,,ii #aae? ,,congress #b;d ,session ,s4 #cjhe ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$ ,,/ates ,june #ai1 #bjah ,mrs4 ,mc,caskill 7= h]self & ,mr4 ,lank=d7 introduc$ ! foll[+ bill2 :i* 0 read twice & ref]r$ to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ,a ,,bill ,to e/abli% a ,f$]al ,acquisition ,security ,c\ncil & to provide executive ag5cies ) au?orities relat+ to mitigat+ supply *a9 risks 9 ! procurem5t ( in=mation te*nology1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,f$]al ,acquisition ,supply ,*a9 ,security ,act ( #bjah4 #b4 ,f$]al ,acquisition ,security ,c\ncil 7a7 ,9 g5]al ,*apt] #ac ( title #da1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+ new sub*apt]3 ,,iii ,f$]al ,acquisition ,security ,c\ncil #acba4 ,def9itions ,9 ?is sub*apt]3 7#a7 ,appropriate congressional committees ,! t]m appropriate congressional committees means-- 7,a7 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs1 ! ,committee on ! ,judici>y1 ! ,committee on ,arm$ ,s]vices1 ! ,committee on ,appropriations1 ! ,select ,committee on ,intellig5ce1 & ! majority & m9ority lead] ( ! ,s5ate2 & 7,b7 ! ,committee on ,ov]sight & ,gov]nm5t ,re=m1 ! ,committee on ! ,judici>y1 ! ,committee on ,arm$ ,s]vices1 ! ,committee on ,appropriations1 ! ,committee on ,homel& ,security1 ! ,p]man5t ,select ,committee on ,intellig5ce1 & ! ,speak] & m9ority lead] ( ! ,h\se ( ,repres5tatives4 7#b7 ,c\ncil ,! t]m ,c\ncil means ! ,f$]al ,acquisition ,security ,c\ncil e/abli%$ "u section #acbb7;a74 7#c7 ,in=mation te*nology ,! t]m in=mation te*nology has ! mean+ giv5 t t]m 9 section #aaaja ( title #dj4 7#d7 ,supply *a9 risk ,! t]m supply *a9 risk has ! mean+ giv5 t t]m 9 section #dgac4 #acbb4 ,e/abli%m5t & memb]%ip 7a7 ,e/abli%m5t ,!re is e/abli%$ 9 ! executive bran* a ,f$]al ,acquisition ,security ,c\ncil4 7b7 ,memb]%ip 7#a7 ,9 g5]al ,! foll[+ ag5cies %all be repres5t$ on ! ,c\ncil3 7,a7 ,! ,(fice ( ,managem5t & ,budget4 7,b7 ,! ,g5]al ,s]vices ,adm9i/ration4 7,c7 ,! ,dep>tm5t ( ,homel& ,security4 7,d7 ,! ,(fice ( ! ,director ( ,national ,intellig5ce4 7,e7 ,! ,f$]al ,bureau ( ,inve/igation4 7,f7 ,! ,dep>tm5t ( ,def5se4 7,g7 ,! ,national ,in/itute ( ,/&>ds & ,te*nology4 7,h7 ,su* o!r executive ag5cies z det]m9$ by ! ,*airp]son ( ! ,c\ncil4 7#b7 ,lead repres5tatives 7,a7 ,designation 7i7 ,9 g5]al ,! head ( ea* ag5cy repres5t$ on ! ,c\ncil %all designate a repres5tative ( t ag5cy z ! lead repres5tative ( ! ag5cy on ! ,c\ncil n lat] ?an #ij days aft] ! date ( ! enactm5t ( ! ,f$]al ,acquisition ,supply ,*a9 ,security ,act ( #bjah4 7ii7 ,requirem5ts ,! repres5tative ( an ag5cy designat$ "u clause 7i7 %all h exp]tise 9 supply *a9 risk managem5t1 acquisitions1 or in=mation te*nology4 7,b7 ,functions ,! lead repres5tative ( an ag5cy designat$ "u subp>agraph 7,a7 %all ensure t appropriate p]sonnel1 includ+ lead]%ip & subject matt] exp]ts ( ! ag5cy1 are aw>e ( ! bus9ess ( ! ,c\ncil4 7c7 ,*airp]son 7#a7 ,designation ,! ,director ( ! ,(fice ( ,managem5t & ,budget %all designate a s5ior-level (ficial f ! ,(fice ( ,managem5t & ,budget to s]ve z ! ,*airp]son ( ! ,c\ncil n lat] ?an #ij days aft] ! date ( ! enactm5t ( ! ,f$]al ,acquisition ,supply ,*a9 ,security ,act ( #bjah4 7#b7 ,functions ,! ,*airp]son %all p]=m functions t include-- 7,a7 subject to subsection 7d71 develop+ a s*$ule = meet+s ( ! ,c\ncil2 7,b7 designat+ executive ag5cies to be repres5t$ on ! ,c\ncil "u subsection 7b77#a77;,h72 7,c7 9 consultation ) ! lead repres5tative ( ea* ag5cy repres5t$ on ! ,c\ncil1 develop+ a *>t] = ! ,c\ncil2 & 7,d7 n lat] ?an #g days aft] completion ( ! *>t]1 submitt+ ! *>t] to ! appropriate congressional committees4 7d7 ,meet+s ,! ,c\ncil %all meet n lat] ?an #ahj days aft] ! date ( ! enactm5t ( ! ,f$]al ,acquisition ,supply ,*a9 ,security ,act ( #bjah & n less frequ5tly ?an qu>t]ly !reaft]4 #acbc4 ,functions 7a7 ,9 g5]al ,! ,c\ncil %all p]=m functions t include ! foll[+3 7#a7 ,develop+ crit]ia & processes-- 7,a7 = assess+ ?reats & vuln]abilities relat+ to supply *a9 risk pos$ by ! acquisition ( in=mation te*nology to national security & ! public int]e/2 & 7,b7 = %>+ in=mation among executive ag5cies1 includ+ ! intellig5ce community1 & ! private sector :]e appropriate1 ) respect to assessm5ts ( t risk4 7#b7 ,def9+ ! responsibilities ( executive ag5cies1 consi/5t ) exi/+ law1 = managem5t ( su* assessm5ts4 7#c7 ,issu+ guidance to executive ag5cies = incorporat+ in=mation relat+ to supply *a9 risks & o!r relevant in=mation into procurem5t decisions = ! protection ( national security & ! public int]e/4 7#d7 ,develop+ /&>ds & measures = supply *a9 risk managem5t1 includ+ assessm5ts1 evaluations1 mitigation1 & response t take into consid]ation national security & o!r factors relevant to ! public int]e/4 7#e7 ,consult+1 z appropriate1 ) ! private sector & o!r nongov]nm5tal /akehold]s on issues relat+ to ! managem5t ( supply *a9 risks pos$ by ! acquisition ( in=mation te*nology4 7#f7 ,det]m9+ :e!r ! exclusion ( a s\rce made by "o executive ag5cy %\ld apply to all executive ag5cies ^u receiv+ a notification "u section #dgac & c>ry+ out su* o!r actions z are agre$ ^u by ! ,c\ncil4 7b7 ,au?ority ,to reque/ in=mation ,! ,c\ncil may reque/ su* in=mation f executive ag5cies z is necess>y = ! ,c\ncil to c>ry out its functions "u subsection 7a74 7c7 ,program (fice ,! ,c\ncil may e/abli% a program (fice to assi/ ! ,c\ncil 9 c>ry+ out its functions "u subsection 7a74 7d7 ,relation%ip to o!r c\ncils ,! ,c\ncil %all consult & coord9ate ) o!r relevant c\ncils to ! maximum ext5t practicable4 7e7 ,rule ( con/ruction ,no?