,,ib  ,union ,calendar ,no4 #adf  #aafth
 ,,congress  #ast ,session  ,h4 ,r4     
#ccbj  ,report ,no4 #aaf-ahh  ,,in ,,the
 ,,house ,,of ,,representatives  ,june  
#ah1 #bjai ,mr4 ,king of ,new ,york 7for
 himself1 ,mr4 ,thompson of             
,mississippi1 ,miss ,rice of ,new ,york1
 ,mr4 ,correa1 ,mr4 ,rogers of ,alabama1
 ,mr4 ,rose of ,new ,york1 and ,mr4     
,payne7 introduced the following bill2  
which was referred to the ,committee on 
,homeland ,security  ,august #bg1 #bjai 
,additional sponsors3 ,mr4 ,mc,caul and 
,mr4 ,hagedorn  ,august #bg1 #bjai      
,reported with an amendment1 committed  
to the ,committee of the ,whole ,house  
on the ,state of the ,union1 and ordered
 to be printed ,strike out all after the
 enacting clause and insert the part    
printed in italic ,for text of          
introduced bill1 see copy of bill as    
introduced on ,june #ah1 #bjai  ,a      
,,bill  ,to amend the ,homeland         
,security ,act of #bjjb to authorize the
 ,secretary of ,homeland ,security to   

implement certain requirements for      
information relating to supply chain    
risk1 and for other purposes4  #a4      
,short title ,this ,act may be cited as 
the ,securing the ,homeland ,security   
,supply ,chain ,act of #bjai4  #b4      
,department of ,homeland ,security      
requirements for information relating to
 supply chain risk  7a7 ,in general     
,subtitle ,d of title ,,viii of the     
,homeland ,security ,act of #bjjb 7#f   
,u4,s4,c4 #cia et seq47 is amended by   
adding at the end the following new     
section3  #hcf4 ,requirements for       
information relating to supply chain    
risk  7a7 ,authority ,subject to        
subsection 7b71 the ,secretary may--    
7#a7 carry out a covered procurement    
action2  7#b7 limit1 notwithstanding any
 other provision of law1 in whole or in 
part1 the disclosure of information1    
including classified information1       
relating to the basis for carrying out  
such an action2 and  7#c7 exclude1 in   
whole or in part1 a source carried out  

in the course of such an action         
applicable to a covered procurement of  
the ,department4  7b7 ,determination and
 notification ,except as authorized by  
subsection 7c7 to address an urgent     
national security interest1 the         
,secretary may exercise the authority   
provided in subsection 7a7 only after-- 
7#a7 obtaining a joint recommendation1  
in unclassified or classified form1 from
 the ,chief ,acquisition ,officer and   
the ,chief ,information ,officer of the 
,department1 including a review of any  
risk assessment made available by an    
appropriate person or entity1 including 
the national risk management center at  
the ,cybersecurity and ,infrastructure  
,security ,agency1 that there is a      
significant supply chain risk in a      
covered procurement2  7#b7 notifying any
 source named in the joint              
recommendation described in paragraph   
7#a7 advising-- 7,a7 that a             
recommendation has been obtained2  7,b7 
to the extent consistent with the       

national security and law enforcement   
interests1 the basis for such           
recommendation2  7,c7 that1 within #cj  
days after receipt of notice1 such      
source may submit information and       
argument in opposition to such          
recommendation2 and  7,d7 of the        
procedures governing the consideration  
of such submission and the possible     
exercise of the authority provided in   
subsection 7a72  7#c7 notifying the     
relevant components of the ,department  
that such risk assessment has           
demonstrated significant supply chain   
risk to a covered procurement2  7#d7    
making a determination in writing1 in   
unclassified or classified form1 that   
after considering any information       
submitted by a source under paragraph   
7#b71 and in consultation with the      
,chief ,information ,officer of the     
,department1 that-- 7,a7 use of         
authority under subsection 7a77#a7 is   
necessary to protect national security  
by reducing supply chain risk2  7,b7    

less intrusive measures are not         
reasonably available to reduce such     
risk2  7,c7 a decision to limit         
disclosure of information under         
subsection 7a77#b7 is necessary to      
protect national security interest2 and 
7,d7 the use of such authorities will   
apply to a single covered procurement or
 a class of covered procurements1 and   
otherwise specifies the scope of such   
determination2  7#e7 providing to the   
,committee on ,homeland ,security of the
 ,house of ,representatives and the     
,committee on ,homeland ,security and   
,governmental ,affairs of the ,senate a 
classified or unclassified notice of the
 determination made under paragraph 7#d7
 that includes--  7,a7 the joint        
recommendation described in paragraph   
7#a72  7,b7 a summary of any risk       
assessment reviewed in support of such  
joint recommendation2 and  7,c7 a       
summary of the basis for such           
determination1 including a discussion of
 less intrusive measures that were      

