for specific activities authorized under the pilot program2 7,e7 consult with the ,secretary of ,defense and the heads of other departments and agencies that have implemented programs to provide compensation for reports of previously undisclosed vulnerabilities in information systems1 regarding lessons that may be applied from such programs2 and 7,f7 develop an expeditious process by which an individual1 organization1 or company can register with the ,department1 submit to a background check as determined by the ,department1 and receive a determination as to eligibility2 and 7,g7 engage qualified interested persons1 including non-government sector representatives1 about the structure of the pilot program as constructive and to the extent practicable4 7#c7 ,contract authority ,in establishing the pilot program1 the ,secretary1 subject to the availability of appropriations1 may award #a or more competitive contracts to an entity1 as necessary1 to manage the pilot program4 7c7 ,report to ,congress ,not later than #ahj days after the date on which the pilot program is completed1 the ,secretary shall submit to the appropriate congressional committees a report on the pilot program1 which shall include-- 7#a7 the number of individuals1 organizations1 or companies that participated in the pilot program1 broken down by the number of individuals1 organizations1 or companies that-- 7,a7 registered2 7,b7 were determined eligible2 7,c7 submitted security vulnerabilities2 and 7,d7 received compensation2 7#b7 the number and severity of vulnerabilities reported as part of the pilot program2 7#c7 the number of previously unidentified security vulnerabilities remediated as a result of the pilot program2 7#d7 the current number of outstanding previously unidentified security vulnerabilities and ,department remediation plans2 7#e7 the average length of time between the reporting of security vulnerabilities and remediation of the vulnerabilities2 7#f7 the types of compensation provided under the pilot program2 and 7#g7 the lessons learned from the pilot program4 7d7 ,authorization of appropriations ,there is authorized to be appropriated to the ,department #bej1jjj for fiscal year #bjai to carry out this section4 #ajc4 ,congressional submittal of reports relating to certain special access programs and similar programs ,the ,national ,defense ,authorization ,act for ,fiscal ,year #aiid 7#ej ,u4,s4,c4 #ccdh7 is amended-- 7#a7 by striking ,congress each place it appears and inserting the congressional oversight committees2 7#b7 in subsection 7f77#a71 by striking appropriate oversight committees and inserting congressional oversight committees2 and 7#c7 in subsection 7g7-- 7,a7 by redesignating paragraphs 7#a7 and 7#b7 as paragraphs 7#b7 and 7#c71 respectively2 and 7,b7 by inserting before paragraph 7#b71 as so redesignated1 the following3 7#a7 ,congressional oversight committees ,the term congressional oversight committees means-- 7,a7 congressional leadership and authorizing and appropriations congressional committees with jurisdiction or shared jurisdiction over a department or agency2 7,b7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 and 7,c7 the ,committee on ,oversight and ,government ,reform of the ,house of ,representatives4 4 ,,ii ,federal acquisition supply chain security #bja4 ,short title ,this title may be cited as the ,federal ,acquisition ,supply ,chain ,security ,act of #bjah4 #bjb4 ,federal acquisition supply chain security 7a7 ,in general ,chapter #ac of title #da1 ,united ,states ,code1 is amended by adding at the end the following new subchapter3 ,,iii ,federal acquisition supply chain security #acba4 ,definitions ,in this subchapter3 7#a7 ,appropriate congressional committees and leadership ,the term appropriate congressional committees and leadership means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs1 the ,committee on the ,judiciary1 the ,committee on ,appropriations1 the ,committee on ,armed ,services1 the ,committee on ,commerce1 ,science1 and ,transportation1 the ,select ,committee on ,intelligence1 and the majority and minority leader of the ,senate2 and 7,b7 the ,committee on ,oversight and ,government ,reform1 the ,committee on the ,judiciary1 the ,committee on ,appropriations1 the ,committee on ,homeland ,security1 the ,committee on ,armed ,services1 the ,committee on ,energy and ,commerce1 the ,permanent ,select ,committee on ,intelligence1 and the ,speaker and minority leader of the ,house of ,representatives4 7#b7 ,council ,the term ,council means the ,federal ,acquisition ,security ,council established under section #acbb7;a7 of this title4 7#c7 ,covered article ,the term covered article has the meaning given that term in section #dgac of this title4 7#d7 ,covered procurement action ,the term covered procurement action has the meaning given that term in section #dgac of this title4 7#e7 ,information and communications technology ,the term information and communications technology has the meaning given that term in section #dgac of this title4 7#f7 ,intelligence community ,the term intelligence community has the meaning given that term in section #c7d7 of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjjc7d774 7#g7 ,national security system ,the term national security system has the meaning given that term in section #ceeb of title #dd4 7#h7 ,supply chain risk ,the term supply chain risk has the meaning given that term in section #dgac of this title4 #acbb4 ,federal ,acquisition ,security ,council establishment and membership 7a7 ,establishment ,there is established in the executive branch a ,federal ,acquisition ,security ,council4 7b7 ,membership 7#a7 ,in general ,the following agencies shall be represented