Federal Register / Vol. 86, No. 11 / Tuesday, January 19, 2021 / Rules and Regulations 4909 

DEPARTMENT OF COMMERCE 

15 CFR Part 7 

[Docket No. 210113–0009] 

RIN 0605–AA51 

Securing the Information and 

Communications Technology and 

Services Supply Chain 

AGENCY: U.S. Department of Commerce. 

ACTION: Interim final rule; request for 

comments. 

SUMMARY: The Department of Commerce 

is promulgating regulations to 

implement provisions of Executive 

Order 13873, ‘‘Executive Order on 

Securing the Information and 

Communications Technology and 

Services Supply Chain’’ (May 15, 2019). 

These regulations create the processes 

and procedures that the Secretary of 

Commerce will use to identify, assess, 

and address certain transactions, 

including classes of transactions, 

between U.S. persons and foreign 

persons that involve information and 

communications technology or services 

designed, developed, manufactured, or 

supplied, by persons owned by, 

controlled by, or subject to the 

jurisdiction or direction of a foreign 

adversary; and pose an undue or 

unacceptable risk. While this interim 

final rule will become effective on 

March 22, 2021, the Department of 

Commerce continues to welcome public 

input and is thus seeking additional 

public comment. Once any additional 

comments have been evaluated, the 

Department is committed to issuing a 

final rule. 

DATES: Effective March 22, 2021. 

Comments to the interim final rule 

must be received on or before March 22, 

2021. 

ADDRESSES: All comments must be 

submitted by one of the following 

methods: 

• By the Federal eRulemaking Portal: 

http://www.regulations.gov at docket 

number [DOC–2019–0005]. 

• By email directly to: 

ICTsupplychain@doc.gov. Include ‘‘RIN 

0605–AA51’’ in the subject line. 

• Instructions: Comments sent by any 

other method, to any other address or 

individual, or received after the end of 

the comment period, may not be 

considered. For those seeking to submit 

confidential business information (CBI), 

please clearly mark such submissions as 

CBI and submit by email, mail, or hand 

delivery as instructed above. Each CBI 

submission must also contain a 

summary of the CBI, clearly marked as 

public, in sufficient detail to permit a 

reasonable understanding of the 

substance of the information for public 

consumption. Such summary 

information will be posted on 

regulations.gov. 

• Supporting documents: 

Æ The Regulatory Impact Analysis is 

available at http://www.regulations.gov 

at docket number [DOC–2019–0005]; 

Æ The Center for Strategic & 

International Studies, ‘‘Significant 

Cyber Incidents 2020’’ is available at 

https://www.csis.org/programs/ 

technology-policy-program/significantcyber-incidents; 

Æ The National Security Strategy of 

the United States is available at https:// 

www.whitehouse.gov/wp-content/ 

uploads/2017/12/NSS-Final-12-18- 

2017-0905.pdf; 

Æ ODNI’s 2016–2019 Worldwide 

Threat Assessments of the U.S. 

Intelligence Community are available at 

https://www.dni.gov/files/documents/ 

Newsroom/Testimonies/ 

SSCI%20Unclassified%20SFR%20- 

%20Final.pdf (2017), https://

www.dni.gov/files/documents/ 

Newsroom/Testimonies/2018-ATA--- 

Unclassified-SSCI.pdf (2018), https://

www.dni.gov/files/ODNI/documents/ 

2019-ATA-SFR---SSCI.pdf (2019); and 

Æ The 2018 National Cyber Strategy 

of the United States of America is 

available at https://

www.whitehouse.gov/wp-content/ 

uploads/2018/09/National-CyberStrategy.pdf. 

FOR FURTHER INFORMATION CONTACT: 

Henry Young, U.S. Department of 

Commerce, telephone: (202) 482–0224. 

For media inquiries: Meghan Burris, 

Director, Office of Public Affairs, U.S. 

Department of Commerce, telephone: 

(202) 482–4883. 

SUPPLEMENTARY INFORMATION: 

I. Background 

The information and communications 

technology and services (ICTS) supply 

chain is critical to nearly every aspect 

of U.S. national security. U.S. business 

and governments at all levels rely 

heavily on ICTS, which: Underpin our 

economy; support critical infrastructure 

and emergency services; and facilitate 

the Nation’s ability to store, process, 

and transmit vast amounts of data, 

including sensitive information, that is 

used for personal, commercial, 

government, and national security 

purposes. The ICTS supply chain must 

be secure to protect our national 

security, including the economic 

strength that is an essential element of 

our national security. Ensuring the 

resilience of, and trust in, our ICTS 

supply chain is an issue that touches 

upon national security, including 

economic security, and public health 

and safety. 

The purchase, incorporation, and use 

by U.S. persons of ICTS—such as 

network management or data storage— 

produced by any person owned by, 

controlled by, or subject to the 

jurisdiction or direction of a foreign 

adversary—can create multiple 

opportunities for those foreign 

adversaries to exploit potential 

vulnerabilities in the ICTS. That, in 

turn, could cause direct and indirect 

harm to both the immediate targets of 

the adverse action and to the United 

States as a whole. While attacks can 

originate from remote foreign sources, 

incorporating certain software, 

equipment, and products into U.S. 

domestic ICTS networks, as well as the 

use of certain cloud, network 

management, or other services, greatly 

increases the risk that potential 

vulnerabilities may be introduced, or 

that vulnerabilities may be present 

without being detected. These potential 

vulnerabilities, if exploited, could 

undermine the confidentiality, integrity, 

and availability of U.S. person data 

including personally identifiable 

information or other sensitive personal 

data. 

Some foreign adversaries are known 

to exploit the sale of software and 

hardware to introduce vulnerabilities 

that can allow them to steal critical 

intellectual property, research results 

(e.g., health data), or government or 

financial information from users of the 

software or hardware. Such 

vulnerabilities can be introduced in the 

network, cloud service, or individual 

product data; allow traffic monitoring or 

surveillance; and may be resistant to 

detection by private purchasers or 

telecommunications carriers. Once 

detected, such vulnerabilities may be 

extremely costly or impossible to 

remediate. 

Vulnerabilities to data integrity can be 

created by including a foreign 

adversary’s hardware and software into 

U.S. networks and systems. This 

incorporated hardware and software 

poses opportunities to add or remove 

important information, modify files or 

data streams, slow down, or otherwise 

modify the normal transmission or 

availability of data across U.S. networks. 

Such capabilities could be exercised in 

areas as diverse as financial market 

communications, satellite 

communications or control, or sensitive 

consumer information. 

A foreign adversary could also exploit 

vulnerabilities provided by the 

incorporation of hardware and software 

into U.S. environments by fully or 


khammond on DSKJM1Z7X2PROD with RULES
4910 Federal Register / Vol. 86, No. 11 / Tuesday, January 19, 2021 / Rules and Regulations 

partially closing down critical networks 

or functions at key times. These types of 

attacks are known as denial of service 

attacks. Such attacks could cause 

widespread problems, such as if they 

occur during periods of crisis, or they 

could be used selectively by targeting 

individual corporations or important 

infrastructure elements or functions. 

They could also be masked to make the 

source of the disruption difficult to 

attribute and, therefore, difficult to trace 

and stop. 

These risks are not necessarily 

confined to infrastructure environments. 

They could, for example, be present in 

the use of cloud services, as well as in 

the widespread use of some consumer 

devices, networked surveillance 

cameras, drones, or interconnection via 

the internet of computing devices 

embedded in everyday objects, enabling 

them to send and receive data. For 

example, applications (‘‘apps’’), which 

may be downloaded from app stores or 

web browsers by a user to a mobile 

device, may automatically capture vast 

swaths of sensitive personal data from 

its users, including internet and other 

network activity information such as 

location data and browsing and search 

histories. This data exfiltration— 

supported by U.S. web data hosting and 

storage servers—threatens to allow 

foreign adversaries to exploit 

Americans’ personal and proprietary 

information by allowing a foreign 

adversary to track the locations of 

Americans, build dossiers of sensitive 

personal data for blackmail, and 

conduct corporate espionage from 

inside the borders of the United States. 

Multiple reported cybersecurity 

incidents in the United States and 

among major allies in 2020 illustrate the 

potential risk in permitting unrestricted 

access to U.S. ICTS supply chains, such 

as: 

—In July 2020, two Chinese hackers 

working with the Chinese Ministry of 

State Security were indicted by the 

U.S. Department of Justice for 

conducting a global computer 

intrusion campaign targeting U.S. 

intellectual property and confidential 

business information, including 

COVID–19 vaccine research; 

—German officials announced that a 

Russian hacking group associated 

with the Federal Security Bureau had 

compromised the networks of energy, 

water, and power companies in 

Germany by exploiting ICTS supply 

chains; and 

—Japan’s Defense Ministry announced 

it was investigating a large-scale cyber 

attack against Mitsubishi Electric that 

could have compromised details of 

new state-of-the-art missile designs. 

See, e.g., Center for Strategic & 

International Studies, ‘‘Significant 

Cyber Incidents 2020,’’ available at 

https://www.csis.org/programs/ 

technology-policy-program/significantcyber-incidents. 

Consequently, the President has 

determined that the unrestricted 

acquisition or use of ICTS that are 

designed, developed, manufactured, or 

supplied by persons owned by, 

controlled by, or subject to the 

jurisdiction or direction of a foreign 

adversary constitutes an unusual and 

extraordinary threat to the national 

security, foreign policy, and economy of 

the United States. 

Executive Order 13873 of May 15, 

2019, ‘‘Securing the Information and 

Communications Technology and 

Services Supply Chain’’ (84 FR 22689) 

(Executive Order), was issued pursuant 

to the President’s authority under the 

Constitution and the laws of the United 

States, including the International 

Emergency Economic Powers Act (50 

U.S.C. 1701 et seq.) (IEEPA), the 

National Emergencies Act (50 U.S.C. 

1601 et seq.), and section 301 of Title 3, 

United States Code. IEEPA and the 

Executive Order grant the Secretary of 

Commerce (Secretary) the authority to 

prohibit any acquisition, importation, 

transfer, installation, dealing in, or use 

of any ICTS (an ‘‘ICTS Transaction’’) by 

any person, or with respect to any 

property, subject to United States 

jurisdiction, when such ICTS 

Transaction involves any property in 

which a foreign country or national has 

any interest, and the Secretary, in 

consultation with other agency heads 

(the Secretary of the Treasury, the 

Secretary of State, the Secretary of 

Defense, the Attorney General, the 

Secretary of Homeland Security, the 

United States Trade Representative, the 

Director of National Intelligence, the 

Administrator of General Services, the 

Chairman of the Federal 

Communications Commission, and the 

heads of any other executive 

departments and agencies as the 

Secretary determines is appropriate) 

determines that the ICTS Transaction: 

(1) Involves ICTS designed, developed, 

manufactured, or supplied by persons 

owned by, controlled by, or subject to 

the jurisdiction or direction of a foreign 

adversary; and (2) poses an undue or 

unacceptable risk. Executive Order, 

Section 1(a). The Executive Order 

further provides the Secretary with the 

authority to prohibit such an ICTS 

Transaction or ‘‘design or negotiate 

measures to mitigate concerns’’ about an 

ICTS Transaction’s impact on national 

security. Executive Order, Section 1(b). 

On November 27, 2019, the 

Department of Commerce (Department) 

published a proposed rule to implement 

the terms of the Executive Order. (84 FR 

65316). The proposed rule set forth 

processes for (1) how the Secretary 

would evaluate and assess transactions 

involving ICTS to determine whether 

they pose an undue risk of sabotage to 

or subversion of the ICTS supply chain, 

or an unacceptable risk to the national 

security of the United States or the 

security and safety of U.S. persons; (2) 

how the Secretary would notify parties 

to transactions under review of the 

Secretary’s decision regarding the ICTS 

Transaction, including whether the 

Secretary would prohibit or mitigate the 

transaction; and (3) how parties to 

transactions reviewed by the Secretary 

could comment on the Secretary’s 

preliminary decisions. The proposed 

rule also provided that the Secretary 

could act without complying with the 

proposed procedures where required by 

national security. Finally, the Secretary 

would establish penalties for violations 

of mitigation agreements, the 

regulations, or the Executive Order. 

In addition to seeking general public 

comment, the Department requested 

comments from the public on five 

specific questions: (1) Whether the 

Secretary should consider categorical 

exclusions or whether there are classes 

of persons whose use of ICTS cannot 

violate the Executive Order; (2) whether 

there are categories of uses or of risks 

that are always capable of being reliably 

and adequately mitigated; (3) how the 

Secretary should monitor and enforce 

any mitigation agreements applied to a 

transaction; (4) how the terms, 

‘‘transaction,’’ ‘‘dealing in,’’ and ‘‘use 

of’’ should be clarified in the rule; and 

(5) whether the Department should add 

record-keeping requirements for 

information related to transactions. 

In response to requests for additional 

time in which to comment on the 

proposed rule, the Department extended 

the initial comment period from 

December 27, 2019, until January 10, 

2020. (84 FR 70445). As reflected 

herein, the Department has carefully 

considered and addressed the public’s 

comments in promulgating this rule. 

Nonetheless, because several 

commenters requested that the 

Department provide for an additional 

round of public comment, and in an 

effort to continue the Department’s work 

to protect the national security while 

reducing the regulatory impact on the 

public, the Department is taking further 

public comment on the rule. However, 

mindful of the urgent need of the United 

States to address national security 

concerns related to ICTS Transactions, 


khammond on DSKJM1Z7X2PROD with RULES
Federal Register / Vol. 86, No. 11 / Tuesday, January 19, 2021 / Rules and Regulations 4911 

this interim final rule will be effective 

March 22, 2021. The Department is 

committed to issuing a subsequent final 

rule in which the Department will 

consider and respond to additional 

comments received. In addition, the 

Department will implement and publish 

procedures for a licensing process by 

May 19, 2021. 

II. Response to Comments 

During the public comment period on 

the proposed rule, the Department 

received a number of written 

submissions reflecting a wide range of 

views. All comments received by the 

end of the comment period are available 

on the public rulemaking docket at 

https://www.regulations.gov. 

Additionally, the Department 

participated in a number of meetings 

with foreign governments and industry 

groups to discuss the proposed rule 

prior to the comment period ending. 

Summaries of those meetings are 

available at https://

www.regulations.gov. Below, the 

Department addresses the comments as 

they pertain to each relevant provision 

of the regulation. 

§ 7.2 Definitions 

§ 7.2—Definition of ‘‘appropriate agency 

heads’’ 

Numerous comments addressed the 

extent to which the Department 

interacts with other agencies and 

department heads throughout the 

process for reviewing ICTS 

Transactions. Some commenters 

advocated for the rule to require 

interagency review of all parts of the 

investigations and final determinations, 

while other commenters noted that 

interagency review should only happen 

during certain parts of the review 

process. Other commenters requested 

that the Secretary notify the heads of 

relevant agencies when a review is 

initiated. 

Requirements regarding interagency 

review are already contained within the 

Executive Order and, thus, are not 

subject to change. 