+ 9 ?is section %all limit ! au?ority ( ! ,(fice ( ,f$]al ,procurem5t ,policy to c>ry out ! responsibilities ( t ,(fice "u any o!r provision ( law4 #acbd4 ,/rategic plan 7a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date ( ! enactm5t ( ! ,f$]al ,acquisition ,supply ,*a9 ,security ,act ( #bjah1 ! ,c\ncil %all develop a /rategic plan = address+ supply *a9 risks pos$ by ! acquisition ( in=mation te*nology & = manag+ su* risks t includes-- 7#a7 ! crit]ia & processes requir$ "u section #acbc7;a77#a71 includ+ a ?re%old & requirem5ts = %>+ relevant in=mation ab\t su* risks ) all executive ag5cies2 7#b7 an id5tification ( exi/+ au?orities = address+ su* risks2 7#c7 an id5tification & promulgation ( be/ practices & proc$ures & available res\rces = executive ag5cies to assess & mitigate su* risks2 7#d7 recomm5dations = any legislative1 regulatory1 or o!r policy *anges to improve ef=ts to address su* risks2 7#e7 an evaluation ( ! effect ( implem5t+ new policies or proc$ures on exi/+ contracts & ! procurem5t process2 7#f7 a plan = engag+ ) executive ag5cies1 ! private sector1 & o!r nongov]nm5tal /akehold]s to address su* risks2 & 7#g7 plans to /r5g!n ! capacity ( all executive ag5cies to conduct assessm5ts (-- 7,a7 ! supply *a9 risk pos$ by ! acquisition ( in=mation te*nology2 & 7,b7 compliance ) ! requirem5ts ( ?is sub*apt]4 7b7 ,submission to ,congress ,n lat] ?an #g days aft] completion ( ! /rategic plan requir$ by subsection 7a71 ! ,*airp]son ( ! ,c\ncil %all submit ! plan to ! appropriate congressional committees4 #acbe4 ,annual report ,n lat] ?an ,decemb] #ca ( ea* ye>1 ! ,*airp]son ( ! ,c\ncil %all submit to ! appropriate congressional committees a report on ! activities ( ! ,c\ncil dur+ ! prec$+ #ab-mon? p]iod4 #acbf4 ,requirem5ts = executive ag5cies 7a7 ,9 g5]al ,! head ( ea* executive ag5cy %all-- 7#a7 be responsible = conduct+ assessm5ts ( ! supply *a9 risks pos$ by ! acquisition ( in=mation te*nology by t ag5cy1 develop+ mitigation & response requirem5ts1 & ensur+ ongo+ managem5t ( su* risks2 7#b7 %>e relevant in=mation ) o!r executive ag5cies z det]m9$ appropriate by ! ,adm9i/rator 9 a mann] consi/5t ) section #acbc2 & 7#c7 ensure t all relevant in=mation1 includ+ classifi$ in=mation1 ) respect to acquisitions ( in=mation te*nology t may pose a supply *a9 risk1 consi/5t ) section #acbc7;a77#a71 is incorporat$ into exi/+ processes ( ! ag5cy = conduct+ assessm5ts describ$ 9 p>agraph 7#a7 & ongo+ managem5t ( acquisition programs1 includ+ any id5tification1 inve/igation1 mitigation1 or rem$iation ne$s4 7b7 ,int]ag5cy acquisitions 7#a7 ,9 g5]al ,except z provid$ 9 p>agraph 7#b71 9 ! case ( an int]ag5cy acquisition1 subsection 7a7 %all be c>ri$ out by ! head ( ! executive ag5cy ! funds ( :i* are obligat$ or exp5d$ to conduct ! acquisition4 7#b7 ,assi/$ acquisitions ,9 an assi/$ acquisition1 ! p>ties to ! acquisition %all det]m9e1 z "p ( ! int]ag5cy agreem5t gov]n+ ! acquisition1 :i* ag5cy is responsible = c>ry+ out subsection 7a74 7#c7 ,def9itions ,9 ?is subsection1 ! t]ms assi/$ acquisition & int]ag5cy acquisition h ! mean+s giv5 ^? t]ms 9 section #b4aja ( title #dh1 ,code ( ,f$]al ,regulations 7or any correspond+ simil> regulation or rul+74 #acbg4 ,t]m9ation ,?is sub*apt] %all t]m9ate on ! date t is #e ye>s aft] ! date ( ! enactm5t ( ! ,f$]al ,acquisition ,supply ,*a9 ,security ,act ( #bjah4 4 7b7 ,cl]ical am5dm5t ,! table ( sections at ! beg9n+ ( *apt] #ac ( su* title is am5d$ by add+ at ! end ! foll[+ new items3 ,,sub*apt] ,,iii--,f$]al ,acquisition ,security ,c\ncil ,sec4 #acba4 ,def9itions4 #acbb4 ,e/abli%m5t & memb]%ip4 #acbc4 ,functions4 #acbd4 ,/rategic plan4 #acbe4 ,annual report4 #acbf4 ,requirem5ts = executive ag5cies4 #acbg4 ,t]m9ation4 4 7c7 ,effective date ,! am5dm5ts made by ?is section %all take effect on ! date t is #ij days aft] ! date ( ! enactm5t ( ?is ,act4 #c4 ,risk assessm5ts = in=mation te*nology made available to o!r ag5cies 7a7 ,9 g5]al ,n lat] ?an "o ye> aft] ! date ( ! enactm5t ( ?is ,act1 ! head ( any executive ag5cy t makes in=mation te*nology available = procurem5t by o!r executive ag5cies %all-- 7#a7 id5tify in=mation te*nology products made available to o!r ag5cies t pose ! greate/ risk to national security or ! public int]e/2 7#b7 complete a risk assessm5t ( in=mation te*nology products id5tifi$ "u p>agraph 7#a72 7#c7 9 ea* case 9 :i* ! head ( ! executive ag5cy id5tifies a significant supply *a9 risk pos$ by in=mation te*nology-- 7,a7 make ! risk assessm5t ) respect to t in=mation te*nology available to all executive ag5cies ?r\gh ! ,f$]al ,acquisition ,security ,c\ncil e/abli%$ "u sub*apt] ,,iii ( *apt] #ac ( title #da1 ,unit$ ,/ates ,code1 z add$ by section #b2 & 7,b7 develop a plan to mitigate t risk2 & 7#d7 develop a vett+ process = conduct+ supply *a9 risk assessm5ts ) respect to prospective provid]s ( in=mation te*nology & make ! process available to all executive ag5cies4 7b7 ,assi/ance ,! ,secret>y ( ,homel& ,security may-- 7#a7 assi/ executive ag5cies 9 conduct+ risk assessm5ts describ$ 9 subsection 7a7 & implem5t+ mitigation requirem5ts = in=mation te*nology2 & 7#b7 provide su* additional guidance or tools z are necess>y to support actions tak5 by executive ag5cies "u subsection 7a74 7c7 ,def9itions ,9 ?is section3 7#a7 ,executive ag5cy ,! t]m executive ag5cy has ! mean+ giv5 t t]m 9 section #acc ( title #da1 ,unit$ ,/ates ,code4 7#b7 ,in=mation te*nology ,! t]m in=mation te*nology has ! mean+ giv5 t t]m 9 section #aaaja ( title #dj1 ,unit$ ,/ates ,code4 7#c7 ,supply *a9 risk ,! t]m supply *a9 risk has ! mean+ giv5 t t]m 9 section #dgac ( title #da1 ,unit$ ,/ates ,code1 z add$ by section #d4 #d4 ,au?orities ( executive ag5cies relat+ to mitigat+ supply *a9 risks 9 ! procurem5t ( in=mation te*nology 7a7 ,9 g5]al ,*apt] #dg ( title #da1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+ new section3 #dgac4 ,au?orities relat+ to mitigat+ supply *a9 risks 9 ! procurem5t ( in=mation te*nology 7a7 ,au?ority ,subject to subsection 7b71 ! head ( an