on the ,council3 7,a7 ,the ,office of ,management and ,budget4 7,b7 ,the ,general ,services ,administration4 7,c7 ,the ,department of ,homeland ,security1 including the ,cybersecurity and ,infrastructure ,security ,agency4 7,d7 ,the ,office of the ,director of ,national ,intelligence1 including the ,national ,counterintelligence and ,security ,center4 7,e7 ,the ,department of ,justice1 including the ,federal ,bureau of ,investigation4 7,f7 ,the ,department of ,defense1 including the ,national ,security ,agency4 7,g7 ,the ,department of ,commerce1 including the ,national ,institute of ,standards and ,technology4 7,h7 ,such other executive agencies as determined by the ,chairperson of the ,council4 7#b7 ,lead representatives 7,a7 ,designation 7i7 ,in general ,not later than #de days after the date of the enactment of the ,federal ,acquisition ,supply ,chain ,security ,act of #bjah1 the head of each agency represented on the ,council shall designate a representative of that agency as the lead representative of the agency on the ,council4 7ii7 ,requirements ,the representative of an agency designated under clause 7i7 shall have expertise in supply chain risk management1 acquisitions1 or information and communications technology4 7,b7 ,functions ,the lead representative of an agency designated under subparagraph 7,a7 shall ensure that appropriate personnel1 including leadership and subject matter experts of the agency1 are aware of the business of the ,council4 7c7 ,chairperson 7#a7 ,designation ,not later than #de days after the date of the enactment of the ,federal ,acquisition ,supply ,chain ,security ,act of #bjah1 the ,director of the ,office of ,management and ,budget shall designate a senior-level official from the ,office of ,management and ,budget to serve as the ,chairperson of the ,council4 7#b7 ,functions ,the ,chairperson shall perform functions that include-- 7,a7 subject to subsection 7d71 developing a schedule for meetings of the ,council2 7,b7 designating executive agencies to be represented on the ,council under subsection 7b77#a77;,h72 7,c7 in consultation with the lead representative of each agency represented on the ,council1 developing a charter for the ,council2 and 7,d7 not later than #g days after completion of the charter1 submitting the charter to the appropriate congressional committees and leadership4 7d7 ,meetings ,the ,council shall meet not later than #fj days after the date of the enactment of the ,federal ,acquisition ,supply ,chain ,security ,act of #bjah and not less frequently than quarterly thereafter4 #acbc4 ,functions and authorities 7a7 ,in general ,the ,council shall perform functions that include the following3 7#a7 ,identifying and recommending development by the ,national ,institute of ,standards and ,technology of supply chain risk management standards1 guidelines1 and practices for executive agencies to use when assessing and developing mitigation strategies to address supply chain risks1 particularly in the acquisition and use of covered articles under section #acbf7;a7 of this title4 7#b7 ,identifying or developing criteria for sharing information with executive agencies1 other ,federal entities1 and non-,federal entities with respect to supply chain risk1 including information related to the exercise of authorities provided under this section and sections #acbf and #dgac of this title4 ,at a minimum1 such criteria shall address-- 7,a7 the content to be shared2 7,b7 the circumstances under which sharing is mandated or voluntary2 and 7,c7 the circumstances under which it is appropriate for an executive agency to rely on information made available through such sharing in exercising the responsibilities and authorities provided under this section and section #dgac of this title4 7#c7 ,identifying an appropriate executive agency to-- 7,a7 accept information submitted by executive agencies based on the criteria established under paragraph 7#b72 7,b7 facilitate the sharing of information received under subparagraph 7,a7 to support supply chain risk analyses under section #acbf of this title1 recommendations under this section1 and covered procurement actions under section #dgac of this title2 7,c7 share with the ,council information regarding covered procurement actions by executive agencies taken under section #dgac of this title2 and 7,d7 inform the ,council of orders issued under this section4 7#d7 ,identifying1 as appropriate1 executive agencies to provide-- 7,a7 shared services1 such as support for making risk assessments1 validation of products that may be suitable for acquisition1 and mitigation activities2 and 7,b7 common contract solutions to support supply chain risk management activities1 such as subscription services or machine-learning-enhanced analysis applications to support informed decision making4 7#e7 ,identifying and issuing guidance on additional steps that may be necessary to address supply chain risks arising in the course of executive agencies providing shared services1 common contract solutions1 acquisitions vehicles1 or assisted acquisitions4 7#f7 ,engaging with the private sector and other nongovernmental stakeholders in performing the functions described in paragraphs 7#a7 and 7#b7 and on issues relating to the management of supply chain risks posed by the acquisition of covered articles4 7#g7 ,carrying out such other actions1 as determined by the ,council1 that are necessary to reduce the supply chain risks posed by acquisitions and use of covered articles4 7b7 ,program office and committees ,the ,council may establish a program office and any committees1 working groups1 or other constituent bodies the ,council deems appropriate1 in its sole and unreviewable discretion1 