#aaeth ,,congress #b;d ,session ,s4 #cjhe ,,an ,,act ,to establish a ,federal ,acquisition ,security ,council and to provide executive agencies with authorities relating to mitigating supply chain risks in the procurement of information technology1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,federal ,acquisition ,supply ,chain ,security ,act of #bjah4 #b4 ,federal acquisition supply chain security 7a7 ,in general ,chapter #ac of title #da1 ,united ,states ,code1 is amended by adding at the end the following new subchapter3 ,,iii ,federal acquisition supply chain security #acba4 ,definitions ,in this subchapter3 7#a7 ,appropriate congressional committees and leadership ,the term appropriate congressional committees and leadership means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs1 the ,committee on the ,judiciary1 the ,committee on ,appropriations1 the ,committee on ,armed ,services1 the ,committee on ,commerce1 ,science1 and ,transportation1 the ,select ,committee on ,intelligence1 and the majority and minority leader of the ,senate2 and 7,b7 the ,committee on ,oversight and ,government ,reform1 the ,committee on the ,judiciary1 the ,committee on ,appropriations1 the ,committee on ,homeland ,security1 the ,committee on ,armed ,services1 the ,committee on ,energy and ,commerce1 the ,permanent ,select ,committee on ,intelligence1 and the ,speaker and minority leader of the ,house of ,representatives4 7#b7 ,council ,the term ,council means the ,federal ,acquisition ,security ,council established under section #acbb7;a7 of this title4 7#c7 ,covered article ,the term covered article has the meaning given that term in section #dgac of this title4 7#d7 ,covered procurement action ,the term covered procurement action has the meaning given that term in section #dgac of this title4 7#e7 ,information and communications technology ,the term information and communications technology has the meaning given that term in section #dgac of this title4 7#f7 ,intelligence community ,the term intelligence community has the meaning given that term in section #c7d7 of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjjc7d774 7#g7 ,national security system ,the term national security system has the meaning given that term in section #ceeb of title #dd4 7#h7 ,supply chain risk ,the term supply chain risk has the meaning given that term in section #dgac of this title4 #acbb4 ,federal ,acquisition ,security ,council establishment and membership 7a7 ,establishment ,there is established in the executive branch a ,federal ,acquisition ,security ,council4 7b7 ,membership 7#a7 ,in general ,the following agencies shall be represented on the ,council3 7,a7 ,the ,office of ,management and ,budget4 7,b7 ,the ,general ,services ,administration4 7,c7 ,the ,department of ,homeland ,security1 including the ,cybersecurity and ,infrastructure ,security ,agency4 7,d7 ,the ,office of the ,director of ,national ,intelligence1 including the ,national ,counterintelligence and ,security ,center4 7,e7 ,the ,department of ,justice1 including the ,federal ,bureau of ,investigation4 7,f7 ,the ,department of ,defense1 including the ,national ,security ,agency4 7,g7 ,the ,department of ,commerce1 including the ,national ,institute of ,standards and ,technology4 7,h7 ,such other executive agencies as determined by the ,chairperson of the ,council4 7#b7 ,lead representatives 7,a7 ,designation 7i7 ,in general ,not later than #de days after the date of the enactment of the ,federal ,acquisition ,supply ,chain ,security ,act of #bjah1 the head of each agency represented on the ,council shall designate a representative of that agency as the lead representative of the agency on the ,council4 7ii7 ,requirements ,the representative of an agency designated under clause 7i7 shall have expertise in supply chain risk management1 acquisitions1 or information and communications technology4 7,b7 ,functions ,the lead representative of an agency designated under subparagraph 7,a7 shall ensure that appropriate personnel1 including leadership and subject matter experts of the agency1 are aware of the business of the ,council4 7c7 ,chairperson 7#a7 ,designation ,not later than #de days after the date of the enactment of the ,federal ,acquisition ,supply ,chain ,security ,act of #bjah1 the ,director of the ,office of ,management and ,budget shall designate a senior-level official from the ,office of ,management and ,budget to serve as the ,chairperson of the ,council4 7#b7 ,functions ,the ,chairperson shall perform functions that include-- 7,a7 subject to subsection 7d71 developing a schedule for meetings of the ,council2 7,b7 designating executive agencies to be represented on the ,council under subsection 7b77#a77;,h72 7,c7 in consultation with the lead representative of each agency represented on the ,council1 developing a charter for the ,council2 and 7,d7 not later than #g days after completion of the charter1 submitting the charter to the appropriate congressional committees and leadership4 7d7 ,meetings ,the ,council shall meet not later than #fj days after the date of the enactment of the ,federal ,acquisition ,supply ,chain ,security ,act of #bjah and not less frequently than quarterly thereafter4 #acbc4 ,functions and authorities 7a7 ,in general ,the ,council shall perform functions that include the