executive ag5cy may-- 7#a7 c>ry out a cov]$ procurem5t action2 & 7#b7 limit1 not)/&+ any o!r provision ( law1 9 :ole or 9 "p1 ! disclosure ( in=mation relat+ to ! basis = c>ry+ out a cov]$ procurem5t action4 7b7 ,det]m9ation & notification ,! head ( an executive ag5cy may ex]cise ! au?ority provid$ 9 subsection 7a7 only aft]-- 7#a7 obta9+ a jo9t recomm5dation by ! s5ior procurem5t executive & *ief in=mation (fic] ( ! ag5cy1 or su* o!r (ficials ( ! ag5cy z ! head ( ! ag5cy consid]s appropriate1 t !re is a significant supply *a9 risk 9 a cov]$ procurem5t2 7#b7 mak+ a det]m9ation 9 writ+1 9 unclassifi$ or classifi$ =m1 t-- 7,a7 use ( ! au?ority "u subsection 7a77#a7 is necess>y to protect national security or ! public int]e/ by r$uc+ supply *a9 risk2 & 7,b7 9 a case :]e ! head ( ! ag5cy plans to limit disclosure ( in=mation "u subsection 7a77#b71 ! risk to national security due to ! disclosure ( su* in=mation outweighs ! risk due to n disclos+ su* in=mation2 & 7#c7 provid+ a classifi$ or unclassifi$ notice ( ! det]m9ation made "u p>agraph 7#b7 n lat] ?an #cj days aft] mak+ t det]m9ation to ! ,f$]al ,acquisition ,security ,c\ncil t includes-- 7,a7 a summ>y ( ! in=mation requir$ = ! pur*ase ( prop]ty or s]vices "u ?is title & any o!r applicable law relat+ to procurem5t2 & 7,b7 a summ>y ( ! basis = ! det]m9ation1 includ+ a discussion ( less intrusive measures t 7 consid]$ & :y su* measures 7 n reasonably available to r$uce supply *a9 risk4 7c7 ,limitation on disclosure ,if ! head ( an executive ag5cy has ex]cis$ ! au?ority provid$ 9 subsection 7a77#b7 to limit disclosure ( in=mation-- 7#a7 no procurem5t action und]tak5 by ! head ( ! ag5cy "u su* au?ority %all be subject to review 9 a bid prote/ be=e ! ,gov]nm5t ,acc\ntability ,(fice or 9 any ,f$]al c\rt2 & 7#b7 ! head ( ! ag5cy %all-- 7,a7 notify appropriate p>ties ( a cov]$ procurem5t action & ! basis = ! action only to ! ext5t necess>y to effectuate ! cov]$ procurem5t action2 7,b7 notify & foll[ notification protocols z direct$ by ! ,f$]al ,acquisition ,security ,c\ncil2 & 7,c7 ensure ! confid5tiality ( any su* notifications4 7d7 ,regulations ,! ,f$]al ,acquisition ,regulatory ,c\ncil %all prescribe su* regulations z may be necess>y to c>ry out ?is section4 7e7 ,reports requir$ ,n less frequ5tly ?an annually1 ! head ( ea* executive ag5cy %all submit to ! appropriate congressional committees a report summ>iz+ ! actions tak5 by ! ag5cy "u ?is section dur+ ! prec$+ #ab-mon? p]iod4 7f7 ,t]m9ation ,! au?ority provid$ "u subsection 7a7 %all t]m9ate on ! date t is #e ye>s aft] ! date ( ! enactm5t ( ! ,f$]al ,acquisition ,supply ,*a9 ,security ,act ( #bjah4 7g7 ,def9itions ,9 ?is section3 7#a7 ,appropriate congressional committees ,! t]m appropriate congressional committees means-- 7,a7 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs1 ! ,committee on ! ,judici>y1 ! ,committee on ,appropriations1 ! ,select ,committee on ,intellig5ce1 & ! majority & m9ority lead] ( ! ,s5ate2 & 7,b7 ! ,committee on ,ov]sight & ,gov]nm5t ,re=m1 ! ,committee on ! ,judici>y1 ! ,committee on ,appropriations1 ! ,committee on ,homel& ,security1 ! ,p]man5t ,select ,committee on ,intellig5ce1 & ! ,speak] & m9ority lead] ( ! ,h\se ( ,repres5tatives4 7#b7 ,cov]$ procurem5t ,! t]m cov]$ procurem5t means-- 7,a7 a s\rce selection = in=mation te*nology involv+ ei!r a p]=mance specification1 z provid$ 9 subsection 7a77#c77;,b7 ( section #ccjf ( ?is title1 or an evaluation factor1 z provid$ 9 subsection 7b77#a77;,a7 ( t section1 relat+ to a supply *a9 risk2 7,b7 ! consid]ation ( proposals = & issuance ( a task or deliv]y ord] = in=mation te*nology1 z provid$ 9 section #dajf7;d77#c7 ( ?is title1 :]e ! task or deliv]y ord] contract includes a contract clause e/abli%+ a requirem5t relat+ to a supply *a9 risk2 7,c7 any contract action involv+ a contract = in=mation te*nology :]e ! contract includes a clause e/abli%+ requirem5ts relat+ to a supply *a9 risk2 or 7,d7 any o!r procurem5t 9 a category ( procurem5ts det]m9$ appropriate by ! ,f$]al ,acquisition ,regulatory ,c\ncil1 ) ! advice ( ! ,f$]al ,acquisition ,security ,c\ncil4 7#c7 ,cov]$ procurem5t action ,! t]m cov]$ procurem5t action means any ( ! foll[+ actions1 if ! action takes place 9 ! c\rse ( conduct+ a cov]$ procurem5t3 7,a7 ,! exclusion ( a s\rce t fails to meet qualification requirem5ts e/abli%$ "u section #ccaa ( ?is title = ! purpose ( r$uc+ supply *a9 risk 9 ! acquisition ( in=mation te*nology4 7,b7 ,! exclusion ( a s\rce t fails to a*ieve an acceptable rat+ ) reg>d to an evaluation factor provid+ = ! consid]ation ( supply *a9 risk 9 ! evaluation ( proposals = ! aw>d ( a contract or ! issuance ( a task or deliv]y ord]4 7,c7 ,! decision to )hold cons5t = a contractor to subcontract ) a p>ticul> s\rce or to direct a contractor to exclude a p>ticul> s\rce f consid]ation = a subcontract "u ! contract4 7#d7 ,in=mation te*nology ,! t]m in=mation te*nology has ! mean+ giv5 t t]m 9 section #aaaja ( title #dj4 7#e7 ,supply *a9 risk ,! t]m supply *a9 risk means ! risk t any p]son may sabotage1 malici\sly introduce unwant$ function1 extract data1 or o!rwise manipulate ! design1 integrity1 manufactur+1 production1 di/ribution1 in/allation1 op]ation1 ma9t5ance1 disposition1 or retirem5t ( in=mation te*nology s z to surveil1 d5y1 disrupt1 or o!rwise manipulate ! function1 use1 or op]ation ( ! in=mation te*nology4 4 7b7 ,cl]ical am5dm5t ,! table ( sections at ! beg9n+ ( *apt] #dg ( su* title is am5d$ by add+ at ! end ! foll[+ new item3 #dgac4 ,au?orities relat+ to mitigat+ supply *a9 risks 9 ! procurem5t ( in=mation te*nology4 4 7c7 ,effective date ,! am5dm5ts made by ?is section %all take effect on ! date t is #ahj days aft] ! date ( ! enactm5t ( ?is ,act & %all apply to contracts t are aw>d$ be=e1 on1 or aft] t date4