to carry out its functions4 7c7 ,authority for exclusion or removal orders 7#a7 ,criteria ,to reduce supply chain risk1 the ,council shall establish criteria and procedures for-- 7,a7 recommending orders applicable to executive agencies requiring the exclusion of sources or covered articles from executive agency procurement actions 7in this section referred to as exclusion orders72 7,b7 recommending orders applicable to executive agencies requiring the removal of covered articles from executive agency information systems 7in this section referred to as removal orders72 7,c7 requesting and approving exceptions to an issued exclusion or removal order when warranted by circumstances1 including alternative mitigation actions or other findings relating to the national interest1 including national security reviews1 national security investigations1 or national security agreements2 and 7,d7 ensuring that recommended orders do not conflict with standards and guidelines issued under section #aacca of title #dj and that the ,council consults with the ,director of the ,national ,institute of ,standards and ,technology regarding any recommended orders that would implement standards and guidelines developed by the ,national ,institute of ,standards and ,technology4 7#b7 ,recommendations ,the ,council shall use the criteria established under paragraph 7#a71 information made available under subsection 7a77#c71 and any other information the ,council determines appropriate to issue recommendations1 for application to executive agencies or any subset thereof1 regarding the exclusion of sources or covered articles from any executive agency procurement action1 including source selection and consent for a contractor to subcontract1 or the removal of covered articles from executive agency information systems4 ,such recommendations shall include-- 7,a7 information necessary to positively identify the sources or covered articles recommended for exclusion or removal2 7,b7 information regarding the scope and applicability of the recommended exclusion or removal order2 7,c7 a summary of any risk assessment reviewed or conducted in support of the recommended exclusion or removal order2 7,d7 a summary of the basis for the recommendation1 including a discussion of less intrusive measures that were considered and why such measures were not reasonably available to reduce supply chain risk2 7,e7 a description of the actions necessary to implement the recommended exclusion or removal order2 and 7,f7 where practicable1 in the ,council's sole and unreviewable discretion1 a description of mitigation steps that could be taken by the source that may result in the ,council rescinding a recommendation4 7#c7 ,notice of recommendation and review ,a notice of the ,council's recommendation under paragraph 7#b7 shall be issued to any source named in the recommendation advising-- 7,a7 that a recommendation has been made2 7,b7 of the criteria the ,council relied upon under paragraph 7#a7 and1 to the extent consistent with national security and law enforcement interests1 of information that forms the basis for the recommendation2 7,c7 that1 within #cj days after receipt of notice1 the source may submit information and argument in opposition to the recommendation2 7,d7 of the procedures governing the review and possible issuance of an exclusion or removal order pursuant to paragraph 7#e72 and 7,e7 where practicable1 in the ,council's sole and unreviewable discretion1 a description of mitigation steps that could be taken by the source that may result in the ,council rescinding the recommendation4 7#d7 ,confidentiality ,any notice issued to a source under paragraph 7#c7 shall be kept confidential until-- 7,a7 an exclusion or removal order is issued pursuant to paragraph 7#e72 and 7,b7 the source has been notified pursuant to paragraph 7#f74 7#e7 ,exclusion and removal orders 7,a7 ,order issuance ,recommendations of the ,council under paragraph 7#b71 together with any information submitted by a source under paragraph 7#c7 related to such a recommendation1 shall be reviewed by the following officials1 who may issue exclusion and removal orders based upon such recommendations3 7i7 ,the ,secretary of ,homeland ,security1 for exclusion and removal orders applicable to civilian agencies1 to the extent not covered by clause 7ii7 or 7iii74 7ii7 ,the ,secretary of ,defense1 for exclusion and removal orders applicable to the ,department of ,defense and national security systems other than sensitive compartmented information systems4 7iii7 ,the ,director of ,national ,intelligence1 for exclusion and removal orders applicable to the intelligence community and sensitive compartmented information systems1 to the extent not covered by clause 7ii74 7,b7 ,delegation ,the officials identified in subparagraph 7,a7 may not delegate any authority under this subparagraph to an official below the level one level below the ,deputy ,secretary or ,principal ,deputy ,director1 except that the ,secretary of ,defense may delegate authority for removal orders to the ,commander of the ,united ,states ,cyber ,command1 who may not redelegate such authority to an official below the level one level below the ,deputy ,commander4 7,c7 ,facilitation of exclusion orders ,if officials identified under this paragraph from the ,department of ,homeland ,security1 the ,department of ,defense1 and the ,office of the ,director of ,national ,intelligence issue orders collectively resulting in a governmentwide exclusion1 the ,administrator for ,general ,services and officials at other executive agencies responsible for management of the ,federal ,supply ,schedules1 governmentwide acquisition contracts and multi-agency contracts shall