following3 7#a7 ,identifying and recommending development by the ,national ,institute of ,standards and ,technology of supply chain risk management standards1 guidelines1 and practices for executive agencies to use when assessing and developing mitigation strategies to address supply chain risks1 particularly in the acquisition and use of covered articles under section #acbf7;a7 of this title4 7#b7 ,identifying or developing criteria for sharing information with executive agencies1 other ,federal entities1 and non-,federal entities with respect to supply chain risk1 including information related to the exercise of authorities provided under this section and sections #acbf and #dgac of this title4 ,at a minimum1 such criteria shall address-- 7,a7 the content to be shared2 7,b7 the circumstances under which sharing is mandated or voluntary2 and 7,c7 the circumstances under which it is appropriate for an executive agency to rely on information made available through such sharing in exercising the responsibilities and authorities provided under this section and section #dgac of this title4 7#c7 ,identifying an appropriate executive agency to-- 7,a7 accept information submitted by executive agencies based on the criteria established under paragraph 7#b72 7,b7 facilitate the sharing of information received under subparagraph 7,a7 to support supply chain risk analyses under section #acbf of this title1 recommendations under this section1 and covered procurement actions under section #dgac of this title2 7,c7 share with the ,council information regarding covered procurement actions by executive agencies taken under section #dgac of this title2 and 7,d7 inform the ,council of orders issued under this section4 7#d7 ,identifying1 as appropriate1 executive agencies to provide-- 7,a7 shared services1 such as support for making risk assessments1 validation of products that may be suitable for acquisition1 and mitigation activities2 and 7,b7 common contract solutions to support supply chain risk management activities1 such as subscription services or machine-learning-enhanced analysis applications to support informed decisionmaking4 7#e7 ,identifying and issuing guidance on additional steps that may be necessary to address supply chain risks arising in the course of executive agencies providing shared services1 common contract solutions1 acquisitions vehicles1 or assisted acquisitions4 7#f7 ,engaging with the private sector and other nongovernmental stakeholders in performing the functions described in paragraphs 7#a7 and 7#b7 and on issues relating to the management of supply chain risks posed by the acquisition of covered articles4 7#g7 ,carrying out such other actions1 as determined by the ,council1 that are necessary to reduce the supply chain risks posed by acquisitions and use of covered articles4 7b7 ,program office and committees ,the ,council may establish a program office and any committees1 working groups1 or other constituent bodies the ,council deems appropriate1 in its sole and unreviewable discretion1 to carry out its functions4 7c7 ,authority for exclusion or removal orders 7#a7 ,criteria ,to reduce supply chain risk1 the ,council shall establish criteria and procedures for-- 7,a7 recommending orders applicable to executive agencies requiring the exclusion of sources or covered articles from executive agency procurement actions 7in this section referred to as exclusion orders72 7,b7 recommending orders applicable to executive agencies requiring the removal of covered articles from executive agency information systems 7in this section referred to as removal orders72 7,c7 requesting and approving exceptions to an issued exclusion or removal order when warranted by circumstances1 including alternative mitigation actions or other findings relating to the national interest1 including national security reviews1 national security investigations1 or national security agreements2 and 7,d7 ensuring that recommended orders do not conflict with standards and guidelines issued under section #aacca of title #dj and that the ,council consults with the ,director of the ,national ,institute of ,standards and ,technology regarding any recommended orders that would implement standards and guidelines developed by the ,national ,institute of ,standards and ,technology4 7#b7 ,recommendations ,the ,council shall use the criteria established under paragraph 7#a71 information made available under subsection 7a77#c71 and any other information the ,council determines appropriate to issue recommendations1 for application to executive agencies or any subset thereof1 regarding the exclusion of sources or covered articles from any executive agency procurement action1 including source selection and consent for a contractor to subcontract1 or the removal of covered articles from executive agency information systems4 ,such recommendations shall include-- 7,a7 information necessary to positively identify the sources or covered articles recommended for exclusion or removal2 7,b7 information regarding the scope and applicability of the recommended exclusion or removal order2 7,c7 a summary of any risk assessment reviewed or conducted in support of the recommended exclusion or removal order2 7,d7 a summary of the basis for the recommendation1 including a discussion of less intrusive measures