(a) Authority.—
Subject to subsection (b), the head of an executive agency may carry out a covered procurement action.
(b) Determination and Notification.—Except as authorized by subsection (c) to address an urgent national security interest, the head of an executive agency may exercise the authority provided in subsection (a) only after—
(1)
obtaining a joint recommendation, in unclassified or classified form, from the chief acquisition officer and the chief information officer of the agency, or officials performing similar functions in the case of executive agencies that do not have such officials, which includes a review of any risk assessment made available by the executive agency identified under section 1323(a)(3) of this title, that there is a significant supply chain risk in a covered procurement;
(2) providing notice of the joint recommendation described in paragraph (1) to any source named in the joint recommendation advising—
(B)
to the extent consistent with the national security and law enforcement interests, of information that forms the basis for the recommendation;
(3) making a determination in writing, in unclassified or classified form, after considering any information submitted by a source under paragraph (2) and in consultation with the chief information security officer of the agency, that—
(A)
use of the authority under subsection (a) is necessary to protect national security by reducing supply chain risk;
(C)
the use of such authorities will apply to a single covered procurement or a class of covered procurements, and otherwise specifies the scope of the determination; and
(4) providing a classified or unclassified notice of the determination made under paragraph (3) to the appropriate congressional committees and leadership that includes—
(B)
a summary of any risk assessment reviewed in support of the joint recommendation required by paragraph (1); and
(C)
a summary of the basis for the determination, including a discussion of less intrusive measures that were considered and why such measures were not reasonably available to reduce supply chain risk.
(c) Procedures To Address Urgent National Security Interests.—In any case in which the head of an executive agency determines that an urgent national security interest requires the immediate exercise of the authority provided in subsection (a), the head of the agency—
(1) may, to the extent necessary to address such national security interest, and subject to the conditions in paragraph (2)—
(2) shall take actions necessary to comply with all requirements of subsection (b) as soon as practicable after addressing the urgent national security interest, including—
(B)
promptly considering any information submitted by the source in response to such notice, and making any appropriate modifications to the determination based on such information;
(C)
providing the notice required by subsection (b)(4), including a description of the urgent national security interest, and any modifications to the determination made in accordance with subparagraph (B); and
(D)
providing notice to the appropriate congressional committees and leadership within 7 calendar days of the covered procurement actions taken under this section.
(d) Confidentiality.—
The notice required by subsection (b)(2) shall be kept confidential until a determination with respect to a covered procurement action has been made pursuant to subsection (b)(3).
(e) Delegation.—
The head of an executive agency may not delegate the authority provided in subsection (a) or the responsibility identified in subsection (f) to an official below the level one level below the Deputy Secretary or Principal Deputy Director.
(f) Annual Review of Determinations.—
The head of an executive agency shall conduct an annual review of all determinations made by such head under subsection (b) and promptly amend any covered procurement action as appropriate.
(g) Regulations.—
The Federal Acquisition Regulatory Council shall prescribe such regulations as may be necessary to carry out this section.
(h) Reports Required.—
Not less frequently than annually, the head of each executive agency that exercised the authority provided in subsection (a) or (c) during the preceding 12-month period shall submit to the appropriate congressional committees and leadership a report summarizing the actions taken by the agency under this section during that 12-month period.
(i) Rule of Construction.—
Nothing in this section shall be construed to authorize the head of an executive agency to carry out a covered procurement action based solely on the fact of foreign ownership of a potential procurement source that is otherwise qualified to enter into procurement contracts with the Federal Government.
(j) Termination.—
The authority provided under subsection (a) shall terminate on the date that is 5 years after the date of the enactment of the Federal Acquisition Supply Chain Security Act of 2018.
(k) Definitions.—In this section:
(1) Appropriate congressional committees and leadership.—The term “appropriate congressional committees and leadership” means—
(A)
the Committee on Homeland Security and Governmental Affairs, the Committee on the Judiciary, the Committee on Appropriations, the Committee on Armed Services, the Committee on Commerce, Science, and Transportation, the Select Committee on Intelligence, and the majority and minority leader of the Senate; and
(B)
the Committee on Oversight and Government Reform, the Committee on the Judiciary, the Committee on Appropriations, the Committee on Homeland Security, the Committee on Armed Services, the Committee on Energy and Commerce, the Permanent Select Committee on Intelligence, and the Speaker and minority leader of the House of Representatives.
(2) Covered article.—The term “covered article” means—
(A)
information technology, as defined in section 11101 of title 40, including cloud computing services of all types;
(B)
telecommunications equipment or telecommunications service, as those terms are defined in section 3 of the Communications Act of 1934 (47 U.S.C. 153);
(3) Covered procurement.—The term “covered procurement” means—
(A)
a source selection for a covered article involving either a performance specification, as provided in subsection (a)(3)(B) of section 3306 of this title, or an evaluation factor, as provided in subsection (b)(1)(A) of such section, relating to a supply chain risk, or where supply chain risk considerations are included in the agency’s determination of whether a source is a responsible source as defined in section 113 of this title;
(B)
the consideration of proposals for and issuance of a task or delivery order for a covered article, as provided in section 4106(d)(3) of this title, where the task or delivery order contract includes a contract clause establishing a requirement relating to a supply chain risk;
(C)
any contract action involving a contract for a covered article where the contract includes a clause establishing requirements relating to a supply chain risk; or
(4) Covered procurement action.—The term “covered procurement action” means any of the following actions, if the action takes place in the course of conducting a covered procurement:
(A)
The exclusion of a source that fails to meet qualification requirements established under section 3311 of this title for the purpose of reducing supply chain risk in the acquisition or use of covered articles.
(B)
The exclusion of a source that fails to achieve an acceptable rating with regard to an evaluation factor providing for the consideration of supply chain risk in the evaluation of proposals for the award of a contract or the issuance of a task or delivery order.
(C)
The determination that a source is not a responsible source as defined in section 113 of this title based on considerations of supply chain risk.
(5) Information and communications technology.—The term “information and communications technology” means—
(C)
telecommunications equipment and telecommunications services, as those terms are defined in section 3 of the Communications Act of 1934 (47 U.S.C. 153).
(6) Supply chain risk.—
The term “supply chain risk” means the risk that any person may sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate the design, integrity, manufacturing, production, distribution, installation, operation, maintenance, disposition, or retirement of covered articles so as to surveil, deny, disrupt, or otherwise manipulate the function, use, or operation of the covered articles or information stored or transmitted on the covered articles.