help facilitate implementation of such orders by removing the covered articles or sources identified in the orders from such contracts4 7,d7 ,review of exclusion and removal orders ,the officials identified under this paragraph shall review all exclusion and removal orders issued under subparagraph 7,a7 not less frequently than annually pursuant to procedures established by the ,council4 7,e7 ,rescission ,orders issued pursuant to subparagraph 7,a7 may be rescinded by an authorized official from the relevant issuing agency4 7#f7 ,notifications ,upon issuance of an exclusion or removal order pursuant to paragraph 7#e77;,a71 the official identified under that paragraph who issued the order shall-- 7,a7 notify any source named in the order of-- 7i7 the exclusion or removal order2 and 7ii7 to the extent consistent with national security and law enforcement interests1 information that forms the basis for the order2 7,b7 provide classified or unclassified notice of the exclusion or removal order to the appropriate congressional committees and leadership2 and 7,c7 provide the exclusion or removal order to the agency identified in subsection 7a77#c74 7#g7 ,compliance ,executive agencies shall comply with exclusion and removal orders issued pursuant to paragraph 7#e74 7d7 ,authority ,to request information ,the ,council may request such information from executive agencies as is necessary for the ,council to carry out its functions4 7e7 ,relationship to other councils ,the ,council shall consult and coordinate1 as appropriate1 with other relevant councils and interagency committees1 including the ,chief ,information ,officers ,council1 the ,chief ,acquisition ,officers ,council1 the ,federal ,acquisition ,regulatory ,council1 and the ,committee on ,foreign ,investment in the ,united ,states1 with respect to supply chain risks posed by the acquisition and use of covered articles4 7f7 ,rules of construction ,nothing in this section shall be construed-- 7#a7 to limit the authority of the ,office of ,federal ,procurement ,policy to carry out the responsibilities of that ,office under any other provision of law2 or 7#b7 to authorize the issuance of an exclusion or removal order based solely on the fact of foreign ownership of a potential procurement source that is otherwise qualified to enter into procurement contracts with the ,federal ,government4 #acbd4 ,strategic plan 7a7 ,in general ,not later than #ahj days after the date of the enactment of the ,federal ,acquisition ,supply ,chain ,security ,act of #bjah1 the ,council shall develop a strategic plan for addressing supply chain risks posed by the acquisition of covered articles and for managing such risks that includes-- 7#a7 the criteria and processes required under section #acbc7;a7 of this title1 including a threshold and requirements for sharing relevant information about such risks with all executive agencies and1 as appropriate1 with other ,federal entities and non-,federal entities2 7#b7 an identification of existing authorities for addressing such risks2 7#c7 an identification and promulgation of best practices and procedures and available resources for executive agencies to assess and mitigate such risks2 7#d7 recommendations for any legislative1 regulatory1 or other policy changes to improve efforts to address such risks2 7#e7 recommendations for any legislative1 regulatory1 or other policy changes to incentivize the adoption of best practices for supply chain risk management by the private sector2 7#f7 an evaluation of the effect of implementing new policies or procedures on existing contracts and the procurement process2 7#g7 a plan for engaging with executive agencies1 the private sector1 and other nongovernmental stakeholders to address such risks2 7#h7 a plan for identification1 assessment1 mitigation1 and vetting of supply chain risks from existing and prospective information and communications technology made available by executive agencies to other executive agencies through common contract solutions1 shared services1 acquisition vehicles1 or other assisted acquisition services2 and 7#i7 plans to strengthen the capacity of all executive agencies to conduct assessments of-- 7,a7 the supply chain risk posed by the acquisition of covered articles2 and 7,b7 compliance with the requirements of this subchapter4 7b7 ,submission to congress ,not later than #g calendar days after completion of the strategic plan required by subsection 7a71 the ,chairperson of the ,council shall submit the plan to the appropriate congressional committees and leadership4 #acbe4 ,annual report ,not later than ,december #ca of each year1 the ,chairperson of the ,council shall submit to the appropriate congressional committees and leadership a report on the activities of the ,council during the preceding #ab-month period4 #acbf4 ,requirements for executive agencies 7a7 ,in general ,the head of each executive agency shall be responsible for-- 7#a7 assessing the supply chain risk posed by the acquisition and use of covered articles and avoiding1 mitigating1 accepting1 or transferring that risk1 as appropriate and consistent with the standards1 guidelines1 and practices identified by the ,council under section #acbc7;a77#a72 and 7#b7 prioritizing supply chain risk assessments conducted under paragraph 7#a7 based on the criticality of the mission1 system1 component1 service1 or asset4 7b7 ,inclusions ,the responsibility for assessing supply chain risk described in subsection 7a7 includes-- 7#a7 developing an overall supply chain risk management strategy and implementation plan and policies and processes to guide and govern supply chain risk management activities2 7#b7 integrating supply chain risk management