Nevertheless, for clarification, the 

Department has replaced the term 

‘‘identified secretaries’’ with 

‘‘appropriate agency heads,’’ to address 

the fact that some of the individuals 

referenced are not Cabinet Secretaries, 

but rather are heads of agencies. For 

clarity, the term ‘‘appropriate agency 

heads’’ refers to the Secretary of the 

Treasury, the Secretary of State, the 

Secretary of Defense, the Attorney 

General, the Secretary of Homeland 

Security, the United States Trade 

Representative, the Director of National 

Intelligence, the Administrator of 

General Services, the Chairman of the 

Federal Communications Commission, 

and the heads of any other executive 

departments and agencies the Secretary 

of Commerce determines is appropriate. 

The Executive Order makes clear the 

Secretary of Commerce will confer with 

other agencies and departments as 

needed. 

§ 7.2—Definition of ‘‘Department’’ 

Although it was not defined in the 

proposed rule, the Department has 

added a definition of the term 

‘‘Department’’ to clarify that it refers to 

the United States Department of 

Commerce, rather than any other 

Cabinet-level agency. 

§ 7.2—Definition of ‘‘foreign adversary’’ 

The rule grants the Secretary the 

authority to block or mitigate certain 

ICTS Transactions involving a foreign 

adversary. Commenters suggested 

limiting the definition of a ‘‘foreign 

adversary’’ to entities already identified 

in legislation. Some commenters 

recommended changing the concept of 

‘‘foreign adversary’’ to focus on entities 

or persons instead of nation-states. 

Other commenters suggested that the 

Department create a list of adversaries 

and a list of exempt countries and 

distinguish between government and 

non-governmental entities. Commenters 

also recommended narrowing the scope 

of the term ‘‘foreign adversary’’ to 

situations where a foreign adversary has 

controlling interest in the company 

executing the covered transaction. 

The rule makes no changes to the 

definition of ‘‘foreign adversary,’’ which 

is consistent with the Executive Order’s 

definition. However, as discussed 

further below, the rule now includes a 

provision titled ‘‘Determination of 

foreign adversaries’’ in section 7.4. This 

provision sets out the list of foreign 

governments and foreign nongovernment persons that the Secretary 

has determined, solely for the purposes 

of the Executive Order, this rule, and 

any subsequent rules, are ‘‘foreign 

adversaries.’’ It also explains some of 

the factors that the Secretary 

considered, and will consider, when 

making any future determinations of 

whether a country is a ‘‘foreign 

adversary.’’ Pursuant to the Secretary’s 

discretion, the list of foreign adversaries 

will be revised as determined to be 

necessary. Because the determination of 

foreign adversaries is subject solely to 

the Secretary’s discretion, such 

revisions will be effective immediately 

upon publication in the Federal 

Register without prior notice or 

opportunity for public comment. 

The list of ‘‘foreign adversaries’’ 

consists of the following foreign 

governments and non-government 

persons: The People’s Republic of 

China, including the Hong Kong Special 

Administrative Region (China); the 

Republic of Cuba (Cuba); the Islamic 

Republic of Iran (Iran); the Democratic 

People’s Republic of Korea (North 

Korea); the Russian Federation (Russia); 

and Venezuelan politician Nicola ́s 

Maduro (Maduro Regime). The 

provision clarifies that the Secretary’s 

determination is based on multiple 

sources, including the National Security 

Strategy of the United States, the Office 

of the Director of National Intelligence’s 

2016–2019 Worldwide Threat 

Assessments of the U.S. Intelligence 

Community, and the 2018 National 

Cyber Strategy of the United States of 

America, as well as other reports and 

assessments from the U.S. Intelligence 

Community, the U.S. Departments of 

Justice, State and Homeland Security, 

and other relevant sources. 

Additionally, the provision notes that 

the Secretary will periodically review 

this list in consultation with appropriate 

agency heads and may add to, subtract 

from, supplement, or otherwise amend 

the list. 

It is important to note that the list at 

section 7.4 identifies ‘‘foreign 

adversaries’’ solely for the purposes of 

the Executive Order, this rule, and any 

subsequent rules. It does not reflect a 

determination by the United States 

about the nature of such foreign 

governments or foreign non-government 

persons for any other purpose. 

§ 7.2—Definition of ‘‘ICTS Transaction’’ 

The proposed rule defined the term 

‘‘transaction’’ using terms from the 

Executive Order, to mean, ‘‘any 

acquisition, importation, transfer, 

installation, dealing in, or use of any 

information and communications 

technology or service.’’ It also noted that 

the term ‘‘transaction’’ ‘‘includes a class 

of transactions.’’ 

Some commenters requested the 

Department refine the definition of 

‘‘transaction’’ in various ways. For 

example, some commenters suggested 

adopting language from the Securities 

Exchange Act of 1934 to define some of 

the terms in the definition, such as 

‘‘dealing in.’’ Others urged the 

Department to further clarify the 

definition ‘‘transaction’’ to define the 

terms ‘‘acquisition,’’ or ‘‘use’’ in the 

definition. 

The Department acknowledges that 

the terms ‘‘transaction,’’ ‘‘acquisition,’’ 

and ‘‘use’’ are broad, and retain their 

commonly-accepted meanings in the 

rule. The concerns raised by the 


khammond on DSKJM1Z7X2PROD with RULES
4912 Federal Register / Vol. 86, No. 11 / Tuesday, January 19, 2021 / Rules and Regulations 

commenters are addressed by defining 

the term ‘‘ICTS Transaction’’ to include 

(1) ‘‘ongoing activities, such as managed 

services, data transmission, software 

updates, repairs, or the platforming or 

data hosting of applications for 

consumer download;’’ and (2) ‘‘any 

other transaction, the structure of which 

is designed or intended to evade or 

circumvent the application of the 

Executive Order.’’ The purpose of these 

additions is to clarify that the Secretary 

may review ICTS Transactions, 

including the provision of services, that 

occur on or after January 19, 2021, by 

any person owned by, controlled by, or 

subject to the jurisdiction or direction of 

a foreign adversary. Providing services, 

such as software updates, to U.S. 

persons may provide a foreign adversary 

an opportunity to engage in the types of 

activities that may threaten U.S. 

national security, as described above. 

Further, the definition of ICTS 

Transaction clarifies that attempting to 

structure a transaction in order to 

circumvent Secretarial review is 

nonetheless an ICTS Transaction subject 

to this rule. 

§ 7.2—Definition of ‘‘party or parties to 

a transaction’’ 

Several commenters expressed an 

interest in the Department further 

clarifying what entities are covered by 

the rule. Further, in revising the 

proposed rule for finalization, the 

Department used the term ‘‘party to a 

transaction’’ in several instances and 

believes it would be beneficial to define 

that term. Accordingly, the rule adds a 

definition of ‘‘party or parties to a 

transaction,’’ to mean a person engaged 

in an ICTS Transaction, including the 

person acquiring the ICTS and the 

person from whom the ICTS is acquired. 

The term ‘‘person’’ is also defined by 

the rule and is unchanged from the 

proposed rule. 

‘‘Party or parties to a transaction’’ 

include entities designed or intended to 

evade or circumvent application of the 

Executive Order. For purposes of this 

rule, this definition does not include 

common carriers that transport goods 

for a fee on behalf of the general public, 

except to the extent that a common 

carrier knows, or should have known (as 

the term ‘‘knowledge’’ is defined in 15 

CFR 772.1), it was providing 

transportation services of ICTS to one or 

more of the parties to a transaction that 

has been prohibited in a final written 

determination made by the Department 

or permitted subject to mitigation 

measures. 

This addition narrows the scope of 

the rule by adding clarity regarding 

which persons are responsible for a 

reviewable transaction. This also affects 

which parties will be notified by the 

Department regarding any potential 

review of a transaction. 

§ 7.2—Definition of ‘‘Person owned by, 

controlled by, or subject to the 

jurisdiction or direction of a foreign 

adversary’’ 

In addition to defining ‘‘party or 

parties to a transaction,’’ the Department 

sought to add clarity to the rule by 

defining the phrase ‘‘person owned by, 

controlled by, or subject to the 

jurisdiction or direction of a foreign 

adversary,’’ as many commenters 

expressed concern that leaving such 

terms undefined might create confusion 

about the breadth of the rule’s reach. 

The Department defines ‘‘person owned 

by, controlled by, or subject to the 

jurisdiction or direction of a foreign 

adversary’’ to mean ‘‘any person, 

wherever located, who acts as an agent, 

representative, or employee, or any 

person who acts in any other capacity 

at the order, request, or under the 

direction or control, of a foreign 

adversary or of a person whose activities 

are directly or indirectly supervised, 

directed, controlled, financed, or 

subsidized in whole or in majority part 

by a foreign adversary; any person, 

wherever located, who is a citizen or 

resident of a nation-state controlled by 

a foreign adversary; any corporation, 

partnership, association, or other 

organization organized under the laws 

of a nation-state controlled by a foreign 

adversary; and any corporation, 

partnership, association, or other 

organization, wherever organized or 

doing business, that is owned or 

controlled by a foreign adversary.’’ 

§ 7.2—Sensitive Personal Data 

Many commenters requested 

additional clarity about the specific 

ICTS that is subject to this rule. While 

it is impossible to identify all of the 

ICTS that may present undue or 

unnecessary risks, the Department has 

defined the term, ‘‘sensitive personal 

data,’’ to identify, along with the 

information identified in section 7.3 of 

the rule, some of types of information or 

communications that might be involved 

in an ICTS Transaction reviewed under 

this rule where a party or parties to a 

transaction use, possess, or retain, or are 

expected to use, possess, or retain 

sensitive personal data. 

The term ‘‘sensitive personal data’’ 

includes: (1) Personally Identifiable 

Information (i.e., data that can identify 

individuals) that is maintained or 

collected by a U.S. business operating in 

specific areas, and that is maintained or 

collected on over one million people 

over a 12 month period; and (2) results 

of individual genetic testing. 

The categories of identifiable data of 

concern to the Department are: 

Financial data that could be used to 

indicate an individual’s financial 

distress or hardship; the set of data 

included in consumer reports; the set of 

data used for health and certain 

financial insurance applications; data 

relating to the physical, mental, or 

psychological health condition of an 

individual; non-public electronic 

communication information, such as 

personal emails; geolocation data used 

in certain technologies; biometric data; 

data stored and processed for generating 

Federal, State, Tribal, Territorial, or 

other government identification cards; 

data concerning U.S. Government 

personnel security clearance status; and 

data from security clearance or 

employment applications. 

As indicated in section 7.3, Scope, the 

Department believes that ICTS 

Transactions involving sensitive 

personal data could create risks for the 

U.S. national security and also believes 

it is important to specifically identify 

these categories of data to provide the 

regulated community with additional 

specificity and certainty as to the scope 

of the rule’s application. 

§ 7.2—Definition of ‘‘Undue or 

unacceptable risk’’ 

Commenters recommended various 

alternative uses for and limits on this 

term. For example, some suggested that 

the Department identify certain 

industries or types of transactions that 

do not pose a risk to national security, 

and that the Department should exempt 

certain types of transactions from the 

rule. 

Most of the suggestions could 

unnecessarily limit the United States’ 

ability to determine its national security 

interests and, thus, could limit the 

ability to protect the Nation. However, 

the Department agrees the term requires 

definition, and in this rule adopts the 

definition of ‘‘undue or unacceptable 

risks’’ as those risks identified in 

Section 1(a)(ii) of the Executive Order. 

Section 1(a)(ii) of the Executive Order 

includes the following risks . . . an 

undue risk of sabotage to or subversion 

of the design, integrity, manufacturing, 

production, distribution, installation, 

operation, or maintenance of 

information and communications 

technology or services in the United 

States; . . . an undue risk of 

catastrophic effects on the security or 

resiliency of United States critical 

infrastructure or the digital economy of 

the United States; or . . . an 

unacceptable risk to the national 


khammond on DSKJM1Z7X2PROD with RULES
Federal Register / Vol. 86, No. 11 / Tuesday, January 19, 2021 / Rules and Regulations 4913 

security of the United States or the 

security and safety of United States 

persons. 

§ 7.3 Scope of Covered ICTS 

Transactions 

Many commenters suggested ways the 

Department could narrow the scope of 

the rule to provide more guidance for 

the types of transactions the Department 

may review. For example, commenters 

noted the potential impact of the 

proposed rule on certain types of 

transactions, such as transportation 

services of ICTS, and argued the rule 

would harm commenters’ industries. 

They also argued that the proposed rule 

was overly broad and that narrowing the 

scope would bring greater economic 

certainty to ICTS Transactions and the 

technology industry as a whole. 

Other commenters sought to have the 

Department identify categorical 

exemptions for select industries, such as 

ICTS Transactions involving medical 

devices or services for air traffic control, 

while yet others sought to exempt 

transactions involving companies with 

their business headquarters in allied 

nations, such as Japan. Commenters also 

suggested that, provided appropriate 

cybersecurity mitigation techniques 

exist, transactions involving otherwise 

banned equipment should be exempted 

from this rule. 

The Department concludes that 

categorical exemptions of specific 

industries or geographic locations are 

unwarranted at this time, although the 

Secretary may consider this possibility 

in the future. Wholesale exemptions of 

industries and geographic locations 

would not serve the rule’s intended 

purpose of securing the ICTS supply 

chain because such exemptions would 

contradict the Department’s evaluation 

method for ICTS Transactions. Such 

exemptions would indicate to foreign 

adversaries whole classes of ICTS 

Transactions outside the scope of 

evaluation under this rule. This would 

allow foreign adversaries to pinpoint 

certain types of ICTS Transactions that 

would more easily escape Departmental 

oversight and, therefore, threaten U.S. 

national security. By retaining broad 

authority across industries, the 

Department will be better able to 

mitigate identified risks. 

While the rule does not contain 

categorical exemptions of specific 

industries or geographic locations, the 

rule now specifies that ICTS 

Transactions that involve certain 

technologies, hardware, or software will 

be considered to be covered ICTS 

Transactions. Additionally, the rule 

does make clear that, as further 

discussed below, the acquisition of ICTS 

items by a United States person as a 

party to a transaction authorized under 

a U.S. government-industrial security 

program, is not an ICTS Transaction. 

Additionally, the Department 

acknowledges that ICTS Transactions 

solely involving personal ICTS 

hardware devices, such as handsets, do 

not warrant particular scrutiny. 

§ 7.3—Technology Sectors 

Many commenters requested that the 

Department identify those technologies 

or products that the Department 

considers create the greatest risks to the 

national security of the United States. 