that were considered and why such measures were not reasonably available to reduce supply chain risk2 7,e7 a description of the actions necessary to implement the recommended exclusion or removal order2 and 7,f7 where practicable1 in the ,council's sole and unreviewable discretion1 a description of mitigation steps that could be taken by the source that may result in the ,council rescinding a recommendation4 7#c7 ,notice of recommendation and review ,a notice of the ,council's recommendation under paragraph 7#b7 shall be issued to any source named in the recommendation advising-- 7,a7 that a recommendation has been made2 7,b7 of the criteria the ,council relied upon under paragraph 7#a7 and1 to the extent consistent with national security and law enforcement interests1 of information that forms the basis for the recommendation2 7,c7 that1 within #cj days after receipt of notice1 the source may submit information and argument in opposition to the recommendation2 7,d7 of the procedures governing the review and possible issuance of an exclusion or removal order pursuant to paragraph 7#e72 and 7,e7 where practicable1 in the ,council's sole and unreviewable discretion1 a description of mitigation steps that could be taken by the source that may result in the ,council rescinding the recommendation4 7#d7 ,confidentiality ,any notice issued to a source under paragraph 7#c7 shall be kept confidential until-- 7,a7 an exclusion or removal order is issued pursuant to paragraph 7#e72 and 7,b7 the source has been notified pursuant to paragraph 7#f74 7#e7 ,exclusion and removal orders 7,a7 ,order issuance ,recommendations of the ,council under paragraph 7#b71 together with any information submitted by a source under paragraph 7#c7 related to such a recommendation1 shall be reviewed by the following officials1 who may issue exclusion and removal orders based upon such recommendations3 7i7 ,the ,secretary of ,homeland ,security1 for exclusion and removal orders applicable to civilian agencies1 to the extent not covered by clause 7ii7 or 7iii74 7ii7 ,the ,secretary of ,defense1 for exclusion and removal orders applicable to the ,department of ,defense and national security systems other than sensitive compartmented information systems4 7iii7 ,the ,director of ,national ,intelligence1 for exclusion and removal orders applicable to the intelligence community and sensitive compartmented information systems1 to the extent not covered by clause 7ii74 7,b7 ,delegation ,the officials identified in subparagraph 7,a7 may not delegate any authority under this subparagraph to an official below the level one level below the ,deputy ,secretary or ,principal ,deputy ,director1 except that the ,secretary of ,defense may delegate authority for removal orders to the ,commander of the ,united ,states ,cyber ,command1 who may not redelegate such authority to an official below the level one level below the ,deputy ,commander4 7,c7 ,facilitation of exclusion orders ,if officials identified under this paragraph from the ,department of ,homeland ,security1 the ,department of ,defense1 and the ,office of the ,director of ,national ,intelligence issue orders collectively resulting in a governmentwide exclusion1 the ,administrator for ,general ,services and officials at other executive agencies responsible for management of the ,federal ,supply ,schedules1 governmentwide acquisition contracts1 and multi-agency contracts shall help facilitate implementation of such orders by removing the covered articles or sources identified in the orders from such contracts4 7,d7 ,review of exclusion and removal orders ,the officials identified under this paragraph shall review all exclusion and removal orders issued under subparagraph 7,a7 not less frequently than annually pursuant to procedures established by the ,council4 7,e7 ,rescission ,orders issued pursuant to subparagraph 7,a7 may be rescinded by an authorized official from the relevant issuing agency4 7#f7 ,notifications ,upon issuance of an exclusion or removal order pursuant to paragraph 7#e77;,a71 the official identified under that paragraph who issued the order shall-- 7,a7 notify any source named in the order of-- 7i7 the exclusion or removal order2 and 7ii7 to the extent consistent with national security and law enforcement interests1 information that forms the basis for the order2 7,b7 provide classified or unclassified notice of the exclusion or removal order to the appropriate congressional committees and leadership2 and 7,c7 provide the exclusion or removal order to the agency identified in subsection 7a77#c74 7#g7 ,compliance ,executive agencies shall comply with exclusion and removal orders issued pursuant to paragraph 7#e74 7d7 ,authority ,to request information ,the ,council may request such information from executive agencies as is necessary for the ,council to carry out its functions4 7e7 ,relationship to other councils ,the ,council shall consult and coordinate1 as appropriate1 with other relevant councils and interagency committees1 including the ,chief ,information ,officers ,council1 the ,chief ,acquisition ,officers ,council1 the ,federal ,acquisition ,regulatory ,council1 and the ,committee on ,foreign ,investment in the ,united ,states1 with respect to supply chain risks posed by the acquisition and use of covered articles4 7f7 ,rules of construction ,nothing in this section shall be construed-- 7#a7 to limit the authority of the ,office of ,federal ,procurement ,policy to carry out the responsibilities of that ,office under any other provision of law2 or 7#b7 to authorize the issuance of an exclusion or removal order based solely on the fact of foreign ownership of a potential procurement source that is otherwise qualified to enter into procurement contracts with the ,federal ,government4 #acbd4 ,strategic plan 7a7 ,in general ,not later than #ahj days after the date of the enactment of the ,federal ,acquisition ,supply ,chain ,security ,act of #bjah1 the ,council shall develop a strategic plan for addressing supply chain risks posed by the acquisition of covered articles and for managing such risks1 that includes-- 7#a7 the criteria and processes required under section #acbc7;a7 of this title1 including a threshold and requirements for sharing relevant information about such risks with all executive agencies and1 as appropriate1 with other ,federal entities and non-,federal entities2 7#b7 an identification of existing authorities for addressing such risks2 7#c7 an identification and promulgation of best practices and procedures and available resources for executive agencies to assess and mitigate such risks2 7#d7 recommendations for any legislative1 regulatory1 or other policy changes to improve efforts to address such risks2 7#e7 recommendations for any legislative1 regulatory1 or other policy changes to incentivize the adoption of best practices for supply chain risk management by the private sector2 7#f7 an evaluation of the effect of implementing new policies or procedures on existing contracts and the procurement process2 7#g7 a plan for engaging with executive agencies1 the private sector1 and other nongovernmental stakeholders to address such risks2 7#h7 a plan for identification1 assessment1 mitigation1 and vetting of supply chain risks from existing and prospective information and communications technology made available by executive agencies to other executive agencies through common contract solutions1 shared services1 acquisition vehicles1 or other assisted acquisition services2 and 7#i7 plans to strengthen the capacity of all executive agencies to conduct assessments of-- 7,a7 the supply chain risk posed by the acquisition of covered articles2 and 7,b7 compliance with the requirements of this subchapter4 7b7 ,submission to congress ,not later than #g calendar days after completion of the strategic plan required by subsection 7a71 the ,chairperson of the ,council shall submit the plan to the appropriate congressional committees and leadership4 #acbe4 ,annual report ,not later than ,december #ca of each year1 the ,chairperson of the ,council shall submit to the appropriate congressional committees and leadership a report on the activities of the ,council during the preceding #ab-month period4 #acbf4 ,requirements for executive agencies 7a7 ,in general ,the head of each executive agency shall be responsible for-- 7#a7 assessing the supply chain risk posed by the acquisition and use of covered articles and avoiding1 mitigating1 accepting1 or transferring that risk1 as appropriate and consistent with the standards1 guidelines1 and practices identified by the ,council under section #acbc7;a77#a72 and 7#b7 prioritizing supply chain risk assessments conducted under paragraph 7#a7 based on the criticality of the mission1 system1 component1 service1 or asset4 7b7 ,inclusions ,the responsibility for assessing supply chain risk described in subsection 7a7 includes-- 7#a7 developing an overall supply chain risk management strategy and implementation plan and policies and processes to guide and govern supply chain risk management activities2 7#b7 integrating supply chain risk management practices throughout the lifecycle of the system1 component1 service1 or asset2 7#c7 limiting1 avoiding1 mitigating1 accepting1 or transferring any identified risk2 7#d7 sharing relevant information with other executive agencies1 as determined appropriate by the ,council in a manner consistent with section #acbc7;a7 of this title2 7#e7 reporting on progress and effectiveness of the agency's supply chain risk management consistent with guidance issued by the ,office of ,management and ,budget and the ,council2 and 7#f7 ensuring that all relevant information1 including classified information1 with respect to acquisitions of covered articles that may pose a supply chain risk1 consistent with section #acbc7;a7 of this title1 is incorporated into existing processes of the agency for conducting assessments described in subsection 7a7 and ongoing management of acquisition programs1 including any identification1 investigation1 mitigation1 or remediation needs4 7c7 ,interagency acquisitions 7#a7 ,in general ,except as provided in paragraph 7#b71 in the case of an interagency acquisition1 subsection 7a7 shall be carried out by the head of the executive agency whose funds are being used to procure the covered article4 7#b7 ,assisted acquisitions ,in an assisted acquisition1 the parties to the acquisition shall determine1 as part of the interagency agreement governing the acquisition1 which agency is responsible for carrying out subsection 7a74 7#c7 ,definitions ,in this subsection1 the terms assisted