practices throughout the life cycle of the system1 component1 service1 or asset2 7#c7 limiting1 avoiding1 mitigating1 accepting1 or transferring any identified risk2 7#d7 sharing relevant information with other executive agencies as determined appropriate by the ,council in a manner consistent with section #acbc7;a7 of this title2 7#e7 reporting on progress and effectiveness of the agency's supply chain risk management consistent with guidance issued by the ,office of ,management and ,budget and the ,council2 and 7#f7 ensuring that all relevant information1 including classified information1 with respect to acquisitions of covered articles that may pose a supply chain risk1 consistent with section #acbc7;a7 of this title1 is incorporated into existing processes of the agency for conducting assessments described in subsection 7a7 and ongoing management of acquisition programs1 including any identification1 investigation1 mitigation1 or remediation needs4 7c7 ,interagency acquisitions 7#a7 ,in general ,except as provided in paragraph 7#b71 in the case of an interagency acquisition1 subsection 7a7 shall be carried out by the head of the executive agency whose funds are being used to procure the covered article4 7#b7 ,assisted acquisitions ,in an assisted acquisition1 the parties to the acquisition shall determine1 as part of the interagency agreement governing the acquisition1 which agency is responsible for carrying out subsection 7a74 7#c7 ,definitions ,in this subsection1 the terms assisted acquisition and interagency acquisition have the meanings given those terms in section #b4aja of title #dh1 ,code of ,federal ,regulations 7or any corresponding similar regulation or ruling74 7d7 ,assistance ,the ,secretary of ,homeland ,security may-- 7#a7 assist executive agencies in conducting risk assessments described in subsection 7a7 and implementing mitigation requirements for information and communications technology2 and 7#b7 provide such additional guidance or tools as are necessary to support actions taken by executive agencies4 #acbg4 ,judicial review procedures 7a7 ,in general ,except as provided in subsection 7b7 and chapter #ga of this title1 and notwithstanding any other provision of law1 an action taken under section #acbc or #dgac of this title1 or any action taken by an executive agency to implement such an action1 shall not be subject to administrative review or judicial review1 including bid protests before the ,government ,accountability ,office or in any ,federal court4 7b7 ,petitions 7#a7 ,in general ,not later than #fj days after a party is notified of an exclusion or removal order under section #acbc7;c77#f7 of this title or a covered procurement action under section #dgac of this title1 the party may file a petition for judicial review in the ,united ,states ,court of ,appeals for the ,district of ,columbia ,circuit claiming that the issuance of the exclusion or removal order or covered procurement action is unlawful4 7#b7 ,standard of review ,the ,court shall hold unlawful a covered action taken under sections #acbc or #dgac of this title1 in response to a petition that the court finds to be-- 7,a7 arbitrary1 capricious1 an abuse of discretion1 or otherwise not in accordance with law2 7,b7 contrary to constitutional right1 power1 privilege1 or immunity2 7,c7 in excess of statutory jurisdiction1 authority1 or limitation1 or short of statutory right2 7,d7 lacking substantial support in the administrative record taken as a whole or in classified information submitted to the court under paragraph 7#c72 or 7,e7 not in accord with procedures required by law4 7#c7 ,exclusive jurisdiction ,the ,united ,states ,court of ,appeals for the ,district of ,columbia ,circuit shall have exclusive jurisdiction over claims arising under sections #acbc7;c77#e7 or #dgac of this title against the ,united ,states1 any ,united ,states department or agency1 or any component or official of any such department or agency1 subject to review by the ,supreme ,court of the ,united ,states under section #abed of title #bh4 7#d7 ,administrative record and procedures 7,a7 ,in general ,the procedures described in this paragraph shall apply to the review of a petition under this section4 7,b7 ,administrative record 7i7 ,filing of record ,the ,united ,states shall file with the court an administrative record1 which shall consist of the information that the appropriate official relied upon in issuing an exclusion or removal order under section #acbc7;c77#e7 or a covered procurement action under section #dgac of this title4 7ii7 ,unclassified1 nonprivileged information ,all unclassified information contained in the administrative record that is not otherwise privileged or subject to statutory protections shall be provided to the petitioner with appropriate protections for any privileged or confidential trade secrets and commercial or financial information4 7iii7 ,in camera and ex parte ,the following information may be included in the administrative record and shall be submitted only to the court ex parte and in camera3 7,i7 ,classified information4 7,,ii7 ,sensitive security information1 as defined by section #aebj4e of title #di1 ,code of ,federal ,regulations4 7,,iii7 ,privileged law enforcement information4 7,,iv7 ,information obtained or derived from any activity authorized under the ,foreign ,intelligence ,surveillance ,act of #aigh 7#ej ,u4,s4,c4 #ahja et seq471 except that1 with respect to such information1 subsections 7c71 7e71 7f71 7g71 and 7h7 of section #ajf 7#ej ,u4,s4,c4 #ahjf71 subsections 7d71 7f71 7g71 7h71 and 7i7 of section #cje 7#ej ,u4,s4,c4 #ahbe71 subsections 7c71 7e71 7f71 7g71 and 7h7 of section #dje 7#ej ,u4,s4,c4 #ahde71 and section #gjf 