The Department understands the desire 

for additional certainty and broke down 

the scope of technologies included 

under the scope of this rule into six 

main types of ICTS Transactions 

involving: (1) ICTS that will be used by 

a party to a transaction in a sector 

designated as critical infrastructure by 

Presidential Policy Directive 21— 

Critical Infrastructure Security and 

Resilience, including any subsectors or 

subsequently designated sectors; (2) 

software, hardware, or any other 

product or service integral to wireless 

local area networks, mobile networks, 

satellite payloads, satellite operations 

and control, cable access points, 

wireline access points, core networking 

systems, or long- and short-haul 

systems; (3) software, hardware, or any 

other product or service integral to data 

hosting or computing services that uses, 

processes, or retains, or is expected to 

use, process, or retain, sensitive 

personal data on greater than one 

million U.S. persons at any point over 

the twelve months preceding an ICTS 

Transaction; (4) certain ICTS products 

which greater than one million units 

have been sold to U.S. persons at any 

point over the twelve months prior to an 

ICTS Transaction; (5) software designed 

primarily for connecting with and 

communicating via the internet that is 

in use by greater than one million U.S. 

persons at any point over the twelve 

months preceding an ICTS Transaction; 

(6) ICTS integral to artificial intelligence 

and machine learning, quantum key 

distribution, quantum computing, 

drones, autonomous systems, or 

advanced robotics. 

§ 7.3—Licensing Process for Potential 

Transactions 

Many commenters requested that the 

Department establish a process for 

entities to seek pre-approval of their 

ICTS Transactions, similar to the 

process by which entities may inform 

the Committee on Foreign Investment in 

the United States (CFIUS) of 

investments in U.S. businesses, and 

obtain ‘‘safe harbor’’ for those 

transactions. Commenters argued that 

such a process would help ease business 

uncertainty in specific cases. 

To afford parties greater certainty, 

within 60 days of the publication date 

of this rule, the Department intends to 

publish procedures to allow a party or 

parties to a proposed, pending, or 

ongoing ICTS Transaction to seek a 

license, pursuant to Section 2(b) of the 

Executive Order, in a manner consistent 

with the national security of the United 

States. Within 120 days of the 

publication date of this rule, the 

Department intends to implement this 

licensing process. The published 

procedures will establish criteria by 

which persons may seek a license to 

enter into a proposed or pending ICTS 

Transaction or engage in an ongoing 

ICTS Transaction. Persons who may 

seek a license will include any parties 

to a proposed, pending, or ongoing ICTS 

Transaction as that term is defined in 

this rule. License application reviews 

will be conducted on a fixed timeline, 

not to exceed 120 days from accepting 

a license application, to enable 

qualifying parties to conclude 

permissible transactions without undue 

delay. If the Department does not issue 

a license decision within 120 days from 

accepting a license application, the 

application will be deemed granted. In 

no event, however, would the 

Department issue a license decision on 

an ICTS Transaction that would reveal 

sensitive information to foreign 

adversaries or others who may seek to 

undermine U.S. national security. 

Qualifying parties may voluntarily 

apply for a license, and a party’s 

decision not to seek a license will not 

create a negative inference or 

unfavorable presumption with respect 

to a transaction. 

§ 7.3—Presidential Policy Directive 21— 

Critical Infrastructure Security and 

Resilience 

Regarding the Department’s 

assessment of undue and unacceptable 

risk, commenters suggested that the 

Department create risk criticality 

categories for transactions, such as low, 

medium, and high, along with different 

assessment approaches. Other 

commenters advocated using risk scores 

or categories to determine the frequency 

and rigor of monitoring. 

The Department agrees that the scope 

of the rule could be narrowed to 

indicate more specifically the types of 

ICTS Transactions that may be 

reviewed. Accordingly, the Department 

clarifies that ICTS Transactions include 

those that involve, among other aspects, 

a sector designated as critical 


khammond on DSKJM1Z7X2PROD with RULES
4914 Federal Register / Vol. 86, No. 11 / Tuesday, January 19, 2021 / Rules and Regulations 

infrastructure by Presidential Policy 

Directive 21—Critical Infrastructure 

Security and Resilience, including any 

subsectors or subsequently designated 

sectors. As explained below, the 

Department has also clarified that 

transactions involving certain sensitive 

personal data, regardless of whether 

they involve a critical infrastructure 

sector, will be considered ICTS 

Transactions for the purposes of the 

rule. 

§ 7.3—Exclusions 

Many commenters sought clarity 

about the relationship of this rule to the 

rules relating to CFIUS’s review of 

transactions. In response, the 

Department is clarifying that this rule 

does not apply to an ICTS Transaction 

that CFIUS is actively reviewing, or has 

reviewed, as a covered transaction or 

covered real estate transaction or as part 

of such a transaction under section 721 

of the Defense Production Act of 1950, 

as amended, and its implementing 

regulations. Note, however, that a 

transaction involving ICTS that is 

separate from, and subsequent to, a 

transaction for which CFIUS has 

concluded action under section 721 may 

be subject to review under this rule, if 

and to the extent that such transactions 

are separate from the transaction 

reviewed by CFIUS. Parties should 

therefore be aware that CFIUS review 

related to a particular ICTS, by itself, 

does not present a safe harbor for future 

transactions involving the same ICTS 

that may present undue or unnecessary 

risks as determined by the Department. 

§ 7.3—Exclusions of ICTS Transactions 

Commenters requested categorical 

exclusions across many sectors, 

industries, functions, and nations. The 

Secretary recognizes the need to be 

judicious and deliberate in deciding 

what types of ICTS Transactions pose an 

undue or unacceptable risk. To that end, 

the rule excludes from the scope of the 

rule those transactions that involve the 

acquisition of ICTS items by a United 

States person as a party to a transaction 

authorized under a U.S. Governmentindustrial security program, because 

they are subject to continuous security 

oversight by, and contractual obligations 

to, other Federal agencies. 

§ 7.3—Retroactivity of Rule’s 

Applicability 

Some commenters argued that the 

rule should not apply to transactions 

that took place prior to May 15, 2019, 

when the Executive Order was issued. 

Other commenters advocated for the 

complete elimination of the proposed 

rule’s retroactivity provisions, and 

proposed the Department only evaluate 

potential transactions prospectively. 

Other commenters proposed 

grandfathering some ICTS equipment 

for a predetermined duration, 

potentially up to 10 years. In reviewing 

these comments and the proposed rule, 

the Department determined that the 

temporal limits of the rule’s application 

could be clarified. 

In response to these comments, the 

Department has clarified, in section 

7.3(a)(3), that the rule applies to an ICTS 

Transactions that is initiated, pending, 

or completed on or after January 19, 

2021. Further, any act or service with 

respect to an ICTS Transaction, such as 

execution of any provision of a managed 

services contract or installation of 

software updates, is an ICTS 

Transaction on the date that the service 

or update is provided. Thus, if a person 

that is owned by, controlled by, or 

subject to the jurisdiction or direction of 

a foreign adversary engages in an ICTS 

Transaction with a person subject to the 

jurisdiction of the United States on or 

after January 19, 2021, even if the 

service was provided pursuant to a 

contract initially entered into prior to 

January 19, 2021, that transaction is an 

ICTS Transaction that may be reviewed 

under this rule. The service is a new 

transaction separate from the underlying 

contract that will be subject to review by 

the Secretary. 

§ 7.4 Determination of Foreign 

Adversaries 

As noted above, many commenters 

requested the Department identify those 

countries that it considers to be ‘‘foreign 

adversaries.’’ Naming these countries, 

the commenters argued, would facilitate 

global trade by allowing U.S. businesses 

to assess the risks of certain types of 

ICTS Transactions from certain 

countries. It would also allow 

companies to adjust their supply chains 

to avoid the risks in such transactions, 

including the risk of an ICTS 

Transaction being reviewed, and 

possibly prohibited or modified, under 

this rule. Several commenters also noted 

that defining ‘‘foreign adversaries’’ 

would help determine, and possibly 

reduce, the adverse economic impact 

the rule may have on businesses 

through better business planning. 

In response to these comments, the 

Department reconsidered its prior 

determination not to identify specific 

‘‘foreign adversaries.’’ The Department 

has determined that it is beneficial for 

the clarity of the rule, as well as for 

persons with ICTS Transactions that 

may be subject to the rule, to identify 

certain foreign governments and foreign 

non-government persons that are 

considered, solely for the purposes of 

the Executive Order, this rule, and any 

subsequent rules, to be ‘‘foreign 

adversaries.’’ The list of foreign 

governments and foreign nongovernment persons this rule identifies 

as being ‘‘foreign adversaries’’ are: The 

People’s Republic of China, including 

the Hong Kong Special Administrative 

Region (China); the Republic of Cuba 

(Cuba); the Islamic Republic of Iran 

(Iran); the Democratic People’s Republic 

of Korea (North Korea); the Russian 

Federation (Russia); and Venezuelan 

politician Nicola ́s Maduro (Maduro 

Regime). The Secretary identified these 

foreign adversaries because they have 

engaged in a long-term pattern or 

serious instances of conduct 

significantly adverse to the national 

security of the United States or security 

and safety of United States persons, 

including taking actions and enacting 

policies that are inimical to the interests 

of the United States. 

The determination to identify these 

‘‘foreign adversaries’’ is based on 

multiple sources, including threat 

assessments and reports from the U.S. 

Intelligence Community, the U.S. 

Departments of Justice, State, and 

Homeland Security, and other relevant 

sources. Additionally, the Secretary will 

periodically review this list in 

consultation with appropriate agency 

heads and may add to, subtract from, 

supplement, or otherwise amend the 

list. Accordingly, this list may be 

revised at any time in the future. Any 

such changes will be announced in the 

Federal Register. 

It is important to note that the list is 

solely for the purposes of the Executive 

Order, this rule, and any subsequent 

rules and does not reflect a 

determination by the United States 

about the nature of such foreign 

governments and foreign nongovernment persons for any purposes 

other than that ICTS Transactions with 

persons (as defined in this rule) owned 

by, controlled by, or subject to the 

jurisdiction or direction of an identified 

foreign adversary may pose an undue or 

unacceptable risk. Further, the rule 

states that any amendment to this list 

will apply to any ICTS Transaction that 

is initiated, pending, or completed on or 

after the date that the list is amended. 

§ 7.5 Effect on Other Laws 

Many commenters suggested that this 

rule should not apply if overlapping and 

existing U.S. authorities are in force, 

referencing in particular existing 

national security regulatory regimes. 

Specifically, commenters pointed to 

CFIUS; authorities under various 

National Defense Authorization Acts; 


khammond on DSKJM1Z7X2PROD with RULES
Federal Register / Vol. 86, No. 11 / Tuesday, January 19, 2021 / Rules and Regulations 4915 

the Export Administration Regulations; 

the Committee for the Assessment of 

Foreign Participation in the United 

States Telecommunications Services 

Sector (i.e., Team Telecom); and other 

programs under the authority of the 

Federal Communications Commission, 

the Department of Homeland Security, 

and the Office of the Director of 

National Intelligence. Other commenters 

recommended exempting equipment 

provided by companies involved in 

mitigation agreements with the Federal 

Government. 

This rule does not alter or affect any 

of these existing authorities; it is 

intended to complement, not supplant, 

these existing regimes. However, the 

Department understands the need for 

regulatory and business certainty, and 

in the interest of not duplicating efforts 

by other parts of the U.S. Federal 

government, the rule states that it does 

not apply to ICTS Transactions that 

CFIUS is actively reviewing, or has 

reviewed, as a covered transaction or 

covered real estate transaction or as part 

of such a transaction under section 721 

of the Defense Production Act of 1950, 

as amended, and its implementing 

regulations. However, this exclusion in 

no way precludes a review of a 

subsequent ICTS Transaction if distinct 

from the previously CFIUS-reviewed 

transaction or new information is 

discovered. 

Other provisions of the rule provide 

additional means of ensuring that any 

action taken by the Secretary neither 

conflicts with nor frustrates the 

purposes of other existing laws, 

regulations or processes. Thus, there are 

two separate points during the review 

process at which the Secretary is 

expressly required to consult with 

appropriate agency heads: before 

making an initial determination that the 

transactions is an ICTS Transaction that 

poses an undue or unacceptable risk 

(section 7.104) and before making a final 

determination (section 7.108). In 

requiring that the Secretary consult with 

other agency heads, the rule provides 

for a coordination mechanism with 

other agencies and Departments that 

have potentially overlapping 

jurisdiction. For example, before making 

an initial determination concerning a 

transaction, the review of which might 

potentially overlap with a review under 

CFIUS, the Secretary is required to 

consult with, among others, the 

Secretary of the Treasury, who serves as 

the Chairperson of CFIUS, thereby 

helping to ensure coordination and 

avoid redundancy. 

In addition, section 7.100(a) of the 

rule provides that the Secretary may 

consider all relevant information 

provided by any U.S. Government 

national security body or other Federal 

Government agency, department or 

regulatory body in determining what 

action may be necessary to ameliorate a 

threat posed by an ICTS Transaction. 

Subpart B—Review of ICTS 

Transactions 

Commenters largely recommended 

the final rule clarify the review process, 

requesting the specific criteria by which 

the Department will use to review 

transactions. As a whole, Subpart B 

adds a more detailed review process, as 

requested by commenters. 

§ 7.100 General 

§ 7.100(a)—Consideration of Relevant 

Information 

Many commenters sought clarity as to 

the type of information on which the 

Secretary could base a determination to 

commence an evaluation of a 

transaction. In response to these 

comments, section 7.100(a) identifies 

sources or information, factors, and 

other variables related to a transaction 

that the Secretary may consider when 

reviewing a transaction. This list is nonexclusive and does not prevent the 

Secretary from reviewing any available 

information; the list is intended to 

provide parties to transactions with 

greater clarity about the types of 

materials on which the Secretary may 

rely when deciding whether to review 

(and during that review of) a 

transaction. 

The rule states that the Secretary may 

consider information provided by any 

U.S. Government national security body 

or other Federal agencies. In addition, 

the rule clarifies that the Secretary, 

when making determinations about 

specific transactions, may also consider 

information that includes: (1) Relevant 

public information; (2) confidential 

business or proprietary information; (3) 

classified national security information; 

(4) information from State, local, tribal, 

or foreign governments; (5) information 

from parties to a transaction, including 

records related to such transaction that 

any party keeps or uses, or would be 

expected to keep or use, in their 

ordinary course of business for such a 

transaction; (6) information obtained 

through the authority granted under 

sections 2(a) and (c) of the Executive 

Order and IEEPA; and (7) information 

provided by any other U.S. Government 

agency, department, or other regulatory 

body. 

The rule further revises section 

7.100(a) to specify that information may 

be obtained through any administrative 

investigative or enforcement action 

undertaken pursuant to the authority 

granted under sections 2(a) and (c) of 

the Executive Order and IEEPA. The 

purpose of this clarification is to set out 

precisely the authorities that grant the 

Secretary the power to access and 

collect documents related to 

investigations and determinations of 

potentially prohibited transactions. 

§ 7.100(c)—Determining Foreign 

Adversary Involvement 

In order to provide industry with 

more clarity regarding the determination 

of whether an ICTS Transaction 

involves ICTS designed, developed, 

manufactured, or supplied, by persons 

owned by, controlled by, or subject to 

the jurisdiction or direction of a foreign 

adversary, the Department added 

guidance about what information it will 

consider when making these decisions. 