considered and why such measures were   
not reasonably available to reduce      
supply chain risk2  7#f7 notifying the  
,director of the ,office of ,management 
and ,budget1 and the heads of other     
,federal agencies as appropriate1 in a  
manner and to the extent consistent with
 the requirements of national security2 
and  7#g7 taking steps to maintain the  
confidentiality of any notifications    
under this subsection4  7c7 ,procedures 
,to address urgent national security    
interests ,in any case in which the     
,secretary determines that national     
security interests require the immediate
 exercise of the authorities under      
subsection 7a71 the ,secretary--  7#a7  
may1 to the extent necessary to address 
any such national security interest1 and
 subject to the conditions specified in 
paragraph 7#b7-- 7,a7 temporarily delay 
the notice required by subsection       
7b77#b72  7,b7 make the determination   
required by subsection 7b77#d71         
regardless of whether the notice        

required by subsection 7b77#b7 has been 
provided or whether the notified source 
at issue has submitted any information  
in response to such notice2  7,c7       
temporarily delay the notice required by
 subsections 7b77#d7 and 7b77#e72 and   
7,d7 exercise the authority provided in 
subsection 7a7 in accordance with such  
determination2 and  7#b7 shall take     
actions necessary to comply with all    
requirements of subsection 7b7 as soon  
as practicable after addressing the     
urgent national security interest that  
is the subject of paragraph 7#a71       
including--  7,a7 providing the notice  
required by subsection 7b77#b72  7,b7   
promptly considering any information    
submitted by the source at issue in     
response to such notice1 and making any 
appropriate modifications to the        
determination required by subsection    
7b77#d7 based on such information2 and  
7,c7 providing the notice required by   
subsections 7b77#e7 and 7b77#f71        
including a description of such urgent  

national security1 and any modifications
 to such determination made in          
accordance with subparagraph 7,b74  7d7 
,annual review of determinations ,the   
,secretary shall annually review all    
determinations made under subsection    
7b74  7e7 ,delegation ,the ,secretary   
may not delegate the authority provided 
in subsection 7a7 or the responsibility 
identified in subsection 7d7 to an      
official below the ,deputy ,secretary4  
7f7 ,limitation of review               
,notwithstanding any other provision of 
law1 no action taken by the ,secretary  
under subsection 7a7 may be subject to  
review in a bid protest before the      
,government ,accountability ,office or  
in any ,federal court4  7g7             
,consultation ,in developing procedures 
and guidelines for the implementation of
 the authorities described in this      
section1 the ,secretary shall review the
 procedures and guidelines utilized by  
the ,department of ,defense to carry out
 similar authorities4  7h7 ,definitions 

,in this section3  7#a7 ,covered article
 ,the term covered article means3 7,a7  
,information technology1 including cloud
 computing services of all types4  7,b7 
,telecommunications equipment4  7,c7    
,telecommunications services4  7,d7 ,the
 processing of information on a ,federal
 or non-,federal information system1    
subject to the requirements of the      
,controlled ,unclassified ,information  
program of the ,department4  7,e7       
,hardware1 systems1 devices1 software1  
or services that include embedded or    
incidental information technology4  7#b7
 ,covered procurement ,the term covered 
procurement means-- 7,a7 a source       
selection for a covered article         
involving either a performance          
specification1 as provided in subsection
 7a77#c77;,b7 of section #ccjf of title 
#da1 ,united ,states ,code1 or an       
evaluation factor1 as provided in       
subsection 7c77#a77;,a7 of such section1
 relating to supply chain risk1 or with 
respect to which supply chain risk      

considerations are included in the      
,department's determination of whether a
 source is a responsible source as      
defined in section #aac of such title2  
7,b7 the consideration of proposals for 
and issuance of a task or delivery order
 for a covered article1 as provided in  
section #dajf7;d77#c7 of title #da1     
,united ,states ,code1 with respect to  
which the task or delivery order        
contract includes a contract clause     
establishing a requirement relating to  
supply chain risk2  7,c7 any contract   
action involving a contract for a       
covered article with respect to which   
such contract includes a clause         
establishing requirements relating to   
supply chain risk2 or  7,d7 any         
procurement made via ,government        
,purchase ,care for a covered article   
when supply chain risk has been         
identified as a concern4  7#c7 ,covered 
procurement action ,the term covered    
procurement action means any of the     
following actions1 if such action takes 