7#ej ,u4,s4,c4 #ahha;e7 of that ,act shall not apply4 7,v7 ,information subject to privilege or protections under any other provision of law4 7iv7 ,under seal ,any information that is part of the administrative record filed ex parte and in camera under clause 7iii71 or cited by the court in any decision1 shall be treated by the court consistent with the provisions of this subparagraph and shall remain under seal and preserved in the records of the court to be made available consistent with the above provisions in the event of further proceedings4 ,in no event shall such information be released to the petitioner or as part of the public record4 7v7 ,return ,after the expiration of the time to seek further review1 or the conclusion of further proceedings1 the court shall return the administrative record1 including any and all copies1 to the ,united ,states4 7,c7 ,exclusive remedy ,a determination by the court under this subsection shall be the exclusive judicial remedy for any claim described in this section against the ,united ,states1 any ,united ,states department or agency1 or any component or official of any such department or agency4 7,d7 ,rule of construction ,nothing in this section shall be construed as limiting1 superseding1 or preventing the invocation of1 any privileges or defenses that are otherwise available at law or in equity to protect against the disclosure of information4 7c7 ,definition ,in this section1 the term classified information-- 7#a7 has the meaning given that term in section #a7;a7 of the ,classified ,information ,procedures ,act 7#ah ,u4,s4,c4 ,app472 and 7#b7 includes-- 7,a7 any information or material that has been determined by the ,united ,states ,government pursuant to an ,executive order1 statute1 or regulation to require protection against unauthorized disclosure for reasons of national security2 and 7,b7 any restricted data1 as defined in section #aa of the ,atomic ,energy ,act of #aied 7#db ,u4,s4,c4 #bjad74 #acbh4 ,termination ,this subchapter shall terminate on the date that is #e years after the date of the enactment of the ,federal ,acquisition ,supply ,chain ,security ,act of #bjah4 4 7b7 ,clerical amendment ,the table of sections at the beginning of chapter #ac of such title is amended by adding at the end the following new items3 ,,subchapter ,,iii--,federal acquisition supply chain security ,sec4 #acba4 ,definitions4 #acbb4 ,federal ,acquisition ,security ,council establishment and membership4 #acbc4 ,functions and authorities4 #acbd4 ,strategic plan4 #acbe4 ,annual report4 #acbf4 ,requirements for executive agencies4 #acbg4 ,judicial review procedures4 #acbh4 ,termination4 4 7c7 ,effective date ,the amendments made by this section shall take effect on the date that is #ij days after the date of the enactment of this ,act and shall apply to contracts that are awarded before1 on1 or after that date4 7d7 ,implementation 7#a7 ,interim final rule ,not later than one year after the date of the enactment of this ,act1 the ,federal ,acquisition ,security ,council shall prescribe an interim final rule to implement subchapter ,,iii of chapter #ac of title #da1 ,united ,states ,code1 as added by subsection 7a74 7#b7 ,final rule ,not later than one year after prescribing the interim final rule under paragraph 7#a7 and considering public comments with respect to such interim final rule1 the ,council shall prescribe a final rule to implement subchapter ,,iii of chapter #ac of title #da1 ,united ,states ,code1 as added by subsection 7a74 7#c7 ,failure to act 7,a7 ,in general ,if the ,council does not issue a final rule in accordance with paragraph 7#b7 on or before the last day of the one-year period referred to in that paragraph1 the ,council shall submit to the appropriate congressional committees and leadership1 not later than #aj days after such last day and every #ij days thereafter until the final rule is issued1 a report explaining why the final rule was not timely issued and providing an estimate of the earliest date on which the final rule will be issued4 7,b7 ,appropriate congressional committees and leadership defined ,in this paragraph1 the term appropriate congressional committees and leadership has the meaning given that term in section #acba of title #da1 ,united ,states ,code1 as added by subsection 7a74 #bjc4 ,authorities of executive agencies relating to mitigating supply chain risks in the procurement of covered articles 7a7 ,in general ,chapter #dg of title #da1 ,united ,states ,code1 is amended by adding at the end the following new section3 #dgac4 ,authorities relating to mitigating supply chain risks in the procurement of covered articles 7a7 ,authority ,subject to subsection 7b71 the head of an executive agency may carry out a covered procurement action4 7b7 ,determination and notification ,except as authorized by subsection 7c7 to address an urgent national security interest1 the head of an executive agency may exercise the authority provided in subsection 7a7 only after-- 7#a7 obtaining a joint recommendation1 in unclassified or classified form1 from the chief acquisition officer and the chief information officer of the agency1 or officials performing similar functions in the case of executive agencies that do not have such officials1 which includes a review of any risk assessment made available by the executive agency identified under section #acbc7;a77#c7 of this title1 that there is a significant supply chain risk in a covered procurement2 7#b7 providing notice of the joint recommendation described in paragraph 7#a7 to any source named in the joint recommendation advising-- 7,a7 that a recommendation is being considered or has been obtained2 7,b7 to the extent consistent with