,,ii #aaeth ,,congress #b;d ,session ,s4 #cjhe ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,june #ai1 #bjah ,mrs4 ,mc,caskill 7for herself and ,mr4 ,lankford7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to establish a ,federal ,acquisition ,security ,council and to provide executive agencies with authorities relating to mitigating supply chain risks in the procurement of information technology1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,federal ,acquisition ,supply ,chain ,security ,act of #bjah4 #b4 ,federal ,acquisition ,security ,council 7a7 ,in general ,chapter #ac of title #da1 ,united ,states ,code1 is amended by adding at the end the following new subchapter3 ,,iii ,federal ,acquisition ,security ,council #acba4 ,definitions ,in this subchapter3 7#a7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs1 the ,committee on the ,judiciary1 the ,committee on ,armed ,services1 the ,committee on ,appropriations1 the ,select ,committee on ,intelligence1 and the majority and minority leader of the ,senate2 and 7,b7 the ,committee on ,oversight and ,government ,reform1 the ,committee on the ,judiciary1 the ,committee on ,armed ,services1 the ,committee on ,appropriations1 the ,committee on ,homeland ,security1 the ,permanent ,select ,committee on ,intelligence1 and the ,speaker and minority leader of the ,house of ,representatives4 7#b7 ,council ,the term ,council means the ,federal ,acquisition ,security ,council established under section #acbb7;a74 7#c7 ,information technology ,the term information technology has the meaning given that term in section #aaaja of title #dj4 7#d7 ,supply chain risk ,the term supply chain risk has the meaning given that term in section #dgac4 #acbb4 ,establishment and membership 7a7 ,establishment ,there is established in the executive branch a ,federal ,acquisition ,security ,council4 7b7 ,membership 7#a7 ,in general ,the following agencies shall be represented on the ,council3 7,a7 ,the ,office of ,management and ,budget4 7,b7 ,the ,general ,services ,administration4 7,c7 ,the ,department of ,homeland ,security4 7,d7 ,the ,office of the ,director of ,national ,intelligence4 7,e7 ,the ,federal ,bureau of ,investigation4 7,f7 ,the ,department of ,defense4 7,g7 ,the ,national ,institute of ,standards and ,technology4 7,h7 ,such other executive agencies as determined by the ,chairperson of the ,council4 7#b7 ,lead representatives 7,a7 ,designation 7i7 ,in general ,the head of each agency represented on the ,council shall designate a representative of that agency as the lead representative of the agency on the ,council not later than #ij days after the date of the enactment of the ,federal ,acquisition ,supply ,chain ,security ,act of #bjah4 7ii7 ,requirements ,the representative of an agency designated under clause 7i7 shall have expertise in supply chain risk management1 acquisitions1 or information technology4 7,b7 ,functions ,the lead representative of an agency designated under subparagraph 7,a7 shall ensure that appropriate personnel1 including leadership and subject matter experts of the agency1 are aware of the business of the ,council4 7c7 ,chairperson 7#a7 ,designation ,the ,director of the ,office of ,management and ,budget shall designate a senior-level official from the ,office of ,management and ,budget to serve as the ,chairperson of the ,council not later than #ij days after the date of the enactment of the ,federal ,acquisition ,supply ,chain ,security ,act of #bjah4 7#b7 ,functions ,the ,chairperson shall perform functions that include-- 7,a7 subject to subsection 7d71 developing a schedule for meetings of the ,council2 7,b7 designating executive agencies to be represented on the ,council under subsection 7b77#a77;,h72 7,c7 in consultation with the lead representative of each agency represented on the ,council1 developing a charter for the ,council2 and 7,d7 not later than #g days after completion of the charter1 submitting the charter to the appropriate congressional committees4 7d7 ,meetings ,the ,council shall meet not later than #ahj days after the date of the enactment of the ,federal ,acquisition ,supply ,chain ,security ,act of #bjah and not less frequently than quarterly thereafter4 #acbc4 ,functions 7a7 ,in general ,the ,council shall perform functions that include the following3 7#a7 ,developing criteria and processes-- 7,a7 for assessing threats and vulnerabilities relating to supply chain risk posed by the acquisition of information technology to national security and the public interest2 and 7,b7 for sharing information among executive agencies1 including the intelligence community1 and the private sector where appropriate1 with respect to assessments of that risk4 7#b7 ,defining the responsibilities of executive agencies1 consistent with existing law1 for management of such assessments4 7#c7 ,issuing guidance to executive agencies for incorporating information