acquisition and interagency acquisition have the meanings given those terms in section #b4aja of title #dh1 ,code of ,federal ,regulations 7or any corresponding similar regulation or ruling74 7d7 ,assistance ,the ,secretary of ,homeland ,security may-- 7#a7 assist executive agencies in conducting risk assessments described in subsection 7a7 and implementing mitigation requirements for information and communications technology2 and 7#b7 provide such additional guidance or tools as are necessary to support actions taken by executive agencies4 #acbg4 ,judicial review procedures 7a7 ,in general ,except as provided in subsection 7b7 and chapter #ga of this title1 and notwithstanding any other provision of law1 an action taken under section #acbc or #dgac of this title1 or any action taken by an executive agency to implement such an action1 shall not be subject to administrative review or judicial review1 including bid protests before the ,government ,accountability ,office or in any ,federal court4 7b7 ,petitions 7#a7 ,in general ,not later than #fj days after a party is notified of an exclusion or removal order under section #acbc7;c77#f7 of this title or a covered procurement action under section #dgac of this title1 the party may file a petition for judicial review in the ,united ,states ,court of ,appeals for the ,district of ,columbia ,circuit claiming that the issuance of the exclusion or removal order or covered procurement action is unlawful4 7#b7 ,standard of review ,the ,court shall hold unlawful a covered action taken under sections #acbc or #dgac of this title1 in response to a petition that the court finds to be-- 7,a7 arbitrary1 capricious1 an abuse of discretion1 or otherwise not in accordance with law2 7,b7 contrary to constitutional right1 power1 privilege1 or immunity2 7,c7 in excess of statutory jurisdiction1 authority1 or limitation1 or short of statutory right2 7,d7 lacking substantial support in the administrative record taken as a whole or in classified information submitted to the court under paragraph 7#c72 or 7,e7 not in accord with procedures required by law4 7#c7 ,exclusive jurisdiction ,the ,united ,states ,court of ,appeals for the ,district of ,columbia ,circuit shall have exclusive jurisdiction over claims arising under sections #acbc7;c77#e7 or #dgac of this title against the ,united ,states1 any ,united ,states department or agency1 or any component or official of any such department or agency1 subject to review by the ,supreme ,court of the ,united ,states under section #abed of title #bh4 7#d7 ,administrative record and procedures 7,a7 ,in general ,the procedures described in this paragraph shall apply to the review of a petition under this section4 7,b7 ,administrative record 7i7 ,filing of record ,the ,united ,states shall file with the court an administrative record1 which shall consist of the information that the appropriate official relied upon in issuing an exclusion or removal order under section #acbc7;c77#e7 or a covered procurement action under section #dgac of this title4 7ii7 ,unclassified1 nonprivileged information ,all unclassified information contained in the administrative record that is not otherwise privileged or subject to statutory protections shall be provided to the petitioner with appropriate protections for any privileged or confidential trade secrets and commercial or financial information4 7iii7 ,in camera and ex parte ,the following information may be included in the administrative record and shall be submitted only to the court ex parte and in camera3 7,i7 ,classified information4 7,,ii7 ,sensitive security information1 as defined by section #aebj4e of title #di1 ,code of ,federal ,regulations4 7,,iii7 ,privileged law enforcement information4 7,,iv7 ,information obtained or derived from any activity authorized under the ,foreign ,intelligence ,surveillance ,act of #aigh 7#ej ,u4,s4,c4 #ahja et seq471 except that1 with respect to such information1 subsections 7c71 7e71 7f71 7g71 and 7h7 of section #ajf 7#ej ,u4,s4,c4 #ahjf71 subsections 7d71 7f71 7g71 7h71 and 7i7 of section #cje 7#ej ,u4,s4,c4 #ahbe71 subsections 7c71 7e71 7f71 7g71 and 7h7 of section #dje 7#ej ,u4,s4,c4 #ahde71 and section #gjf 7#ej ,u4,s4,c4 #ahha;e7 of that ,act shall not apply4 7,v7 ,information subject to privilege or protections under any other provision of law4 7iv7 ,under seal ,any information that is part of the administrative record filed ex parte and in camera under clause 7iii71 or cited by the court in any decision1 shall be treated by the court consistent with the provisions of this subparagraph and shall remain under seal and preserved in the records of the court to be made available consistent with the above provisions in the event of further proceedings4 ,in no event shall such information be released to the petitioner or as part of the public record4 7v7 ,return ,after the expiration of the time to seek further review1 or the conclusion of further proceedings1 the court shall return the administrative record1 including any and all copies1 to the ,united ,states4 7,c7 ,exclusive remedy ,a determination by the court under this subsection shall be the exclusive judicial remedy for any claim described in this section against the ,united ,states1 any ,united ,states department or agency1 or any component or official of