These factors include: (1) Whether the 

party or its component suppliers have 

headquarters, research, development, 

manufacturing, test, distribution, or 

service facilities or other operations in 

a foreign country, including one 

controlled by a foreign adversary; (2) 

personal and professional ties between 

the party—including its officers, 

directors or similar officials, employees, 

consultants, or contractors—and any 

foreign adversary; (3) laws and 

regulations of the foreign adversary in 

which the party is headquartered or 

conducts operations, including research 

and development, manufacturing, 

packaging, and distribution; and (4) any 

other criteria that the Secretary deems 

appropriate. 

§ 7.100(d)—Factors for Determining an 

Undue or Unacceptable Risk 

Commenters also requested additional 

information from the Department about 

how it will determine whether an ICTS 

Transaction poses an undue or 

unacceptable risk. Along with listing 

factors to help determine the 

relationship between a foreign party to 

an ICTS Transaction and a foreign 

adversary, the Department has provided 

guidance on some of the information 

that the Secretary, in consultation with 

the appropriate agency heads, will 

consider when determining the impact 

of an ICTS Transaction on U.S. national 

security. 

Specifically, when determining 

whether an ICTS Transaction poses an 

undue or unacceptable risk, the 

Secretary and the appropriate agency 

heads will consider factors such as: (1) 

Threat assessments and reports 

prepared by the Director of National 

Intelligence pursuant to section 5(a) of 

the Executive Order; (2) removal or 

exclusion orders issued by the Secretary 


khammond on DSKJM1Z7X2PROD with RULES
4916 Federal Register / Vol. 86, No. 11 / Tuesday, January 19, 2021 / Rules and Regulations 

of Homeland Security, the Secretary of 

Defense, or the Director of National 

Intelligence (or their designee) pursuant 

to recommendations of the Federal 

Acquisition Security Council, under 41 

U.S.C. 1323; (3) relevant provisions of 

the Defense Federal Acquisition 

Regulation and the Federal Acquisition 

Regulation, and their respective 

supplements; (4) entities, hardware, 

software, and services that present 

vulnerabilities in the United States as 

determined by the Secretary of 

Homeland Security pursuant to section 

5(b) of the Executive Order, Department 

of Homeland Security Cybersecurity and 

Infrastructure Security Agency, 

‘‘Information and Communications 

Technology Supply Chain Risk 

Management Task Force: Interim 

Report,’’ September 18, 2019; (5) actual 

and potential threats to execution of a 

‘‘National Critical Function’’ identified 

by the Department of Homeland 

Security Cybersecurity and 

Infrastructure Security Agency; (6) the 

nature, degree, and likelihood of 

consequence to the United States public 

and private sectors that could occur if 

ICTS vulnerabilities were to be 

exploited; and (7) any other source or 

information that the Secretary deems 

appropriate. 

§ 7.100(d)—Risk Management 

The Department specifically 

requested comments on transactions 

that could present an undue or 

unacceptable risk, but where that risk 

could be reliably and adequately 

mitigated or prevented. Commenters 

suggested creating national security risk 

categories for transactions and 

providing assurance that the Secretary 

would impose the least intrusive 

measures to mitigate transactions in 

each category. Other commenters 

advocated creating risk categories or 

bands with different assessment 

approaches. The Department did not 

adopt these suggestions. ICTS 

Transaction reviews are made on a caseby-case basis. Therefore, categorically 

labeling transactions with predetermined mitigation requirements 

would effectively counteract that 

individualized approach and may result 

in ICTS Transactions proceeding that 

otherwise should have been reviewed, 

and possibly prohibited or mitigated. 

In determining whether an ICTS 

Transaction poses an undue or 

unacceptable risk, the rule clarifies the 

risk factors the Secretary, in 

consultation with the appropriate 

agency heads, may consider. 

Specifically, the Secretary may 

consider: (1) Threat assessments and 

reports prepared by the Director of 

National Intelligence pursuant to 

section 5(a) of the Executive Order; (2) 

removal or exclusion orders issued by 

the Secretary of Homeland Security, the 

Secretary of Defense, or the Director of 

National Intelligence (or their designee) 

pursuant to recommendations of the 

Federal Acquisition Security Council, 

under 41 U.S.C. 1323; (3) relevant 

provisions of the Defense Federal 

Acquisition Regulation and the Federal 

Acquisition Regulation, and their 

respective supplements; (4) entities, 

hardware, software, and services that 

present vulnerabilities in the United 

States as determined by the Secretary of 

Homeland Security pursuant to section 

5(b) of the Executive Order, Department 

of Homeland Security Cybersecurity and 

Infrastructure Security Agency, 

‘‘Information and Communications 

Technology Supply Chain Risk 

Management Task Force: Interim 

Report,’’ September 18, 2019; (5) actual 

and potential threats to execution of a 

‘‘National Critical Function’’ identified 

by the Department of Homeland 

Security Cybersecurity and 

Infrastructure Security Agency; (6) the 

nature, degree, and likelihood of 

consequence to the United States public 

and private sectors that could occur if 

ICTS vulnerabilities were to be 

exploited; and (7) any other source or 

information that the Secretary deems 

appropriate. 

§ 7.101 Information To Be Furnished 

on Demand 

The proposed rule contemplated that 

individuals might be requested to 

furnish the Secretary with information 

related to a transaction under review. 

Section 7.101 in this rule clarifies that, 

under the Secretary’s authority pursuant 

to IEEPA, persons may be required to 

furnish under oath complete 

information relative to any ICTS 

Transaction under review. The 

Secretary may require that such reports 

include the production of any books, 

contracts, letters, papers, or other hard 

copy or electronic documents relating to 

any such act, transaction, or property, in 

the custody or control of the persons 

required to make such reports. Reports 

may be required either before, during, or 

after an ICTS Transaction under review. 

Additionally, under the authorities 

provided by IEEPA, the Secretary may, 

through any person or agency, conduct 

investigations, hold hearings, 

administer oaths, examine witnesses, 

receive evidence, take depositions, and 

require by subpoena the attendance and 

testimony of witnesses and the 

production of any books, contracts, 

letters, papers, and other hard copy or 

electronic documents relating to any 

matter under investigation. 

§ 7.102 Confidentiality of Information 

The proposed rule requested 

comments and recommendations from 

stakeholders on additional 

recordkeeping requirements for 

information related to transactions. 

Most commenters focused on the 

confidentiality and the public 

availability of any information received. 

Commenters strongly advocated that the 

Department protect confidential or 

proprietary business information when 

making or publishing reports. Some 

commenters advocated for more open 

publication of these reports, and how 

each threat was mitigated or eliminated. 

To address these concerns and 

provide additional certainty for entities 

required to produce documents related 

to transactions, the rule clarifies the 

Department’s responsibility to preserve 

the confidentiality of information 

requested by the Department. 

Specifically, the rule provides that 

information or documentary materials 

that are not otherwise publicly or 

commercially available, submitted or 

filed with the Secretary under this part, 

will not be released publicly except to 

the extent required by law. However, 

the Secretary may disclose information 

or documentary materials, not otherwise 

publicly or commercially available: (1) 

Pursuant to any administrative or 

judicial proceeding; (2) pursuant to an 

act of Congress; (3) pursuant to a request 

from any duly authorized committee or 

subcommittee of Congress; (4) pursuant 

to a request to any domestic 

governmental entity, or to any foreign 

governmental entity of a United States 

ally or partner, information or 

documentary materials, not otherwise 

publicly or commercially available and 

important to the national security 

analysis or actions of the Secretary, but 

only to the extent necessary for national 

security purposes, and subject to 

appropriate confidentiality and 

classification requirements; (5) where 

the parties or a party to a transaction 

have consented the information or 

documentary materials not otherwise 

publicly or commercially available may 

be disclosed to third parties; and (6) any 

other purpose authorized by law. These 

provisions largely incorporate the 

record release requirements of the 

Freedom of Information Act, 5 U.S.C. 

552. While the Department will, as 

always, seek to protect business and 

other confidential information provided 

by parties, parties providing such 

information in response to this rule 

must clearly mark those documents as 

business or other confidential. 


khammond on DSKJM1Z7X2PROD with RULES
Federal Register / Vol. 86, No. 11 / Tuesday, January 19, 2021 / Rules and Regulations 4917 

§ 7.103 Initial Review of ICTS 

Transactions 

Many commenters addressed the 

manner in which an ICTS Transaction 

could be identified to the Secretary as 

a transaction that should be reviewed. 

In particular, many commenters sought 

clarity on the proposed provision that 

the Secretary could commence 

evaluations of transactions based on 

information received from private 

parties ‘‘that the Secretary determines to 

be credible.’’ The commenters requested 

clear guidance on what types of 

information, or parties, the Secretary 

would deem credible. Additionally, 

several commenters noted that such a 

provision might incentivize parties to 

engage in anti-competitive behavior that 

would not necessarily lead to 

identifying transactions posing risks to 

national security. In light of these 

comments and concerns, the rule 

clarifies that the Secretary may consider 

any referral for review of a transaction 

(referral): (1) Upon receipt of any 

information identified in section 

7.100(a); (2) upon written request of an 

appropriate agency head; or (3) at the 

Secretary’s discretion. Following receipt 

of a referral, the Secretary will assess 

whether the referral falls within the 

scope of § 7.3(a) and involves ICTS 

designed, developed, manufactured, or 

supplied by persons owned by, 

controlled by, or subject to the 

jurisdiction of direction of a foreign 

adversary, and determine whether to: (1) 

Accept the referral and commence an 

initial review of the transaction; (2) 

request additional information, as 

identified in § 7.100(a), including 

information from the referring entity 

regarding the referral; or (3) reject the 

referral. 

Several commenters requested the 

rule establish clearer procedures for 

how the Secretary will review ICTS 

Transactions. Commenters also 

advocated for differing determination 

timeframes, deadlines, or milestones 

based on device nature, threat severity, 

equipment replacement risks, and other 

potential harms. 

In response to these and other 

comments, the Department provides 

that, unless the Secretary determines in 

writing that additional time is 

necessary, the Secretary shall issue the 

final determination within 180 days of 

accepting a referral and commencing the 

initial review of the ICTS Transaction. 

Regarding the procedures for the 

Secretary’s review of ICTS Transactions, 

the Executive Order provides a careful 

process for the Secretary’s decisionmaking. The rule further sets out the 

factors that the Secretary will consider 

to assist the decision-making process. 

Specifically, the rule provides that the 

Secretary shall assess whether the ICTS 

Transaction: Falls within the scope of 

§ 7.3(a) of the rule; involves ICTS 

designed, developed, manufactured, or 

supplied, by persons owned by, 

controlled by, or subject to the 

jurisdiction or direction of a foreign 

adversary; and poses an undue or 

unacceptable risk. The Secretary will 

evaluate each transaction, on a case-bycase basis, based upon the particular 

facts and circumstances, including the 

identity of the parties involved. 

The rule also further articulates what 

the Secretary will consider when 

determining whether an ICTS 

Transactions poses an undue or 

unacceptable risk. The Department has 

identified ten criteria for such 

determinations. Along with other 

factors, when determining if an ICTS 

Transaction poses an undue or 

unacceptable risk, the Secretary will 

consider the nature of the information 

and communications technology or 

services at issue in the ICTS 

Transaction, including technical 

capabilities, applications, and market 

share considerations; the nature and 

degree of the direction or jurisdiction 

exercised by the foreign adversary over 

the design, development, manufacture, 

or supply at issue in the ICTS 

Transaction; and the statements and 

actions of the foreign adversary at issue 

in the ICTS Transaction. Other 

considerations include whether the 

ICTS Transaction poses a discrete or 

persistent threat and the nature of the 

vulnerability implicated by the ICTS 

Transaction. 

§ 7.104 First Interagency Consultation 

The Department has clarified that the 

Secretary will consult with the 

appropriate agency heads after finding 

that an ICTS Transaction may fall 

within the scope of the Executive Order. 

§ 7.105 Initial Determination 

This rule clarifies that if, after review 

of an ICTS Transaction and consultation 

with the appropriate agency heads, the 

Secretary determines that such ICTS 

Transaction meets the criteria in section 

7.103(c) of the rule, the Secretary shall 

then issue an initial written 

determination explaining the finding 

and whether the Secretary has 

determined to prohibit or propose 

mitigation measures to the ICTS 

Transaction at issue. The initial 

determination will contain no 

confidential information, even if such 

was relied upon to make the initial 

determination. Notice of this initial 

determination shall be served upon the 

parties to the ICTS Transaction known 

to the Secretary at the time of service. 

Service may be made by registered U.S. 

mail, facsimile, electronic transmission, 

or third-party commercial carrier, to an 

addressee’s last known address or by 

personal delivery. Service of documents 

will be considered effective upon the 

date of postmark, facsimile 

transmission, delivery to third party 

commercial carrier, electronic 

transmission or upon personal delivery. 

Notice of the initial determination to the 

parties may also be accomplished by 

publication in the Federal Register 

where the Secretary determines that the 

initial determination concerns or could 

impact entities beyond the parties to the 

ICTS Transaction, where one or more of 

the parties to the ICTS Transaction are 

unknown to the Secretary, or in any 

other circumstance at the Secretary’s 

discretion. 

§ 7.106 Retention of Records 

The proposed rule requested public 

comments on whether to require parties 

to undertake additional recordkeeping 

for information related to transactions. 

Some commenters argued that the 

Department should not impose 

additional recordkeeping requirements. 

Additionally, some commenters 

suggested that the recordkeeping 

requirement begin upon receipt of a 

transaction notice, rather than being an 

ongoing duty for any potentially 

prohibited ICTS Transaction. 

After reviewing these comments, and 

consistent with IEEPA, the rule provides 

that, after receiving notification that an 

ICTS Transaction is under review or 

that an initial determination concerning 

an ICTS Transaction has been made, a 

notified person must immediately take 

steps to retain any and all records 

related to such transaction. 

§ 7.107 Procedures Governing 

Response and Mitigation 

Commenters requested that the final 

rule explain how the Secretary’s 

determinations may be ‘‘appealed’’ and 

how mitigation agreements will be 

reached and enforced. Commenters also 

sought more robust procedures for 

waivers, appeals, and mitigation. The 

proposed rule had provided that, within 

30 days of a preliminary determination 

by the Secretary that a transaction was 

an ICTS Transaction that would pose an 

undue or unacceptable risk to the U.S. 

national security, parties to that 

transaction could submit a response to 

the decision. The proposed rule also 

allowed the Secretary to require a 

transaction be mitigated to reduce the 

risks the Secretary identified in the 

preliminary determination. 


khammond on DSKJM1Z7X2PROD with RULES
4918 Federal Register / Vol. 86, No. 11 / Tuesday, January 19, 2021 / Rules and Regulations 

In response to these comments, the 

Department has added provisions to 

enhance and clarify when and how 

parties to an ICTS Transaction that is 

the subject of an initial determination 

may engage with the Secretary about the 

initial determination. The rule 

establishes a clear process for 

responding to an initial determination 

concerning an ICTS Transaction and 

provides further guidance on how any 

identified risks may be mitigated so that 

an identified ICTS Transaction may 

proceed. Similar to the proposed rule, 

within 30 days of being notified of an 

initial determination, pursuant to 

section 7.105 of the rule, parties to that 

transaction may respond to the initial 

determination or assert that the 

circumstances leading to the initial 

determination no longer apply. A party 

may submit arguments or evidence in 

support of their response and may also 

propose remedial steps that the party 

believes would negate the basis for the 

Secretary’s initial determination. The 

rule also allows parties to an ICTS 

Transaction that is subject to an initial 

determination to request a meeting with 

the Department, which may be granted 

at the Secretary’s discretion. 