the national security and law enforcement interests1 of information that forms the basis for the recommendation2 7,c7 that1 within #cj days after receipt of the notice1 the source may submit information and argument in opposition to the recommendation2 and 7,d7 of the procedures governing the consideration of the submission and the possible exercise of the authority provided in subsection 7a72 7#c7 making a determination in writing1 in unclassified or classified form1 after considering any information submitted by a source under paragraph 7#b7 and in consultation with the chief information security officer of the agency1 that-- 7,a7 use of the authority under subsection 7a7 is necessary to protect national security by reducing supply chain risk2 7,b7 less intrusive measures are not reasonably available to reduce such supply chain risk2 and 7,c7 the use of such authorities will apply to a single covered procurement or a class of covered procurements1 and otherwise specifies the scope of the determination2 and 7#d7 providing a classified or unclassified notice of the determination made under paragraph 7#c7 to the appropriate congressional committees and leadership that includes-- 7,a7 the joint recommendation described in paragraph 7#a72 7,b7 a summary of any risk assessment reviewed in support of the joint recommendation required by paragraph 7#a72 and 7,c7 a summary of the basis for the determination1 including a discussion of less intrusive measures that were considered and why such measures were not reasonably available to reduce supply chain risk4 7c7 ,procedures ,to address urgent national security interests ,in any case in which the head of an executive agency determines that an urgent national security interest requires the immediate exercise of the authority provided in subsection 7a71 the head of the agency-- 7#a7 may1 to the extent necessary to address such national security interest1 and subject to the conditions in paragraph 7#b7-- 7,a7 temporarily delay the notice required by subsection 7b77#b72 7,b7 make the determination required by subsection 7b77#c71 regardless of whether the notice required by subsection 7b77#b7 has been provided or whether the notified source has submitted any information in response to such notice2 7,c7 temporarily delay the notice required by subsection 7b77#d72 and 7,d7 exercise the authority provided in subsection 7a7 in accordance with such determination within #fj calendar days after the day the determination is made2 and 7#b7 shall take actions necessary to comply with all requirements of subsection 7b7 as soon as practicable after addressing the urgent national security interest1 including-- 7,a7 providing the notice required by subsection 7b77#b72 7,b7 promptly considering any information submitted by the source in response to such notice1 and making any appropriate modifications to the determination based on such information2 7,c7 providing the notice required by subsection 7b77#d71 including a description of the urgent national security interest1 and any modifications to the determination made in accordance with subparagraph 7,b72 and 7,d7 providing notice to the appropriate congressional committees and leadership within #g calendar days of the covered procurement actions taken under this section4 7d7 ,confidentiality ,the notice required by subsection 7b77#b7 shall be kept confidential until a determination with respect to a covered procurement action has been made pursuant to subsection 7b77#c74 7e7 ,delegation ,the head of an executive agency may not delegate the authority provided in subsection 7a7 or the responsibility identified in subsection 7f7 to an official below the level one level below the ,deputy ,secretary or ,principal ,deputy ,director4 7f7 ,annual review of determinations ,the head of an executive agency shall conduct an annual review of all determinations made by such head under subsection 7b7 and promptly amend any covered procurement action as appropriate4 7g7 ,regulations ,the ,federal ,acquisition ,regulatory ,council shall prescribe such regulations as may be necessary to carry out this section4 7h7 ,reports required ,not less frequently than annually1 the head of each executive agency that exercised the authority provided in subsection 7a7 or 7c7 during the preceding #ab-month period shall submit to the appropriate congressional committees and leadership a report summarizing the actions taken by the agency under this section during that #ab-month period4 7i7 ,rule of construction ,nothing in this section shall be construed to authorize the head of an executive agency to carry out a covered procurement action based solely on the fact of foreign ownership of a potential procurement source that is otherwise qualified to enter into procurement contracts with the ,federal ,government4 7j7 ,termination ,the authority provided under subsection 7a7 shall terminate on the date that is #e years after the date of the enactment of the ,federal ,acquisition ,supply ,chain ,security ,act of #bjah4 7k7 ,definitions ,in this section3 7#a7 ,appropriate congressional committees and leadership ,the term appropriate congressional committees and leadership means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs1 the ,committee on the ,judiciary1 the ,committee on ,appropriations1 the ,committee on ,armed ,services1 the ,committee on ,commerce1 ,science1 and ,transportation1 the ,select ,committee on ,intelligence1 and the majority and minority leader of the ,senate2 and 7,b7 the ,committee on ,oversight and ,government ,reform1 the ,committee on the ,judiciary1 the ,committee on ,appropriations1 the ,committee on ,homeland ,security1 the ,committee on ,armed ,services1 the ,committee