relating to supply chain risks and other relevant information into procurement decisions for the protection of national security and the public interest4 7#d7 ,developing standards and measures for supply chain risk management1 including assessments1 evaluations1 mitigation1 and response that take into consideration national security and other factors relevant to the public interest4 7#e7 ,consulting1 as appropriate1 with the private sector and other nongovernmental stakeholders on issues relating to the management of supply chain risks posed by the acquisition of information technology4 7#f7 ,determining whether the exclusion of a source made by one executive agency should apply to all executive agencies upon receiving a notification under section #dgac and carrying out such other actions as are agreed upon by the ,council4 7b7 ,authority ,to request information ,the ,council may request such information from executive agencies as is necessary for the ,council to carry out its functions under subsection 7a74 7c7 ,program office ,the ,council may establish a program office to assist the ,council in carrying out its functions under subsection 7a74 7d7 ,relationship to other councils ,the ,council shall consult and coordinate with other relevant councils to the maximum extent practicable4 7e7 ,rule of construction ,nothing in this section shall limit the authority of the ,office of ,federal ,procurement ,policy to carry out the responsibilities of that ,office under any other provision of law4 #acbd4 ,strategic plan 7a7 ,in general ,not later than #ahj days after the date of the enactment of the ,federal ,acquisition ,supply ,chain ,security ,act of #bjah1 the ,council shall develop a strategic plan for addressing supply chain risks posed by the acquisition of information technology and for managing such risks that includes-- 7#a7 the criteria and processes required under section #acbc7;a77#a71 including a threshold and requirements for sharing relevant information about such risks with all executive agencies2 7#b7 an identification of existing authorities for addressing such risks2 7#c7 an identification and promulgation of best practices and procedures and available resources for executive agencies to assess and mitigate such risks2 7#d7 recommendations for any legislative1 regulatory1 or other policy changes to improve efforts to address such risks2 7#e7 an evaluation of the effect of implementing new policies or procedures on existing contracts and the procurement process2 7#f7 a plan for engaging with executive agencies1 the private sector1 and other nongovernmental stakeholders to address such risks2 and 7#g7 plans to strengthen the capacity of all executive agencies to conduct assessments of-- 7,a7 the supply chain risk posed by the acquisition of information technology2 and 7,b7 compliance with the requirements of this subchapter4 7b7 ,submission to ,congress ,not later than #g days after completion of the strategic plan required by subsection 7a71 the ,chairperson of the ,council shall submit the plan to the appropriate congressional committees4 #acbe4 ,annual report ,not later than ,december #ca of each year1 the ,chairperson of the ,council shall submit to the appropriate congressional committees a report on the activities of the ,council during the preceding #ab-month period4 #acbf4 ,requirements for executive agencies 7a7 ,in general ,the head of each executive agency shall-- 7#a7 be responsible for conducting assessments of the supply chain risks posed by the acquisition of information technology by that agency1 developing mitigation and response requirements1 and ensuring ongoing management of such risks2 7#b7 share relevant information with other executive agencies as determined appropriate by the ,administrator in a manner consistent with section #acbc2 and 7#c7 ensure that all relevant information1 including classified information1 with respect to acquisitions of information technology that may pose a supply chain risk1 consistent with section #acbc7;a77#a71 is incorporated into existing processes of the agency for conducting assessments described in paragraph 7#a7 and ongoing management of acquisition programs1 including any identification1 investigation1 mitigation1 or remediation needs4 7b7 ,interagency acquisitions 7#a7 ,in general ,except as provided in paragraph 7#b71 in the case of an interagency acquisition1 subsection 7a7 shall be carried out by the head of the executive agency the funds of which are obligated or expended to conduct the acquisition4 7#b7 ,assisted acquisitions ,in an assisted acquisition1 the parties to the acquisition shall determine1 as part of the interagency agreement governing the acquisition1 which agency is responsible for carrying out subsection 7a74 7#c7 ,definitions ,in this subsection1 the terms assisted acquisition and interagency acquisition have the meanings given those terms in section #b4aja of