Additionally, the rule clarifies that if the 

parties to an ICTS Transaction do not 

submit a response to the Secretary’s 

initial determination within 30 days 

following service of the initial 

determination, that initial determination 

will become final. 

Other commenters recommended the 

adoption of an appeals process for 

parties notified of a final determination. 

The Department has adopted a process 

for reconsidering an initial 

determination by the Secretary. 

However, an administrative appeals 

process would hinder the Secretary’s 

ability to move swiftly to prevent an 

undue or unacceptable risk. 

Some commenters also requested that 

the Department establish a maximum 

life span for imposed mitigations, 

arguing that such a rule would reduce 

the inhibiting effects that mitigations 

would have on ICTS innovation. The 

Department disagrees with commenters, 

finding that such a clause would 

prevent the Department from evaluating 

the mitigations put in place on ICTS 

Transactions. Failing to reevaluate 

would effectively limit mitigation 

requirements and potentially reopen 

national security vulnerabilities. 

§ 7.108 Second Interagency 

Consultation 

The proposed rule set out the review 

process that must be followed before the 

Secretary issues a final determination 

that constitutes a final agency action. 

The process involved response periods, 

as well as possible extensions, given to 

any party affected by a preliminary 

determination. Commenters addressed 

communications regarding initial and 

final determinations within the context 

of this process. Some commenters 

suggested that the Secretary should 

collaborate with private industry when 

making determinations, similar to the 

process within the Department of 

Homeland Security’s Supply Chain Risk 

Management Task Force. Similar 

comments were received advocating for 

the establishment of a mechanism for 

industry to seek guidance on specific 

work programs or participants involved. 

The Department has declined to add 

specific provisions relating to 

collaborating with industry on ICTS 

Transaction determinations. However, 

in consideration of these comments 

there is now a provision explaining 

what factors and sources the Secretary 

will take into consideration during the 

second consultation. Specifically, the 

Secretary will take into account the 

views of the appropriate agency heads, 

through the interagency consultation 

processes. In providing their views, the 

appropriate agency heads may consider 

the perspective of relevant publicprivate working groups and advisory 

committees with which they convene or 

engage. For instance, DHS’s views could 

incorporate input from the Supply 

Chain Risk Management Task Force. 

The Department also points out that it 

maintains a number of advisory 

committees that provide regular 

opportunities for industry and the 

regulated community to provide 

feedback to the Department on issues 

impacting their operations. Under the 

Secure and Trusted Communications 

Networks Act of 2020, the National 

Telecommunications and Information 

Administration is also charged with 

establishing a program to share supply 

chain risk information with 

telecommunication providers and 

manufacturers. 

Commenters also requested that the 

Department explain whether and how 

the Secretary’s determinations may be 

appealed or reviewed by another 

authority. This rule adds a provision 

that, should any appropriate agency 

head oppose the Secretary’s proposed 

final determination, the Secretary shall 

notify the President of the Secretary’s 

proposed final determination and such 

opposition. After receiving direction 

from the President regarding the 

Secretary’s proposed final 

determination and any appropriate 

agency head’s opposition thereto, the 

Secretary shall issue a final 

determination pursuant to § 7.109. 

Additionally, the Department will 

implement, within 120 days of 

publishing this rule, procedures for how 

parties to a proposed, pending, or 

ongoing ICTS Transaction may seek a 

license, pursuant to Section 2(b) of the 

Executive Order, in a manner consistent 

with the national security of the United 

States. 

As noted above, after reviewing an 

ICTS Transaction that the Secretary 

believes may pose an undue or 

unacceptable risk, the Secretary will 

engage in a first interagency 

consultation with the appropriate 

agency heads to discuss the ICTS 

Transaction and the Secretary’s 

concerns. Following that consultation, 

the Secretary will make an initial 

determination and, if that decision 

includes a determination to prohibit an 

ICTS Transaction, will notify the parties 

to the transaction of the Secretary’s 

initial determination. After the parties 

are afforded an opportunity to respond 

to the initial determination and propose 

mitigation measures, the Secretary will 

engage in a second interagency 

consultation with the appropriate 

agency heads, to discuss the transaction, 

the initial determination, and any 

response. This process will help ensure 

that all information regarding ICTS 

Transactions and the views of the 

appropriate agency head are considered 

when the Secretary makes a final 

determination. 

§ 7.109 Final Determination 

As noted above, the Department 

appreciates the comments requesting 

additional clarity on the process by 

which the Secretary will make decisions 

about ICTS Transactions. The rule now 

provides a specific step for issuing final 

determinations on ICTS Transactions. 

The outcome of a final determination 

remains unchanged from the proposed 

rule and will provide that an ICTS 

Transaction is either: (1) Prohibited; (2) 

not prohibited; or (3) permitted 

pursuant to the adoption of agreed-upon 

mitigation measures. Moreover, the rule 

clarifies that the written final 

determinations will include directions 

on the timing and manner of cessation 

of a prohibited ICTS Transaction, as 

applicable, along with the penalties, as 

authorized by IEEPA, for violations of 

applicable mitigation terms or other 

direction or prohibition issued under 

this rule. The final determination will 

provide a specific description of the 

prohibited ICTS Transaction and shall 

be limited in force to the circumstances 

described therein. Moreover, if the 

Secretary determines that an ICTS 

Transaction is prohibited, the final 

determination shall direct the least 


khammond on DSKJM1Z7X2PROD with RULES
Federal Register / Vol. 86, No. 11 / Tuesday, January 19, 2021 / Rules and Regulations 4919 

restrictive means that the Secretary, in 

the Secretary’s discretion, determines to 

be necessary to attenuate or alleviate the 

undue or unacceptable risk posed by the 

ICTS Transaction. 

§ 7.109(c)—Notification of Final 

Determination 

Commenters also provided a number 

of suggestions on how to further ensure 

the Secretary is held accountable for his 

or her actions under the authority of this 

rule. Recommendations include limiting 

the Secretary’s ability to assign a 

designee with final decision-making 

authority and deleting the emergency 

action provision set forth in section 

7.100(f) of the proposed rule. These 

suggestions are intended to ensure that 

Congress can hold the executive branch 

accountable for enforcement actions. 

In response to these comments, the 

final rule enhances transparency by 

requiring final written determinations to 

be published in the Federal Register, 

where they are readily accessible to both 

the Congress and the public. Moreover, 

the rule now clarifies that the 

publication shall omit any confidential 

business information. 

§ 7.200 Penalties 

Commenters requested the final rule 

clarify the type and scope of penalties 

for noncompliance with the Secretary’s 

prohibition or mitigation of a 

transaction. We agree with commenters 

that the type and scope of the penalties 

for noncompliance were unclear, and 

the section has been revised 

accordingly. The rule now clarifies that 

any person who commits a violation of 

any final determination, direction, or 

mitigation agreement may be liable to 

the United States for civil or criminal 

penalties under IEEPA. 

Other Comments 

The Department received other 

comments with which the Department 

disagrees. The Department responds to 

those comments below. 

First, one commenter requested that 

the Department expand the meaning of 

the term ‘‘electronic means’’ within the 

definition of ICTS. While the 

Department cannot modify the 

definition of ICTS contained in the 

Executive Order, the Department 

clarifies that ‘‘electronic means’’ 

includes electromagnetic, magnetic, and 

photonic means. This change is not 

intended to widen the scope of the rule, 

but merely to clarify the means by 

which ICTS must function in order for 

the rule to apply. 

Second, some commenters requested 

that the Department provide technical 

assistance for parties forced to alter 

ICTS infrastructure. However, the 

Department is unable to offer technical 

assistance at this time. Accordingly, the 

Department declines to implement any 

provision for technical assistance in the 

rule, and the parties to the transaction 

will bear the responsibility and cost of 

complying with any prohibition or 

mitigation measure. 

Third, one commenter argued that the 

rule imposes an unfunded mandate on 

the private sector, within the meaning of 

the Unfunded Mandates Reform Act of 

1995, Public Law 104–4 (UMRA), 

contrary to the determination made by 

the Department in the proposed rule. 

The commenter further argued that 

UMRA requires that before the rule 

becomes final, the Department must 

include in the rule a written statement 

assessing the costs and benefits of the 

rule, and estimates of future compliance 

costs, as required by UMRA. The 

Department continues to believe that the 

rule does not constitute a ‘‘Federal 

private sector mandate’’ as defined by 

UMRA, in that the rule does not impose 

‘‘an enforceable duty’’ upon the private 

sector. See 2 U.S.C. 658(7). Rather, the 

rule sets out the processes and 

procedures that the Secretary of 

Commerce will use to identify, assess, 

and address certain transactions, 

including classes of transactions. 

However, as the commenter notes, when 

a rule does constitute a ‘‘Federal private 

sector mandate,’’ UMRA requires the 

agency prepare a written statement 

containing information about the costs 

and benefits of the mandate, including, 

where feasible, future compliance costs, 

2 U.S.C. 1532, as well as that the agency 

identify and consider regulatory 

alternatives and select the least costly, 

most cost-effective, or least burdensome 

alternative that achieves the objectives 

of the rule, 2 U.S.C. 1535. Thus, even in 

the event that the rule were considered 

to constitute a federal private sector 

mandate, the Department has met these 

requirements in full through the 

preparation of the accompanying 

Regulatory Impact Analysis. 

Changes From the Proposed Rule 

Upon consideration of the public 

comments received, the Department 

makes several changes, as discussed in 

detail above, from the proposed rule in 

order to increase clarity and certainty 

for the public. First, the rule provides 

detail on the procedures the Secretary 

will follow when reviewing ICTS 

Transactions, including identifying the 

criteria and information the Secretary 

will consider. For example, the rule 

provides clarity as to when the 

Secretary will consult with the 

appropriate agency heads as part of the 

review and determination process. 

Second, the rule details the 

requirements for responding to initial 

determinations. Third, the rule clarifies 

that parties may respond to an initial 

determination or seek to negotiate a 

mitigation agreement with the Secretary. 

Fourth, the rule now provides that 

unless the Secretary determines in 

writing that additional time is 

necessary, the Secretary shall issue a 

final determination within 180 days of 

accepting a referral and commencing the 

initial review of an ICTS Transaction, 

eliminating the uncertainty of an openended review process. Fifth, the rule 

ensures transparency by specifically 

requiring the Secretary to publish the 

results of final determinations, absent 

any confidential business information, 

in the Federal Register. Sixth, the rule 

now specifies that an ICTS Transactions 

between parties outside of a sector 

designated as critical infrastructure 

must involve a clearly specified 

technology or service in order to be 

considered a covered ICTS 

Transactions. 

Additionally, in response to 

commenters seeking clarity regarding 

the scope of the rule, including 

numerous requests for the identification 

of ‘‘foreign adversaries,’’ the Department 

defines certain terms. The added 

definitions help to clarify the scope of 

the rule by providing guidance on 

which entities may be subject to the 

rule, what constitutes an ICTS 

Transaction, and whether an ICTS 

Transaction involves a foreign 

adversary. This additional clarity will 

assist entities with making appropriate 

decisions regarding ICTS Transactions 

that may present risks to the national 

security, therefore helping to protect the 

United States’ ICTS supply chain. 

Classification 

A. Executive Order 12866 (Regulatory 

Policies and Procedures) 

Pursuant to the procedures 

established to implement Executive 

Order 12866, the Office of Management 

and Budget has determined that this 

rule is economically significant. 

B. Executive Order 13771 (Reducing 

Regulation and Controlling Regulatory 

Costs) 

This rule is not subject to the 

requirements of Executive Order 13771 

because the benefit-cost analysis 

demonstrates that the regulation is 

anticipated to improve national security 

as its primary direct benefit. 

ICTS has become integral to the daily 

operations and functionality of U.S. 

critical infrastructure, as well as much, 


khammond on DSKJM1Z7X2PROD with RULES
4920 Federal Register / Vol. 86, No. 11 / Tuesday, January 19, 2021 / Rules and Regulations 

if not most, of U.S. industry. Moreover, 

ICTS accounts for a large part of the U.S. 

economy. Accordingly, if vulnerabilities 

in the ICTS supply chain—composed of 

hardware, software, and managed 

services from third-party vendors, 

suppliers, service providers, and 

contractors—are exploited, the 

consequences can affect all users of that 

technology or service, potentially 

causing serious harm to critical 

infrastructure, U.S. Government 

operations, and disrupting the United 

States and the global economy. These 

harms are already occurring. As noted 

in Executive Order 13873, ‘‘foreign 

adversaries are increasingly creating and 

exploiting vulnerabilities in information 

and communications technology and 

services, which store and communicate 

vast amounts of sensitive information, 

facilitate the digital economy, and 

support critical infrastructure and vital 

emergency services.’’ 

U.S. entities purchasing and 

incorporating ICTS equipment and 

using ICTS services, such as network 

management or data storage, provided 

by foreign adversaries can create 

multiple opportunities for foreign 

adversaries to exploit potential 

vulnerabilities in the ICTS. That, in 

turn, could cause direct and indirect 

harm to both the immediate targets of 

the adverse action and to the United 

States as a whole. Incorporation of a 

foreign adversary’s software, equipment, 

and products into domestic ICTS 

networks, as well as the use of use of 

foreign cloud, network management, or 

other services, greatly increases the risk 

that potential vulnerabilities may be 

introduced, or that they may be present 

without being detected. These potential 

vulnerabilities are often categorized 

under the general concepts of threats to 

privacy, data integrity, and denial of 

service. 

Some foreign actors are known to 

exploit the sale or lease of software and 

hardware to introduce vulnerabilities 

that can allow them to steal critical 

intellectual property, research results 

(e.g., health data), or government or 

financial information from users of the 

software or hardware. Such 

vulnerabilities can be introduced at the 

network, cloud service or individual 

product data, allow traffic monitoring or 

surveillance, and may be resistant to 

detection by private purchasers or 

telecommunications carriers. Once 

detected, the existence of such 

vulnerabilities may be extremely costly 

or impossible to remediate. 

Vulnerabilities to data integrity can be 

created by including an adversary’s 

hardware and software into U.S. 

networks and systems. This 

incorporated hardware and software 

could then pose opportunities to add or 

remove important information, modify 

files or data streams, slow down, or 

otherwise modify the normal 

transmission or availability of data 

across U.S. networks. Such capabilities 

could be exercised in areas as diverse as 

financial market communications, 

satellite communications or control, or 

other sensitive consumer information. 