on ,energy and ,commerce1 the ,permanent ,select ,committee on ,intelligence1 and the ,speaker and minority leader of the ,house of ,representatives4 7#b7 ,covered article ,the term covered article means-- 7,a7 information technology1 as defined in section #aaaja of title #dj1 including cloud computing services of all types2 7,b7 telecommunications equipment or telecommunications service1 as those terms are defined in section #c of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aec72 7,c7 the processing of information on a ,federal or non-,federal information system1 subject to the requirements of the ,controlled ,unclassified ,information program2 or 7,d7 hardware1 systems1 devices1 software1 or services that include embedded or incidental information technology4 7#c7 ,covered procurement ,the term covered procurement means-- 7,a7 a source selection for a covered article involving either a performance specification1 as provided in subsection 7a77#c77;,b7 of section #ccjf of this title1 or an evaluation factor1 as provided in subsection 7b77#a77;,a7 of such section1 relating to a supply chain risk1 or where supply chain risk considerations are included in the agency's determination of whether a source is a responsible source as defined in section #aac of this title2 7,b7 the consideration of proposals for and issuance of a task or delivery order for a covered article1 as provided in section #dajf7;d77#c7 of this title1 where the task or delivery order contract includes a contract clause establishing a requirement relating to a supply chain risk2 7,c7 any contract action involving a contract for a covered article where the contract includes a clause establishing requirements relating to a supply chain risk2 or 7,d7 any other procurement in a category of procurements determined appropriate by the ,federal ,acquisition ,regulatory ,council1 with the advice of the ,federal ,acquisition ,security ,council4 7#d7 ,covered procurement action ,the term covered procurement action means any of the following actions1 if the action takes place in the course of conducting a covered procurement3 7,a7 ,the exclusion of a source that fails to meet qualification requirements established under section #ccaa of this title for the purpose of reducing supply chain risk in the acquisition or use of covered articles4 7,b7 ,the exclusion of a source that fails to achieve an acceptable rating with regard to an evaluation factor providing for the consideration of supply chain risk in the evaluation of proposals for the award of a contract or the issuance of a task or delivery order4 7,c7 ,the determination that a source is not a responsible source as defined in section #aac of this title based on considerations of supply chain risk4 7,d7 ,the decision to withhold consent for a contractor to subcontract with a particular source or to direct a contractor to exclude a particular source from consideration for a subcontract under the contract4 7#e7 ,information and communications technology ,the term information and communications technology means-- 7,a7 information technology1 as defined in section #aaaja of title #dj2 7,b7 information systems1 as defined in section #cejb of title #dd2 and 7,c7 telecommunications equipment and telecommunications services1 as those terms are defined in section #c of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aec74 7#f7 ,supply chain risk ,the term supply chain risk means the risk that any person may sabotage1 maliciously introduce unwanted function1 extract data1 or otherwise manipulate the design1 integrity1 manufacturing1 production1 distribution1 installation1 operation1 maintenance1 disposition1 or retirement of covered articles so as to surveil1 deny1 disrupt1 or otherwise manipulate the function1 use1 or operation of the covered articles or information stored or transmitted on the covered articles4 7#g7 ,executive agency ,notwithstanding section #caja7;c77#a71 this section applies to the ,department of ,defense1 the ,coast ,guard1 and the ,national ,aeronautics and ,space ,administration4 4 7b7 ,clerical amendment ,the table of sections at the beginning of chapter #dg of such title is amended by adding at the end the following new item3 #dgac4 ,authorities relating to mitigating supply chain risks in the procurement of covered articles4 4 7c7 ,effective date ,the amendments made by this section shall take effect on the date that is #ij days after the date of the enactment of this ,act and shall apply to contracts that are awarded before1 on1 or after that date4 #bjd4 ,federal ,information ,security ,modernization ,act 7a7 ,in general ,title #dd1 ,united ,states ,code1 is amended-- 7#a7 in section #ceec7;a77#e71 by inserting and section #acbf of title #da after compliance with the requirements of this subchapter2 and 7#b7 in section #ceed7;a77#a77;,b7-- 7,a7 by inserting 1 subchapter ,,iii of chapter #ac of title #da1 after complying with the requirements of this subchapter2 7,b7 in clause 7iv71 by striking 2 and and inserting a semicolon2 and 7,c7 by adding at the end the following new clause3 7vi7 responsibilities relating to assessing and avoiding1 mitigating1 transferring1 or accepting supply chain risks under section #acbf of title #da1 and complying with exclusion and removal orders issued under section #acbc of such title2 and 4 7b7 ,rule of construction ,nothing in this title shall be construed to alter or impede any authority or responsibility under section #ceec of title #dd1 ,united ,states ,code4 #bje4 ,effective date ,this title shall take effect on the date that is #ij days after the date of the enactment of this ,act4 ,passed the ,house of ,representatives ,december #ai1 #bjah4,karen ,l4 ,haas1,clerk4