any such department or agency4 7,d7 ,rule of construction ,nothing in this section shall be construed as limiting1 superseding1 or preventing the invocation of1 any privileges or defenses that are otherwise available at law or in equity to protect against the disclosure of information4 7c7 ,definition ,in this section1 the term classified information-- 7#a7 has the meaning given that term in section #a7;a7 of the ,classified ,information ,procedures ,act 7#ah ,u4,s4,c4 ,app472 and 7#b7 includes-- 7,a7 any information or material that has been determined by the ,united ,states ,government pursuant to an ,executive order1 statute1 or regulation to require protection against unauthorized disclosure for reasons of national security2 and 7,b7 any restricted data1 as defined in section #aa of the ,atomic ,energy ,act of #aied 7#db ,u4,s4,c4 #bjad74 #acbh4 ,termination ,this subchapter shall terminate on the date that is #e years after the date of the enactment of the ,federal ,acquisition ,supply ,chain ,security ,act of #bjah4 4 7b7 ,clerical amendment ,the table of sections at the beginning of chapter #ac of such title is amended by adding at the end the following new items3 ,,subchapter ,,iii--,federal acquisition supply chain security,sec4 #acba4 ,definitions4#acbb4 ,federal ,acquisition ,security ,council establishment and membership4#acbc4 ,functions and authorities4#acbd4 ,strategic plan4#acbe4 ,annual report4#acbf4 ,requirements for executive agencies4#acbg4 ,judicial review procedures4#acbh4 ,termination4 4 7c7 ,effective date ,the amendments made by this section shall take effect on the date that is #ij days after the date of the enactment of this ,act and shall apply to contracts that are awarded before1 on1 or after that date4 7d7 ,implementation 7#a7 ,interim final rule ,not later than one year after the date of the enactment of this ,act1 the ,federal ,acquisition ,security ,council shall prescribe an interim final rule to implement subchapter ,,iii of chapter #ac of title #da1 ,united ,states ,code1 as added by subsection 7a74 7#b7 ,final rule ,not later than one year after prescribing the interim final rule under paragraph 7#a7 and considering public comments with respect to such interim final rule1 the ,council shall prescribe a final rule to implement subchapter ,,iii of chapter #ac of title #da1 ,united ,states ,code1 as added by subsection 7a74 7#c7 ,failure to act 7,a7 ,in general ,if the ,council does not issue a final rule in accordance with paragraph 7#b7 on or before the last day of the #a-year period referred to in that paragraph1 the ,council shall submit to the appropriate congressional committees and leadership1 not later than #aj days after such last day and every #ij days thereafter until the final rule is issued1 a report explaining why the final rule was not timely issued and providing an estimate of the earliest date on which the final rule will be issued4 7,b7 ,appropriate congressional committees and leadership defined ,in this paragraph1 the term appropriate congressional committees and leadership has the meaning given that term in section #acba of title #da1 ,united ,states ,code1 as added by subsection 7a74 #c4 ,authorities of executive agencies relating to mitigating supply chain risks in the procurement of covered articles 7a7 ,in general ,chapter #dg of title #da1 ,united ,states ,code1 is amended by adding at the end the following new section3 #dgac4 ,authorities relating to mitigating supply chain risks in the procurement of covered articles 7a7 ,authority ,subject to subsection 7b71 the head of an executive agency may carry out a covered procurement action4 7b7 ,determination and notification ,except as authorized by subsection 7c7 to address an urgent national security interest1 the head of an executive agency may exercise the authority provided in subsection 7a7 only after-- 7#a7 obtaining a joint recommendation1 in unclassified or classified form1 from the chief acquisition officer and the chief information officer of the agency1 or officials performing similar functions in the case of executive agencies that do not have such officials1 which includes a review of any risk assessment made available by the executive agency identified under section #acbc7;a77#c7 of this title1 that there is a significant supply chain risk in a covered procurement2 7#b7 providing notice of the joint recommendation described in paragraph 7#a7 to any source named in the joint recommendation advising-- 7,a7 that a recommendation is being considered or has been obtained2 7,b7 to the extent consistent with the national security and law enforcement interests1 of information that forms the basis for the recommendation2 7,c7 that1 within #cj days after receipt of the notice1 the source may submit information and argument in opposition to the recommendation2 and 7,d7 of the procedures governing the consideration of the submission and the possible exercise of the authority provided in subsection 7a72 7#c7 making a determination in writing1 in unclassified or classified form1 after considering any information submitted by a source under paragraph 7#b7 and in consultation with the chief information security officer of the agency1 that-- 7,a7 use of the authority under subsection 7a7 is necessary to protect national security by reducing supply chain