title #dh1 ,code of ,federal ,regulations 7or any corresponding similar regulation or ruling74 #acbg4 ,termination ,this subchapter shall terminate on the date that is #e years after the date of the enactment of the ,federal ,acquisition ,supply ,chain ,security ,act of #bjah4 4 7b7 ,clerical amendment ,the table of sections at the beginning of chapter #ac of such title is amended by adding at the end the following new items3 ,,subchapter ,,iii--,federal ,acquisition ,security ,council ,sec4 #acba4 ,definitions4 #acbb4 ,establishment and membership4 #acbc4 ,functions4 #acbd4 ,strategic plan4 #acbe4 ,annual report4 #acbf4 ,requirements for executive agencies4 #acbg4 ,termination4 4 7c7 ,effective date ,the amendments made by this section shall take effect on the date that is #ij days after the date of the enactment of this ,act4 #c4 ,risk assessments for information technology made available to other agencies 7a7 ,in general ,not later than one year after the date of the enactment of this ,act1 the head of any executive agency that makes information technology available for procurement by other executive agencies shall-- 7#a7 identify information technology products made available to other agencies that pose the greatest risk to national security or the public interest2 7#b7 complete a risk assessment of information technology products identified under paragraph 7#a72 7#c7 in each case in which the head of the executive agency identifies a significant supply chain risk posed by information technology-- 7,a7 make the risk assessment with respect to that information technology available to all executive agencies through the ,federal ,acquisition ,security ,council established under subchapter ,,iii of chapter #ac of title #da1 ,united ,states ,code1 as added by section #b2 and 7,b7 develop a plan to mitigate that risk2 and 7#d7 develop a vetting process for conducting supply chain risk assessments with respect to prospective providers of information technology and make the process available to all executive agencies4 7b7 ,assistance ,the ,secretary of ,homeland ,security may-- 7#a7 assist executive agencies in conducting risk assessments described in subsection 7a7 and implementing mitigation requirements for information technology2 and 7#b7 provide such additional guidance or tools as are necessary to support actions taken by executive agencies under subsection 7a74 7c7 ,definitions ,in this section3 7#a7 ,executive agency ,the term executive agency has the meaning given that term in section #acc of title #da1 ,united ,states ,code4 7#b7 ,information technology ,the term information technology has the meaning given that term in section #aaaja of title #dj1 ,united ,states ,code4 7#c7 ,supply chain risk ,the term supply chain risk has the meaning given that term in section #dgac of title #da1 ,united ,states ,code1 as added by section #d4 #d4 ,authorities of executive agencies relating to mitigating supply chain risks in the procurement of information technology 7a7 ,in general ,chapter #dg of title #da1 ,united ,states ,code1 is amended by adding at the end the following new section3 #dgac4 ,authorities relating to mitigating supply chain risks in the procurement of information technology 7a7 ,authority ,subject to subsection 7b71 the head of an executive agency may-- 7#a7 carry out a covered procurement action2 and 7#b7 limit1 notwithstanding any other provision of law1 in whole or in part1 the disclosure of information relating to the basis for carrying out a covered procurement action4 7b7 ,determination and notification ,the head of an executive agency may exercise the authority provided in subsection 7a7 only after-- 7#a7 obtaining a joint recommendation by the senior procurement executive and chief information officer of the agency1 or such other officials of the agency as the head of the agency considers appropriate1 that there is a significant supply chain risk in a covered procurement2 7#b7 making a determination in writing1 in unclassified or classified form1 that-- 7,a7 use of the authority under subsection 7a77#a7 is necessary to protect national security or the public interest by reducing supply chain risk2 and 7,b7 in a case where the head of the agency plans to limit disclosure of information under subsection 7a77#b71 the risk to national security due to the disclosure of such information outweighs the risk due to not disclosing such information2 and 7#c7 providing a classified or unclassified notice of the determination made under paragraph 7#b7 not later than #cj days after making that determination to the ,federal ,acquisition ,security ,council that includes-- 7,a7 a summary of the information required for the purchase of property or services under this title and any other applicable law relating to procurement2 and 7,b7 a summary of the basis for the determination1 including a discussion of less intrusive measures that were