place in the course of conducting a     
covered procurement3  7,a7 ,the         
exclusion of a source that fails to meet
 qualification requirements established 
pursuant to section #ccaa of title #da1 
,united ,states ,code1 for the purpose  
of reducing supply chain risk in the    
acquisition or use of a covered article4
  7,b7 ,the exclusion of a source that  
fails to achieve an acceptable rating   
with regard to an evaluation factor     
providing for the consideration of      
supply chain risk in the evaluation of  
proposals for the award of a contract or
 the issuance of a task or delivery     
order4  7,c7 ,the determination that a  
source is not a responsible source based
 on considerations of supply chain risk4
  7,d7 ,the decision to withhold consent
 for a contractor to subcontract with a 
particular source or to direct a        
contractor to exclude a particular      
source from consideration for a         
subcontract4  7#d7 ,information system  
,the term information system has the    

meaning given such term in section #cejb
 of title #dd1 ,united ,states ,code4   
7#e7 ,information technology ,the term  
information technology has the meaning  
given such term in section #aaaja of    
title #dj1 ,united ,states ,code4  7#f7 
,responsible source ,the term           
responsible source has the meaning given
 such term in section #aac of title #da1
 ,united ,states ,code4  7#g7 ,supply   
chain risk ,the term supply chain risk  
means the risk that a malicious actor   
may sabotage1 maliciously introduce an  
unwanted function1 extract or modify    
data1 or otherwise manipulate the       
design1 integrity1 manufacturing1       
production1 distribution1 installation1 
operation1 or maintenance of a covered  
article so as to surveil1 deny1 disrupt1
 or otherwise manipulate the function1  
use1 or operation of the information    
technology or information stored or     
transmitted on the covered articles4    
7#h7 ,telecommunications equipment ,the 
term telecommunications equipment has   

the meaning given such term in section  
#c7eb7 of the ,communications ,act of   
#aicd 7#dg ,u4,s4,c4 #aec7eb774  7#i7   
,telecommunications service ,the term   
telecommunications service has the      
meaning given such term in section      
#c7ec7 of the ,communications ,act of   
#aicd 7#dg ,u4,s4,c4 #aec7ec774  7i7    
,effective date ,the requirements of    
this section shall take effect on the   
date that is #ij days after the date of 
the enactment of this ,act and shall    
apply to-- 7#a7 contracts awarded on or 
after such date2 and  7#b7 task and     
delivery orders issued on or after such 
date pursuant to contracts awarded      
before1 on1 or after such date4  4  7b7 
,rulemaking ,section #eec of title #e1  
,united ,states ,code1 and section #agjg
 of title #da1 ,united ,states ,code1   
shall not apply to the ,secretary of    
,homeland ,security when carrying out   
the authorities and responsibilities    
under section #hcf of the ,homeland     
,security ,act of #bjjb1 as added by    

subsection 7a74  7c7 ,clerical amendment
 ,the table of contents in section      
#a7;b7 of the ,homeland ,security ,act  
of #bjjb is amended by inserting after  
the item relating to section #hce the   
following new item3  ,sec4 #hcf4        
,requirements for information relating  
to supply chain risk4  4  #c4 ,report on
 threats posed by foreign state-owned   
entities to ,,dhs information technology
 and communications systems ,not later  
than #ahj days after the date of the    
enactment of this ,act1 the ,under      
,secretary for ,management of the       
,department of ,homeland ,security1 in  
coordination with the national risk     
management center of the ,cybersecurity 
and ,infrastructure ,security ,agency of
 the ,department1 shall submit to the   
,committee on ,homeland ,security of the
 ,house of ,representatives and the     
,committee on ,homeland ,security and   
,governmental ,affairs of the ,senate a 
report on cybersecurity threats posed by
 terrorist actors and foreign           

state-owned entities to the information 
technology and communications systems of
 ,department of ,homeland ,security1    
including information relating to the   
following3  7#a7 ,the use of foreign    
state-owned entities' information and   
communications technology by the        
,department of ,homeland ,security1     
listed by component4  7#b7 ,the threats1
 in consultation with the ,department's 
,office of ,intelligence and ,analysis1 
of foreign state-owned entities'        
information and communications          
technology equipment that could impact  
the ,department4  ,august #bg1 #bjai    
,reported with an amendment1 committed  
to the ,committee of the ,whole ,house  
on the ,state of the ,union1 and ordered
 to be printed