Privileged access to market movement 

and trends, or other manipulation, 

could disrupt and harm the operation of 

major exchanges. 

A foreign adversary could also 

effectively deny access to critical 

services by exploiting vulnerabilities 

provided by the incorporation of 

hardware and software into U.S. 

environments, fully or partially shutting 

down critical networks or functions at 

key times. These types of attacks are 

known as denial of service attacks. Such 

attacks could cause widespread 

problems, such as if they occur during 

periods of crisis, or they could be used 

selectively by targeting individual 

corporations, infrastructure elements, or 

other important infrastructure functions. 

They could also be masked to make the 

source of the disruption difficult to 

attribute, and therefore be difficult to 

trace and terminate. 

Such risks can be substantially 

increased by incorporating the software 

and equipment from unreliable 

adversaries into the U.S. 

telecommunications infrastructure. 

However, these risks are not necessarily 

confined to infrastructure environments. 

They could, for example, be present in 

the use of cloud services, as well as in 

the widespread use of some consumer 

devices, networked surveillance 

cameras, drones, or interconnection via 

the internet of computing devices 

embedded in everyday objects, enabling 

them to send and receive data. 

The number of attacks by foreign 

adversaries on the ICTS supply chain 

are known to be increasing. The 

associated costs are borne by the U.S. 

Government as well as private industry. 

Given the ubiquity of ICTS in the 

modern economy and especially in 

critical infrastructure, the benefits of 

preventing significant disruptions or 

harms to the ICTS supply chain that 

could cause incalculable costs to U.S. 

firms, consumers, and the U.S. 

Government, would be very high. 

This rule provides a process through 

which serious disruptions to the United 

States telecommunications 

infrastructure can be avoided or 

ameliorated. The rule provides the 

means of bringing to bear the 

information and analytical resources of 

the U.S. government to address ICTS 

supply chain issues before they arise, 

and which may be beyond the means of 

individual telecommunications carriers 

or other U.S. ICTS purchasers or users 

to address on their own. As noted 

above, the costs associated with the 

potential attacks, loss of service, or 

disruption to the ICTS supply chain are 

not known at this time, and are in 

actuality unknowable due to the 

generally clandestine nature of the 

attacks and the fact that they may or 

may not occur. However, by deterring, 

preventing, or mitigating these attacks, 

this rule will provide the United States 

with substantial, though unknowable, 

economic benefits as well as benefits to 

the national security of the United 

States. 

C. Regulatory Flexibility Analysis 

The Department has examined the 

economic implications of this final rule 

on small entities as required by the 

Regulatory Flexibility Act (RFA). The 

RFA requires an agency to describe the 

impact of a rule on small entities by 

providing a regulatory flexibility 

analysis. The Department published an 

initial regulatory flexibility analysis in 

the proposed rule issued on November 

27, 2019 (84 FR 65316) and has posted 

a final regulatory flexibility analysis 

(FRFA) as part of the RIA (see 

ADDRESSES). This final rule is likely to 

have a significant economic impact on 

a substantial number of small entities. A 

summary of the FRFA follows. 

A Statement of the Significant Issues 

Raised by Public Comments or by the 

Chief Counsel for Advocacy of the Small 

Business Administration in Response to 

the IRFA, a Statement of the Assessment 

of the Agency of Such Issues, and a 

Statement of Any Changes Made in the 

Proposed Rule as a Result of Such 

Comments 

Many commenters discussed the 

possibility that this rule could present 

significant economic costs. For example, 

one commenter stated that ‘‘Commerce’s 

proposed rules would result in an 

extremely broad and unprecedented 

increase in regulatory jurisdiction over 

private ICT transactions. The notice of 

proposed rulemaking thus marks a 

watershed regulatory moment for 

companies in or adjacent to the ICT 

market—which is to say, virtually every 

company in United States—given the 

government’s newfound stance that it 

can determine key terms of what ICT 

companies can buy, sell, or use. As a 

result, this proceeding and the rules that 

result from it inescapably will impose 

additional costs on ICT companies, such 

as the increased practical need—even 


khammond on DSKJM1Z7X2PROD with RULES
Federal Register / Vol. 86, No. 11 / Tuesday, January 19, 2021 / Rules and Regulations 4921 

absent a legal requirement—to 

document supply chain risk 

management analysis in the event a 

transaction is investigated, along with 

related due diligence to consider the asyet uncertain possibilities for 

government intervention.’’ In the RIA, 

the Department estimated costs 

associated with developing and 

implementing a plan to conduct due 

diligence on potentially covered 

transactions, including estimating the 

number of small entities that could be 

affected by the rule and the economic 

impact on those small entities. 

Statement of the Objectives of, and 

Legal Basis for, the Final Rule 

A description of this final rule, why 

it is being implemented, the legal basis, 

and the purpose of this final rule are 

contained in the SUMMARY and 

SUPPLEMENTARY INFORMATION sections of 

this preamble, as well as in the 

preamble to the Notice of Proposed 

Rulemaking issued on November 27, 

2019 (84 FR 65316), and are not 

repeated here. 

A Description and, Where Feasible, 

Estimate of the Number of Small 

Entities to Which the Final Rule Applies 

Small Business Administration (SBA) 

size standards for businesses are based 

on annual receipts and average 

employment. For the purpose of this 

analysis we define a small business as 

one employing fewer than 500 persons. 

This definition allows us to use 2017 

Census data on firm employment by 

NAICS industry to estimate the number 

of affected small entities. 

In the RIA, the Department identified 

4,533,000 firms that imported 

significant amounts of goods and 

services potentially subject to review 

under the Rule. This formed our upper 

bound estimate for the total number of 

affected entities. By replicating this 

methodology with firm employment 

data, the Department finds that 

4,516,000 of these firms, about 99.6 

percent, have less than 500 employees. 

Assuming the lower bound estimate of 

268,000 affected entities is also made up 

of 99.6 percent small businesses, the 

Department estimates that between 

266,995 and 4,516,000 small businesses 

will be potentially affected by this rule. 

Federal Rules That May Duplicate, 

Overlap or Conflict With the Final Rule 

The Department did not identify any 

Federal rule that duplicates, overlaps, or 

conflicts with this final rule. 

Description and Estimate of Economic 

Effects on Entities, by Entity Size and 

Industry 

In the Costs section of the RIA, the 

Department estimates that costs to all 

affected entities will range between 

approximately $235 million and $20.2 

billion, or about $2,800 to $6,300 per 

entity. The Department estimated the 

costs to small entities using the same 

methodology. All small entity 

calculations and assumptions can be 

found in Tables 10 through 14. These 

tables are analogous to Tables 5 through 

9 in the RIA. While most of the 

assumptions below are identical to 

those found in the previous estimates, 

there are 3 important adjustments to 

assumptions in the small entity cost 

estimates: 

1. Entities potentially impacted by the 

rule reduced by 0.4 percent to account 

for our finding that 99.6 percent of all 

affected entities have less than 500 

employees. 

2. Small entities are less likely to have 

the resources to develop and implement 

a compliance plan. This analysis thus 

reduces estimates of the share of small 

firms likely to engage in these activities 

accordingly. 

3. Small entities engage in fewer 

transactions than large entities. This 

analysis reduces the estimates of the 

number of transactions subject to the 

rule per small firm accordingly. 

As a result of these adjustments, the 

Department estimates that costs to 

affected small entities will range 

between approximately $109 million 

and $10.9 billion, or about $1,800 and 

$3,900 per small entity. 

Potential Economic Impact of the Rule 

on Small Entities 

Small businesses, as opposed to larger 

firms, may not have the same ability to 

deal with the burdens, both direct and 

indirect, associated with the rule. Faced 

with the various costs associated with 

compliance, firms will have to absorb 

those costs and/or pass them along to 

their consumers in the form of higher 

prices. Either action will reduce the 

profits of firms. Due to their lack of 

market power, and their lower profit 

margins, small firms may find it 

difficult to pursue either or both of 

those responses while remaining viable. 

A similar situation will hold with 

respect to the indirect impacts of the 

rule. Small firms downstream of 

impacted industries are likely to face 

increases in the prices of ICT products 

they use as inputs and either absorb the 

increase in cost and/or raise their prices. 

Given this situation, it is possible that 

the rule will have a more substantial 

adverse impact on small firms relative 

to larger firms. 

However, the changes made from the 

proposed rule benefit small businesses 

by limiting the scope of transactions 

subject to the rule. Small entities have 

fewer suppliers and engage in fewer 

transactions than large entities. As a 

result, by identifying specific foreign 

adversaries and providing guidance on 

which entities may be subject to the rule 

as well as additional criteria on what 

constitutes an ICTS Transaction, small 

entities will more readily be able to 

determine whether their transactions are 

subject to review under the rule—and 

may in some cases, find that none of 

their transaction are likely to be within 

the scope of the rule. Additionally, by 

specifically requiring the Secretary to 

publish the results of final 

determinations in the Federal Register, 

small businesses will be able to assess 

whether their transactions are 

substantially similar to those that have 

been prohibited. Finally, the rule 

reduces the potential burdens on small 

entities by emphasizing that (1) the 

Secretary will choose the least 

burdensome restriction that still allows 

for protection of the national security 

when deciding whether to prohibit or 

mitigate an ICTS Transaction, and (2) 

the Secretary shall issue a final 

determination within 180 of 

commencing an initial review. 

A Description of, and an Explanation of 

the Basis for, Assumptions Used 

SBA size standards for businesses are 

based on annual receipts and average 

employment. For the purpose of this 

analysis, the Department defines a small 

business as one employing fewer than 

500 persons. This definition allows the 

Department to use 2017 Census data on 

firm employment by NAICS industry to 

estimate the number of affected small 

entities. The Department does not have 

access to sufficiently detailed data on 

firm employment and receipts to make 

use of the full set of SBA size standard 

thresholds. 

The Department notes, however, that 

84% of SBA employee thresholds are 

above 500, and 91% of SBA receipt 

thresholds are above $6 million. Census 

data show that average receipts for firms 

employing less than 500 employees are 

$2.2 million. Thus, using our threshold 

of 500 employees we estimate that 

99.6% of affected entities are small 

businesses which is likely a slight 

underestimate. 


khammond on DSKJM1Z7X2PROD with RULES
4922 Federal Register / Vol. 86, No. 11 / Tuesday, January 19, 2021 / Rules and Regulations 

Description of Any Significant 

Alternatives to the Final Rule That 

Accomplish the Stated Objectives of 

Applicable Statutes and That Minimize 

Any Significant Economic Impact of the 

Rule on Small Entities 

This rule will allow the Secretary to 

review ICTS Transactions to determine 

whether they present an undue or 

unacceptable risk, a function which is 

currently not performed by any other 

private or public entity. As noted above, 

private industry often lacks the 

incentive, information, or resources to 

review their ICTS purchases for 

malicious suppliers or other potentially 

bad actors in the ICTS supply chain. 

The U.S. Government is uniquely 

situated to determine threats and protect 

the national security, including 

economic security. 

The Department considered two 

regulatory alternatives to reduce the 

burden on small entities: (1) Excluding 

small entities with 5 or fewer 

employees, and (2) excluding certain 

industries and sectors. However, the 

Department determined that neither of 

these two alternatives would achieve 

the goal of protecting the national 

security, nor would they eliminate the 

rule’s significant economic impact on a 

substantial number of small entities. 

First, the Department considered 

providing an exemption for small 

entities that have 5 or fewer employees. 

(‘‘smallest entities’’). According to 

Census Bureau’s most recent dataset of 

number of firms by employee count, 

about 61% of all firms have less than 5 

employees. 

Second, the Department examined the 

feasibility of eliminating the application 

of the rule to certain small entities 

involved in specific industries or sectors 

by excluding: (a) ICTS Transactions that 

involve only the acquisition of 

commercial items as defined by Federal 

Acquisition Regulation Part 2.101; (b) 

ICTS Transactions that are used solely 

for the purpose of cybersecurity 

mitigation or legitimate cybersecurity 

research; and (c) ICTS Transactions 

under which a United States person is 

subject to a security control agreement, 

special security agreement, or proxy 

agreement approved by a cognizant 

security agency to offset foreign 

ownership, control, or influence 

pursuant to the National Industrial 

Security Program regulations (32 CFR 

part 2004). 

Ultimately, the Department decided 

against adopting either of these 

regulatory alternatives. Exempting 

certain industries or sectors or 

eliminating the application of the rule to 

smallest entities could inadvertently 

allow potentially problematic 

transactions that are substantially 

similar to those conducted by nonexempt entities to avoid review, 

undermining the rule’s national security 

objectives. For example, a company that 

is headquartered in a foreign adversary 

country, regardless of its size or main 

industry sector, may be involved in 

legitimate cybersecurity research and 

development initiatives performed 

under the National Cooperative 

Research and Production Act, 15 U.S.C. 

4301–06, and the foreign company may 

study foreign equipment to gain insights 

on new innovations or potential 

network security risks. However, that 

same company may also be conducting 

operations during other ICTS 

Transactions that could harm U.S. 

national security interests. By 

promulgating the chosen alternative for 

the rule, the Department sought to 

remove both the possibility for 

confusion as well as the ability for 

malicious actors to argue that some 

legitimate cybersecurity research 

performed by a company would exempt 

all cybersecurity research by a company, 

legitimate or otherwise. Thus, the rule 

applies to types of ICTS Transactions 

most affecting U.S. national security as 

opposed to exempting entire industries, 

sectors, or regulated smallest entities 

from review. 

Section 212 of the Small Business 

Regulatory Enforcement Fairness Act of 

1996 states that, for each rule or group 

of related rules for which an agency is 

required to prepare a FRFA, the agency 

shall publish one or more guides to 

assist small entities in complying with 

the rule, and shall designate such 

publications as ‘‘small entity 

compliance guides.’’ The agency shall 

explain the actions a small entity is 

required to take to comply with a rule 

or group of rules. 

D. Paperwork Reduction Act 

The Paperwork Reduction Act of 1995 

(44 U.S.C. 3501 et seq.) (PRA) provides 

that an agency generally cannot conduct 

or sponsor a collection of information, 

and no person is required to respond to 

nor be subject to a penalty for failure to 

comply with a collection of information, 

unless that collection has obtained 

Office of Management and Budget 

(OMB) approval and displays a 

currently valid OMB Control Number. 

This rulemaking does not contain a 

collection of information requirement 

subject to review and approval by OMB 

under the PRA. 

E. Unfunded Mandates Reform Act of 

1995 

This rule would not produce a 

Federal mandate (under the regulatory 

provisions of Title II of the Unfunded 

Mandates Reform Act of 1995) for State, 

local, and tribal governments or the 

private sector. 

F. Executive Order 13132 (Federalism) 

This rule does not contain policies 

having federalism implications 

requiring preparations of a Federalism 

Summary Impact Statement. 