considered and why such measures were not reasonably available to reduce supply chain risk4 7c7 ,limitation on disclosure ,if the head of an executive agency has exercised the authority provided in subsection 7a77#b7 to limit disclosure of information-- 7#a7 no procurement action undertaken by the head of the agency under such authority shall be subject to review in a bid protest before the ,government ,accountability ,office or in any ,federal court2 and 7#b7 the head of the agency shall-- 7,a7 notify appropriate parties of a covered procurement action and the basis for the action only to the extent necessary to effectuate the covered procurement action2 7,b7 notify and follow notification protocols as directed by the ,federal ,acquisition ,security ,council2 and 7,c7 ensure the confidentiality of any such notifications4 7d7 ,regulations ,the ,federal ,acquisition ,regulatory ,council shall prescribe such regulations as may be necessary to carry out this section4 7e7 ,reports required ,not less frequently than annually1 the head of each executive agency shall submit to the appropriate congressional committees a report summarizing the actions taken by the agency under this section during the preceding #ab-month period4 7f7 ,termination ,the authority provided under subsection 7a7 shall terminate on the date that is #e years after the date of the enactment of the ,federal ,acquisition ,supply ,chain ,security ,act of #bjah4 7g7 ,definitions ,in this section3 7#a7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs1 the ,committee on the ,judiciary1 the ,committee on ,appropriations1 the ,select ,committee on ,intelligence1 and the majority and minority leader of the ,senate2 and 7,b7 the ,committee on ,oversight and ,government ,reform1 the ,committee on the ,judiciary1 the ,committee on ,appropriations1 the ,committee on ,homeland ,security1 the ,permanent ,select ,committee on ,intelligence1 and the ,speaker and minority leader of the ,house of ,representatives4 7#b7 ,covered procurement ,the term covered procurement means-- 7,a7 a source selection for information technology involving either a performance specification1 as provided in subsection 7a77#c77;,b7 of section #ccjf of this title1 or an evaluation factor1 as provided in subsection 7b77#a77;,a7 of that section1 relating to a supply chain risk2 7,b7 the consideration of proposals for and issuance of a task or delivery order for information technology1 as provided in section #dajf7;d77#c7 of this title1 where the task or delivery order contract includes a contract clause establishing a requirement relating to a supply chain risk2 7,c7 any contract action involving a contract for information technology where the contract includes a clause establishing requirements relating to a supply chain risk2 or 7,d7 any other procurement in a category of procurements determined appropriate by the ,federal ,acquisition ,regulatory ,council1 with the advice of the ,federal ,acquisition ,security ,council4 7#c7 ,covered procurement action ,the term covered procurement action means any of the following actions1 if the action takes place in the course of conducting a covered procurement3 7,a7 ,the exclusion of a source that fails to meet qualification requirements established under section #ccaa of this title for the purpose of reducing supply chain risk in the acquisition of information technology4 7,b7 ,the exclusion of a source that fails to achieve an acceptable rating with regard to an evaluation factor providing for the consideration of supply chain risk in the evaluation of proposals for the award of a contract or the issuance of a task or delivery order4 7,c7 ,the decision to withhold consent for a contractor to subcontract with a particular source or to direct a contractor to exclude a particular source from consideration for a subcontract under the contract4 7#d7 ,information technology ,the term information technology has the meaning given that term in section #aaaja of title #dj4 7#e7 ,supply chain risk ,the term supply chain risk means the risk that any person may sabotage1 maliciously introduce unwanted function1 extract data1 or otherwise manipulate the design1 integrity1 manufacturing1 production1 distribution1 installation1 operation1 maintenance1 disposition1 or retirement of information technology so as to surveil1 deny1 disrupt1 or otherwise manipulate the function1 use1 or operation of the information technology4 4 7b7 ,clerical amendment ,the table of sections at the beginning of chapter #dg of such title is amended by adding at the end the following new item3 #dgac4 ,authorities relating to mitigating supply chain risks in the procurement of information technology4 4 7c7 ,effective date ,the amendments made by this section shall take effect on the date that is #ahj days after the date of the enactment of this ,act and shall apply to contracts that are awarded before1 on1 or after that date4