risk2 7,b7 less intrusive measures are not reasonably available to reduce such supply chain risk2 and 7,c7 the use of such authorities will apply to a single covered procurement or a class of covered procurements1 and otherwise specifies the scope of the determination2 and 7#d7 providing a classified or unclassified notice of the determination made under paragraph 7#c7 to the appropriate congressional committees and leadership that includes-- 7,a7 the joint recommendation described in paragraph 7#a72 7,b7 a summary of any risk assessment reviewed in support of the joint recommendation required by paragraph 7#a72 and 7,c7 a summary of the basis for the determination1 including a discussion of less intrusive measures that were considered and why such measures were not reasonably available to reduce supply chain risk4 7c7 ,procedures ,to address urgent national security interests ,in any case in which the head of an executive agency determines that an urgent national security interest requires the immediate exercise of the authority provided in subsection 7a71 the head of the agency-- 7#a7 may1 to the extent necessary to address such national security interest1 and subject to the conditions in paragraph 7#b7-- 7,a7 temporarily delay the notice required by subsection 7b77#b72 7,b7 make the determination required by subsection 7b77#c71 regardless of whether the notice required by subsection 7b77#b7 has been provided or whether the notified source has submitted any information in response to such notice2 7,c7 temporarily delay the notice required by subsection 7b77#d72 and 7,d7 exercise the authority provided in subsection 7a7 in accordance with such determination within #fj calendar days after the day the determination is made2 and 7#b7 shall take actions necessary to comply with all requirements of subsection 7b7 as soon as practicable after addressing the urgent national security interest1 including-- 7,a7 providing the notice required by subsection 7b77#b72 7,b7 promptly considering any information submitted by the source in response to such notice1 and making any appropriate modifications to the determination based on such information2 7,c7 providing the notice required by subsection 7b77#d71 including a description of the urgent national security interest1 and any modifications to the determination made in accordance with subparagraph 7,b72 and 7,d7 providing notice to the appropriate congressional committees and leadership within #g calendar days of the covered procurement actions taken under this section4 7d7 ,confidentiality ,the notice required by subsection 7b77#b7 shall be kept confidential until a determination with respect to a covered procurement action has been made pursuant to subsection 7b77#c74 7e7 ,delegation ,the head of an executive agency may not delegate the authority provided in subsection 7a7 or the responsibility identified in subsection 7g7 to an official below the level one level below the ,deputy ,secretary or ,principal ,deputy ,director4 7f7 ,annual review of determinations ,the head of an executive agency shall conduct an annual review of all determinations made by such head under subsection 7b7 and promptly amend any covered procurement action as appropriate4 7g7 ,regulations ,the ,federal ,acquisition ,regulatory ,council shall prescribe such regulations as may be necessary to carry out this section4 7h7 ,reports required ,not less frequently than annually1 the head of each executive agency that exercised the authority provided in subsection 7a7 or 7c7 during the preceding #ab-month period shall submit to the appropriate congressional committees and leadership a report summarizing the actions taken by the agency under this section during that #ab-month period4 7i7 ,rule of construction ,nothing in this section shall be construed to authorize the head of an executive agency to carry out a covered procurement action based solely on the fact of foreign ownership of a potential procurement source that is otherwise qualified to enter into procurement contracts with the ,federal ,government4 7j7 ,termination ,the authority provided under subsection 7a7 shall terminate on the date that is #e years after the date of the enactment of the ,federal ,acquisition ,supply ,chain ,security ,act of #bjah4 7k7 ,definitions ,in this section3 7#a7 ,appropriate congressional committees and leadership ,the term appropriate congressional committees and leadership means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs1 the ,committee on the ,judiciary1 the ,committee on ,appropriations1 the ,committee on ,armed ,services1 the ,committee on ,commerce1 ,science1 and ,transportation1 the ,select ,committee on ,intelligence1 and the majority and minority leader of the ,senate2 and 7,b7 the ,committee on ,oversight and ,government ,reform1 the ,committee on the ,judiciary1 the ,committee on ,appropriations1 the ,committee on ,homeland ,security1 the ,committee on ,armed ,services1 the ,committee on ,energy and ,commerce1 the ,permanent ,select ,committee on ,intelligence1 and the ,speaker and minority leader of the ,house of ,representatives4 7#b7 ,covered article ,the term covered article means-- 7,a7 information technology1 as defined in section #aaaja of title #dj1 including cloud computing services of all types2 7,b7 telecommunications equipment