G. Executive Order 12630 

(Governmental Actions and Interference 

With Constitutionally Protected Property 

Rights) 

This rule does not contain policies 

that have unconstitutional takings 

implications. 

H. Executive Order 13175 (Consultation 

and Coordination With Indian Tribes) 

The Department has analyzed this 

proposed rule under Executive Order 

13175 and has determined that the 

action would not have a substantial 

direct effect on one or more Indian 

tribes, would not impose substantial 

direct compliance costs on Indian tribal 

governments, and would not preempt 

tribal law. 

I. National Environmental Policy Act 

The Department has reviewed this 

rulemaking action for the purposes of 

the National Environmental Policy Act 

(42 U.S.C. 4321 et seq.). It has 

determined that this final rule would 

not have a significant impact on the 

quality of the human environment. 

List of Subjects in 15 CFR Part 7 

Administrative practice and 

procedure, Business and industry, 

Communications, Computer technology, 

Critical infrastructure, Executive orders, 

Foreign persons, Investigations, 

National security, Penalties, 

Technology, Telecommunications. 

This document of the Department of 

Commerce was signed on January 13, by 

Wilbur Ross, Secretary of Commerce. 

That document with the original 

signature and date is maintained by the 

Department of Commerce. For 

administrative purposes only, and in 

compliance with requirements of the 

Office of the Federal Register, the 

undersigned Department of Commerce 

Federal Register Liaison Officer has 

been authorized to sign and submit the 

document in electronic format for 

publication, as an official document of 

the Department of Commerce. This 

administrative process in no way alters 


khammond on DSKJM1Z7X2PROD with RULES
Federal Register / Vol. 86, No. 11 / Tuesday, January 19, 2021 / Rules and Regulations 4923 

the legal effect of this document upon 

publication in the Federal Register. 

Signed in Washington, DC, on January 13, 

2021. 

Asha Mathew, 

Federal Register Liaison Officer, U.S. 

Department of Commerce. 

■ For the reasons set out in the 

preamble, 15 CFR part 7 is added to 

read as follows: 

PART 7—SECURING THE 

INFORMATION AND 

COMMUNICATIONS TECHNOLOGY 

AND SERVICES SUPPLY CHAIN 

Subpart A—General 

7.1 Purpose. 

7.2 Definitions. 

7.3 Scope of Covered ICTS Transactions. 

7.4 Determination of foreign adversaries. 

7.5 Effect on other laws. 

7.6 Amendment, modification, or 

revocation. 

7.7 Public disclosure of records. 

Subpart B—Review of ICTS Transactions 

7.100 General. 

7.101 Information to be furnished on 

demand. 

7.102 Confidentiality of information. 

7.103 Initial review of ICTS Transactions. 

7.104 First interagency consultation. 

7.105 Initial determination. 

7.106 Recordkeeping requirement. 

7.107 Procedures governing response and 

mitigation. 

7.108 Second interagency consultation. 

7.109 Final determination. 

7.110 Classified national security 

information. 

Subpart C—Enforcement 

7.200 Penalties. 

Authority: 50 U.S.C. 1701 et seq.; 50 

U.S.C. 1601 et seq.; E.O. 13873, 84 FR 22689. 

Subpart A—General 

§ 7.1 Purpose. 

These regulations set forth the 

procedures by which the Secretary may: 

(a) Determine whether any acquisition, 

importation, transfer, installation, 

dealing in, or use of any information 

and communications technology or 

service (ICTS Transaction) that has been 

designed, developed, manufactured, or 

supplied by persons owned by, 

controlled by, or subject to the 

jurisdiction or direction of foreign 

adversaries poses certain undue or 

unacceptable risks as identified in the 

Executive Order; (b) issue a 

determination to prohibit an ICTS 

Transaction; (c) direct the timing and 

manner of the cessation of the ICTS 

Transaction; and (d) consider factors 

that may mitigate the risks posed by the 

ICTS Transaction. The Secretary will 

evaluate ICTS Transactions under this 

rule, which include classes of 

transactions, on a case-by-case basis. 

The Secretary, in consultation with 

appropriate agency heads specified in 

Executive Order 13873 and other 

relevant governmental bodies, as 

appropriate, shall make an initial 

determination as to whether to prohibit 

a given ICTS Transaction or propose 

mitigation measures, by which the ICTS 

Transaction may be permitted. Parties 

may submit information in response to 

the initial determination, including a 

response to the initial determination 

and any supporting materials and/or 

proposed measures to remediate or 

mitigate the risks identified in the initial 

determination as posed by the ICTS 

Transaction at issue. Upon 

consideration of the parties’ 

submissions, the Secretary will issue a 

final determination prohibiting the 

transaction, not prohibiting the 

transaction, or permitting the 

transaction subject to the adoption of 

measures determined by the Secretary to 

sufficiently mitigate the risks associated 

with the ICTS Transaction. The 

Secretary shall also engage in 

coordination and information sharing, 

as appropriate, with international 

partners on the application of these 

regulations. 

§ 7.2 Definitions. 

Appropriate agency heads means the 

Secretary of the Treasury, the Secretary 

of State, the Secretary of Defense, the 

Attorney General, the Secretary of 

Homeland Security, the United States 

Trade Representative, the Director of 

National Intelligence, the Administrator 

of General Services, the Chairman of the 

Federal Communications Commission, 

and the heads of any other executive 

departments and agencies the Secretary 

determines is appropriate. 

Commercial item has the same 

meaning given to it in Federal 

Acquisition Regulation (48 CFR part 

2.101). 

Department means the United States 

Department of Commerce. 

Entity means a partnership, 

association, trust, joint venture, 

corporation, group, subgroup, or other 

non-U.S. governmental organization. 

Executive Order means Executive 

Order 13873, May 15, 2019, ‘‘Securing 

the Information and Communications 

Technology and Services Supply 

Chain’’. 

Foreign adversary means any foreign 

government or foreign non-government 

person determined by the Secretary to 

have engaged in a long-term pattern or 

serious instances of conduct 

significantly adverse to the national 

security of the United States or security 

and safety of United States persons. 

ICTS Transaction means any 

acquisition, importation, transfer, 

installation, dealing in, or use of any 

information and communications 

technology or service, including 

ongoing activities, such as managed 

services, data transmission, software 

updates, repairs, or the platforming or 

data hosting of applications for 

consumer download. An ICTS 

Transaction includes any other 

transaction, the structure of which is 

designed or intended to evade or 

circumvent the application of the 

Executive Order. The term ICTS 

Transaction includes a class of ICTS 

Transactions. 

IEEPA means the International 

Emergency Economic Powers Act (50 

U.S.C. 1701, et seq.). 

Information and communications 

technology or services or ICTS means 

any hardware, software, or other 

product or service, including cloudcomputing services, primarily intended 

to fulfill or enable the function of 

information or data processing, storage, 

retrieval, or communication by 

electronic means (including 

electromagnetic, magnetic, and 

photonic), including through 

transmission, storage, or display. 

Party or parties to a transaction 

means a person engaged in an ICTS 

Transaction, including the person 

acquiring the ICTS and the person from 

whom the ICTS is acquired. Party or 

parties to a transaction include entities 

designed, or otherwise used with the 

intention, to evade or circumvent 

application of the Executive Order. For 

purposes of this rule, this definition 

does not include common carriers, 

except to the extent that a common 

carrier knew or should have known (as 

the term ‘‘knowledge’’ is defined in 15 

CFR 772.1) that it was providing 

transportation services of ICTS to one or 

more of the parties to a transaction that 

has been prohibited in a final written 

determination made by the Secretary or, 

if permitted subject to mitigation 

measures, in violation of such 

mitigation measures. 

Person means an individual or entity. 

Person owned by, controlled by, or 

subject to the jurisdiction or direction of 

a foreign adversary means any person, 

wherever located, who acts as an agent, 

representative, or employee, or any 

person who acts in any other capacity 

at the order, request, or under the 

direction or control, of a foreign 

adversary or of a person whose activities 

are directly or indirectly supervised, 

directed, controlled, financed, or 

subsidized in whole or in majority part 


khammond on DSKJM1Z7X2PROD with RULES
4924 Federal Register / Vol. 86, No. 11 / Tuesday, January 19, 2021 / Rules and Regulations 

by a foreign adversary; any person, 

wherever located, who is a citizen or 

resident of a nation-state controlled by 

a foreign adversary; any corporation, 

partnership, association, or other 

organization organized under the laws 

of a nation-state controlled by a foreign 

adversary; and any corporation, 

partnership, association, or other 

organization, wherever organized or 

doing business, that is owned or 

controlled by a foreign adversary. 

Secretary means the Secretary of 

Commerce or the Secretary’s designee. 

Sensitive personal data means: 

(1) Personally-identifiable 

information, including: 

(i) Financial data that could be used 

to analyze or determine an individual’s 

financial distress or hardship; 

(ii) The set of data in a consumer 

report, as defined under 15 U.S.C. 

1681a, unless such data is obtained from 

a consumer reporting agency for one or 

more purposes identified in 15 U.S.C. 

1681b(a); 

(iii) The set of data in an application 

for health insurance, long-term care 

insurance, professional liability 

insurance, mortgage insurance, or life 

insurance; 

(iv) Data relating to the physical, 

mental, or psychological health 

condition of an individual; 

(v) Non-public electronic 

communications, including email, 

messaging, or chat communications, 

between or among users of a U.S. 

business’s products or services if a 

primary purpose of such product or 

service is to facilitate third-party user 

communications; 

(vi) Geolocation data collected using 

positioning systems, cell phone towers, 

or WiFi access points such as via a 

mobile application, vehicle GPS, other 

onboard mapping tool, or wearable 

electronic device; 

(vii) Biometric enrollment data 

including facial, voice, retina/iris, and 

palm/fingerprint templates; 

(viii) Data stored and processed for 

generating a Federal, State, Tribal, 

Territorial, or other government 

identification card; 

(ix) Data concerning U.S. Government 

personnel security clearance status; or 

(x) The set of data in an application 

for a U.S. Government personnel 

security clearance or an application for 

employment in a position of public 

trust; or 

(2) Genetic information, which 

includes the results of an individual’s 

genetic tests, including any related 

genetic sequencing data, whenever such 

results, in isolation or in combination 

with previously released or publicly 

available data, constitute identifiable 

data. Such results shall not include data 

derived from databases maintained by 

the U.S. Government and routinely 

provided to private parties for purposes 

of research. For purposes of this 

paragraph, ‘‘genetic test’’ shall have the 

meaning provided in 42 U.S.C. 300gg– 

91(d)(17). 

Undue or unacceptable risk means 

those risks identified in Section 1(a)(ii) 

of the Executive Order. 

United States person means any 

United States citizen; any permanent 

resident alien; or any entity organized 

under the laws of the United States or 

any jurisdiction within the United 

States (including such entity’s foreign 

branches). 

§ 7.3 Scope of Covered ICTS Transactions. 

(a) This part applies only to an ICTS 

Transaction that: 

(1) Is conducted by any person subject 

to the jurisdiction of the United States 

or involves property subject to the 

jurisdiction of the United States; 

(2) Involves any property in which 

any foreign country or a national thereof 

has an interest (including through an 

interest in a contract for the provision 

of the technology or service); 

(3) Is initiated, pending, or completed 

on or after January 19, 2021, regardless 

of when any contract applicable to the 

transaction is entered into, dated, or 

signed or when any license, permit, or 

authorization applicable to such 

transaction was granted. Any act or 

service with respect to an ICTS 

Transaction, such as execution of any 

provision of a managed services 

contract, installation of software 

updates, or the conducting of repairs, 

that occurs on or after January 19, 2021 

may be deemed an ICTS Transaction 

within the scope of this part, even if the 

contract was initially entered into, or 

the activity commenced, prior to 

January 19, 2021; and 

(4) Involves one of the following 

ICTS: 

(i) ICTS that will be used by a party 

to a transaction in a sector designated as 

critical infrastructure by Presidential 

Policy Directive 21—Critical 

Infrastructure Security and Resilience, 

including any subsectors or 

subsequently designated sectors; 

(ii) Software, hardware, or any other 

product or service integral to: 

(A) Wireless local area networks, 

including: 

(1) Distributed antenna systems; and 

(2) Small-cell or micro-cell base 

stations; 

(B) Mobile networks, including: 

(1) eNodeB based stations; 

(2) gNodeB or 5G new radio base 

stations; 

(3) NodeB base stations; 

(4) Home location register databases; 

(5) Home subscriber servers; 

(6) Mobile switching centers; 

(7) Session border controllers; and 

(8) Operation support systems; 

(C) Satellite payloads, including: 

(1) Satellite telecommunications 

systems; 

(2) Satellite remote sensing systems; 

and 

(3) Satellite position, navigation, and 

timing systems; 

(D) Satellite operations and control, 

including: 

(1) Telemetry, tracking, and control 

systems; 

(2) Satellite control centers; 

(3) Satellite network operations; 

(4) Multi-terminal ground stations; 

and 

(5) Satellite uplink centers; 

(E) Cable access points, including: 

(1) Core routers; 

(2) Core networks; and 

(3) Core switches; 

(F) Wireline access points, including: 

(1) Access infrastructure datalinks; 

and 

(2) Access infrastructure digital loops; 

(G) Core networking systems, 

including: 

(1) Core infrastructure synchronous 

optical networks and synchronous 

digital hierarchy systems; 

(2) Core infrastructure dense 

wavelength division multiplexing or 

optical transport network systems; 

(3) Core infrastructure internet 

protocol and internet routing systems; 

(4) Core infrastructure content 

delivery network systems; 

(5) Core infrastructure internet 

protocol and multiprotocol label 

switching systems; 

(6) Data center multiprotocol label 

switching routers; and 

(7) Metropolitan multiprotocol label 

switching routers; or 

(H) Long- and short-haul networks, 

including: 

(1) Fiber optical cables; and 

(2) Repeaters; 

(iii) Software, hardware, or any other 

product or service integral to data 

hosting or computing services, to 

include software-defined services such 

as virtual private servers, that uses, 

processes, or retains, or is expected to 

use, process, or retain, sensitive 

personal data on greater than one 

million U.S. persons at any point over 

the twelve (12) months preceding an 

ICTS Transaction, including: 

(A) Internet hosting services; 

(B) Cloud-based or distributed 

computing and data storage; 

(C) Managed services; and 

(D) Content delivery services; 


khammond on DSKJM1Z7X2PROD with RULES
Federal Register / Vol. 86, No. 11 / Tuesday, January 19, 2021 / Rules and Regulations 4925 

(iv) Any of the following ICTS 

products, if greater than one million 

units have been sold to U.S. persons at 

any point over the twelve (12) months 

prior to an ICTS Transaction: 

(A) Internet-enabled sensors, 

webcams, and any other end-point 

surveillance or monitoring device; 

(B) Routers, modems, and any other 

home networking device; or 

(C) Drones or any other unmanned 

aerial system; 

(v) Software designed primarily for 

connecting with and communicating via 

the internet that is in use by greater than 

one million U.S. persons at any point 

over the twelve (12) months preceding 

an ICTS Transaction, including: 

(A) Desktop applications; 

(B) Mobile applications; 

(C) Gaming applications; and 

(D) Web-based applications; or 

(vi) ICTS integral to: 

(A) Artificial intelligence and 

machine learning; 

(B) Quantum key distribution; 

(C) Quantum computing; 

(D) Drones; 

(E) Autonomous systems; or 

(F) Advanced Robotics. 