or telecommunications service1 as those terms are defined in section #c of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aec72 7,c7 the processing of information on a ,federal or non-,federal information system1 subject to the requirements of the ,controlled ,unclassified ,information program2 or 7,d7 hardware1 systems1 devices1 software1 or services that include embedded or incidental information technology4 7#c7 ,covered procurement ,the term covered procurement means-- 7,a7 a source selection for a covered article involving either a performance specification1 as provided in subsection 7a77#c77;,b7 of section #ccjf of this title1 or an evaluation factor1 as provided in subsection 7b77#a77;,a7 of such section1 relating to a supply chain risk1 or where supply chain risk considerations are included in the agency's determination of whether a source is a responsible source as defined in section #aac of this title2 7,b7 the consideration of proposals for and issuance of a task or delivery order for a covered article1 as provided in section #dajf7;d77#c7 of this title1 where the task or delivery order contract includes a contract clause establishing a requirement relating to a supply chain risk2 7,c7 any contract action involving a contract for a covered article where the contract includes a clause establishing requirements relating to a supply chain risk2 or 7,d7 any other procurement in a category of procurements determined appropriate by the ,federal ,acquisition ,regulatory ,council1 with the advice of the ,federal ,acquisition ,security ,council4 7#d7 ,covered procurement action ,the term covered procurement action means any of the following actions1 if the action takes place in the course of conducting a covered procurement3 7,a7 ,the exclusion of a source that fails to meet qualification requirements established under section #ccaa of this title for the purpose of reducing supply chain risk in the acquisition or use of covered articles4 7,b7 ,the exclusion of a source that fails to achieve an acceptable rating with regard to an evaluation factor providing for the consideration of supply chain risk in the evaluation of proposals for the award of a contract or the issuance of a task or delivery order4 7,c7 ,the determination that a source is not a responsible source as defined in section #aac of this title based on considerations of supply chain risk4 7,d7 ,the decision to withhold consent for a contractor to subcontract with a particular source or to direct a contractor to exclude a particular source from consideration for a subcontract under the contract4 7#e7 ,information and communications technology ,the term information and communications technology means-- 7,a7 information technology1 as defined in section #aaaja of title #dj2 7,b7 information systems1 as defined in section #cejb of title #dd2 and 7,c7 telecommunications equipment and telecommunications services1 as those terms are defined in section #c of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aec74 7#f7 ,supply chain risk ,the term supply chain risk means the risk that any person may sabotage1 maliciously introduce unwanted function1 extract data1 or otherwise manipulate the design1 integrity1 manufacturing1 production1 distribution1 installation1 operation1 maintenance1 disposition1 or retirement of covered articles so as to surveil1 deny1 disrupt1 or otherwise manipulate the function1 use1 or operation of the covered articles or information stored or transmitted on the covered articles4 7#g7 ,executive agency ,notwithstanding section #caja7;c77#a71 this section applies to the ,department of ,defense1 the ,coast ,guard1 and the ,national ,aeronautics and ,space ,administration4 4 7b7 ,clerical amendment ,the table of sections at the beginning of chapter #dg of such title is amended by adding at the end the following new item3 ,sec4 #dgac4 ,authorities relating to mitigating supply chain risks in the procurement of covered articles4 4 7c7 ,effective date ,the amendments made by this section shall take effect on the date that is #ij days after the date of the enactment of this ,act and shall apply to contracts that are awarded before1 on1 or after that date4 #d4 ,federal ,information ,security ,modernization ,act 7a7 ,in general ,title #dd1 ,united ,states ,code1 is amended-- 7#a7 in section #ceec7;a77#e71 by inserting and section #acbf of title #da after compliance with the requirements of this subchapter2 and 7#b7 in section #ceed7;a77#a77;,b7-- 7,a7 by inserting 1 subchapter ,,iii of chapter #ac of title #da1 after complying with the requirements of this subchapter2 7,b7 in clause 7iv71 by striking 2 and and inserting a semicolon2 and 7,c7 by adding at the end the following new clause3 7vi7 responsibilities relating to assessing and avoiding1 mitigating1 transferring1 or accepting supply chain risks under section #acbf of title #da1 and complying with exclusion and removal orders issued under section #acbc of such title2 and 4 7b7 ,rule of construction ,nothing in this ,act shall be construed to alter or impede any authority or responsibility under section #ceec of title #dd1 ,united ,states ,code4 #e4 ,effective date ,this ,act shall take effect on the date that is #ij days after the date of the enactment of this ,act4 ,passed the ,senate ,december #ah1 #bjah4,secretary