(b) This part does not apply to an 

ICTS Transaction that: 

(1) Involves the acquisition of ICTS 

items by a United States person as a 

party to a transaction authorized under 

a U.S. government-industrial security 

program; or 

(2) The Committee on Foreign 

Investment in the United States (CFIUS) 

is actively reviewing, or has reviewed, 

as a covered transaction or covered real 

estate transaction or as part of such a 

transaction under section 721 of the 

Defense Production Act of 1950, as 

amended, and its implementing 

regulations. 

(c) (c) Notwithstanding the exemption 

in paragraph (b)(2) of this section, ICTS 

Transactions conducted by parties to 

transactions reviewed by CFIUS that 

were not part of the covered transaction 

or covered real estate transaction 

reviewed by CFIUS remain fully subject 

to this part. 

§ 7.4 Determination of foreign adversaries. 

(a) The Secretary has determined that 

the following foreign governments or 

foreign non-government persons have 

engaged in a long-term pattern or 

serious instances of conduct 

significantly adverse to the national 

security of the United States or security 

and safety of United States persons and, 

therefore, constitute foreign adversaries 

solely for the purposes of the Executive 

Order, this rule, and any subsequent 

rule: 

(1) The People’s Republic of China, 

including the Hong Kong Special 

Administrative Region (China); 

(2) Republic of Cuba (Cuba); 

(3) Islamic Republic of Iran (Iran); 

(4) Democratic People’s Republic of 

Korea (North Korea); 

(5) Russian Federation (Russia); and 

(6) Venezuelan politician Nicola ́s 

Maduro (Maduro Regime). 

(b) The Secretary’s determination of 

foreign adversaries is solely for the 

purposes of the Executive Order, this 

rule, and any subsequent rule 

promulgated pursuant to the Executive 

Order. Pursuant to the Secretary’s 

discretion, the list of foreign adversaries 

will be revised as determined to be 

necessary. Such revisions will be 

effective immediately upon publication 

in the Federal Register without prior 

notice or opportunity for public 

comment. 

(c) The Secretary’s determination is 

based on multiple sources, including: 

(1) National Security Strategy of the 

United States; 

(2) The Director of National 

Intelligence’s 2016–2019 Worldwide 

Threat Assessments of the U.S. 

Intelligence Community; 

(3) The 2018 National Cyber Strategy 

of the United States of America; and 

(4) Reports and assessments from the 

U.S. Intelligence Community, the U.S. 

Departments of Justice, State and 

Homeland Security, and other relevant 

sources. 

(d) (d) The Secretary will periodically 

review this list in consultation with 

appropriate agency heads and may add 

to, subtract from, supplement, or 

otherwise amend this list. Any 

amendment to this list will apply to any 

ICTS Transaction that is initiated, 

pending, or completed on or after the 

date that the list is amended. 

§ 7.5 Effect on other laws. 

Nothing in this part shall be 

construed as altering or affecting any 

other authority, process, regulation, 

investigation, enforcement measure, or 

review provided by or established under 

any other provision of Federal law, 

including prohibitions under the 

National Defense Authorization Act of 

2019, the Federal Acquisition 

Regulations, or IEEPA, or any other 

authority of the President or the 

Congress under the Constitution of the 

United States. 

§ 7.6 Amendment, modification, or 

revocation. 

Except as otherwise provided by law, 

any determinations, prohibitions, or 

decisions issued under this part may be 

amended, modified, or revoked, in 

whole or in part, at any time. 

§ 7.7 Public disclosure of records. 

Public requests for agency records 

related to this part will be processed in 

accordance with the Department of 

Commerce’s Freedom of Information 

Act regulations, 15 CFR part 4, or other 

applicable law and regulation. 

Subpart B—Review of ICTS 

Transactions 

§ 7.100 General. 

In implementing this part, the 

Secretary of Commerce may: 

(a) Consider any and all relevant 

information held by, or otherwise made 

available to, the Federal Government 

that is not otherwise restricted by law 

for use for this purpose, including: 

(1) Publicly available information; 

(2) Confidential business information, 

as defined in 19 CFR 201.6, or 

proprietary information; 

(3) Classified National Security 

Information, as defined in Executive 

Order 13526 (December 29, 2009) and 

its predecessor executive orders, and 

Controlled Unclassified Information, as 

defined in Executive Order 13556 

(November 4, 2010); 

(4) Information obtained from state, 

local, tribal, or foreign governments or 

authorities; 

(5) Information obtained from parties 

to a transaction, including records 

related to such transaction that any 

party uses, processes, or retains, or 

would be expected to use, process, or 

retain, in their ordinary course of 

business for such a transaction; 

(6) Information obtained through the 

authority granted under sections 2(a) 

and (c) of the Executive Order and 

IEEPA, as set forth in U.S.C. 7.101; 

(7) Information provided by any other 

U.S. Government national security 

body, in each case only to the extent 

necessary for national security 

purposes, and subject to applicable 

confidentiality and classification 

requirements, including the Committee 

for the Assessment of Foreign 

Participation in the United States 

Telecommunications Services Sector 

and the Federal Acquisitions Security 

Council and its designated informationsharing bodies; and 

(8) Information provided by any other 

U.S. Government agency, department, or 

other regulatory body, including the 

Federal Communications Commission, 

Department of Homeland Security, and 

Department of Justice; 

(b) Consolidate the review of any 

ICTS Transactions with other 

transactions already under review 

where the Secretary determines that the 

transactions raise the same or similar 

issues, or that are otherwise properly 

consolidated; 


khammond on DSKJM1Z7X2PROD with RULES
4926 Federal Register / Vol. 86, No. 11 / Tuesday, January 19, 2021 / Rules and Regulations 

(c) In consultation with the 

appropriate agency heads, in 

determining whether an ICTS 

Transaction involves ICTS designed, 

developed, manufactured, or supplied, 

by persons owned by, controlled by, or 

subject to the jurisdiction or direction of 

a foreign adversary, consider the 

following: 

(1) Whether the person or its 

suppliers have headquarters, research, 

development, manufacturing, test, 

distribution, or service facilities, or 

other operations in a foreign country, 

including one controlled by, or subject 

to the jurisdiction of, a foreign 

adversary; 

(2) Ties between the person— 

including its officers, directors or 

similar officials, employees, 

consultants, or contractors—and a 

foreign adversary; 

(3) Laws and regulations of any 

foreign adversary in which the person is 

headquartered or conducts operations, 

including research and development, 

manufacturing, packaging, and 

distribution; and 

(4) Any other criteria that the 

Secretary deems appropriate; 

(d) In consultation with the 

appropriate agency heads, in 

determining whether an ICTS 

Transaction poses an undue or 

unacceptable risk, consider the 

following: 

(1) Threat assessments and reports 

prepared by the Director of National 

Intelligence pursuant to section 5(a) of 

the Executive Order; 

(2) Removal or exclusion orders 

issued by the Secretary of Homeland 

Security, the Secretary of Defense, or the 

Director of National Intelligence (or 

their designee) pursuant to 

recommendations of the Federal 

Acquisition Security Council, under 41 

U.S.C. 1323; 

(3) Relevant provisions of the Defense 

Federal Acquisition Regulation (48 CFR 

ch. 2) and the Federal Acquisition 

Regulation (48 CFR ch. 1), and their 

respective supplements; 

(4) The written assessment produced 

pursuant to section 5(b) of the Executive 

Order, as well as the entities, hardware, 

software, and services that present 

vulnerabilities in the United States as 

determined by the Secretary of 

Homeland Security pursuant to that 

section; 

(5) Actual and potential threats to 

execution of a ‘‘National Critical 

Function’’ identified by the Department 

of Homeland Security Cybersecurity and 

Infrastructure Security Agency; 

(6) The nature, degree, and likelihood 

of consequence to the United States 

public and private sectors that could 

occur if ICTS vulnerabilities were to be 

exploited; and 

(7) Any other source or information 

that the Secretary deems appropriate; 

and 

(e) In the event the Secretary finds 

that unusual and extraordinary harm to 

the national security of the United 

States is likely to occur if all of the 

procedures specified herein are 

followed, the Secretary may deviate 

from these procedures in a manner 

tailored to protect against that harm. 

§ 7.101 Information to be furnished on 

demand. 

(a) Pursuant to the authority granted 

to the Secretary under sections 2(a), 

2(b), and 2(c) of the Executive Order and 

IEEPA, persons involved in an ICTS 

Transaction may be required to furnish 

under oath, in the form of reports or 

otherwise, at any time as may be 

required by the Secretary, complete 

information relative to any act or 

transaction, subject to the provisions of 

this part. The Secretary may require that 

such reports include the production of 

any books, contracts, letters, papers, or 

other hard copy or electronic documents 

relating to any such act, transaction, or 

property, in the custody or control of 

the persons required to make such 

reports. Reports with respect to 

transactions may be required either 

before, during, or after such 

transactions. The Secretary may, 

through any person or agency, conduct 

investigations, hold hearings, 

administer oaths, examine witnesses, 

receive evidence, take depositions, and 

require by subpoena the attendance and 

testimony of witnesses and the 

production of any books, contracts, 

letters, papers, and other hard copy or 

documents relating to any matter under 

investigation, regardless of whether any 

report has been required or filed in 

connection therewith. 

(b) For purposes of paragraph (a) of 

this section, the term ‘‘document’’ 

includes any written, recorded, or 

graphic matter or other means of 

preserving thought or expression 

(including in electronic format), and all 

tangible things stored in any medium 

from which information can be 

processed, transcribed, or obtained 

directly or indirectly, including 

correspondence, memoranda, notes, 

messages, contemporaneous 

communications such as text and 

instant messages, letters, emails, 

spreadsheets, metadata, contracts, 

bulletins, diaries, chronological data, 

minutes, books, reports, examinations, 

charts, ledgers, books of account, 

invoices, air waybills, bills of lading, 

worksheets, receipts, printouts, papers, 

schedules, affidavits, presentations, 

transcripts, surveys, graphic 

representations of any kind, drawings, 

photographs, graphs, video or sound 

recordings, and motion pictures or other 

film. 

(c) Persons providing documents to 

the Secretary pursuant to this section 

must produce documents in a format 

useable to the Department of Commerce, 

which may be detailed in the request for 

documents or otherwise agreed to by the 

parties. 

§ 7.102 Confidentiality of information. 

(a) Information or documentary 

materials, not otherwise publicly or 

commercially available, submitted or 

filed with the Secretary under this part 

will not be released publicly except to 

the extent required by law. 

(b) The Secretary may disclose 

information or documentary materials 

that are not otherwise publicly or 

commercially available and referenced 

in paragraph (a) in the following 

circumstances: 

(1) Pursuant to any administrative or 

judicial proceeding; 

(2) Pursuant to an act of Congress; 

(3) Pursuant to a request from any 

duly authorized committee or 

subcommittee of Congress; 

(4) Pursuant to any domestic 

governmental entity, or to any foreign 

governmental entity of a United States 

ally or partner, information or 

documentary materials, not otherwise 

publicly or commercially available and 

important to the national security 

analysis or actions of the Secretary, but 

only to the extent necessary for national 

security purposes, and subject to 

appropriate confidentiality and 

classification requirements; 

(5) Where the parties or a party to a 

transaction have consented, the 

information or documentary material 

that are not otherwise publicly or 

commercially available may be 

disclosed to third parties; and 

(6) Any other purpose authorized by 

law. 

(c) This section shall continue to 

apply with respect to information and 

documentary materials that are not 

otherwise publicly or commercially 

available and submitted to or obtained 

by the Secretary even after the Secretary 

issues a final determination pursuant to 

§ 7.109 of this part. 

(d) The provisions of 18 U.S.C. 1905, 

relating to fines and imprisonment and 

other penalties, shall apply with respect 

to the disclosure of information or 

documentary material provided to the 

Secretary under these regulations. 


khammond on DSKJM1Z7X2PROD with RULES
Federal Register / Vol. 86, No. 11 / Tuesday, January 19, 2021 / Rules and Regulations 4927 

§ 7.103 Initial review of ICTS Transactions. 

(a) Upon receipt of any information 

identified in § 7.100(a), upon written 

request of an appropriate agency head, 

or at the Secretary’s discretion, the 

Secretary may consider any referral for 

review of a transaction (referral). 

(b) In considering a referral pursuant 

to paragraph (a), the Secretary shall 

assess whether the referral falls within 

the scope of § 7.3(a) of this part and 

involves ICTS designed, developed, 

manufactured, or supplied by persons 

owned by, controlled by, or subject to 

the jurisdiction or direction of a foreign 

adversary, and determine whether to: 

(1) Accept the referral and commence 

an initial review of the transaction; 

(2) Request additional information, as 

identified in § 7.100(a), from the 

referring entity regarding the referral; or 

(3) Reject the referral. 

(c) Upon accepting a referral pursuant 

to paragraph (b) of this section, the 

Secretary shall conduct an initial review 

of the ICTS Transaction and assess 

whether the ICTS Transaction poses an 

undue or unacceptable risk, which may 

be determined by evaluating the 

following criteria: 

(1) The nature and characteristics of 

the information and communications 

technology or services at issue in the 

ICTS Transaction, including technical 

capabilities, applications, and market 

share considerations; 

(2) The nature and degree of the 

ownership, control, direction, or 

jurisdiction exercised by the foreign 

adversary over the design, development, 

manufacture, or supply at issue in the 

ICTS Transaction; 

(3) The statements and actions of the 

foreign adversary at issue in the ICTS 

Transaction; 

(4) The statements and actions of the 

persons involved in the design, 

development, manufacture, or supply at 

issue in the ICTS Transaction; 

(5) The statements and actions of the 

parties to the ICTS Transaction; 

(6) Whether the ICTS Transaction 

poses a discrete or persistent threat; 

(7) The nature of the vulnerability 

implicated by the ICTS Transaction; 

(8) Whether there is an ability to 

otherwise mitigate the risks posed by 

the ICTS Transaction; 

(9) The severity of the harm posed by 

the ICTS Transaction on at least one of 

the following: 

(i) Health, safety, and security; 

(ii) Critical infrastructure; 

(iii) Sensitive data; 

(iv) The economy; 

(v) Foreign policy; 

(vi) The natural environment; and 

(vii) National Essential Functions (as 

defined by Federal Continuity Directive2 (FCD–2)); and 

(10) The likelihood that the ICTS 

Transaction will in fact cause 

threatened harm. 

(d) If the Secretary finds that an ICTS 

Transaction does not meet the criteria of 

paragraph (b) of this section: 

(1) The transaction shall no longer be 

under review; and 

(2) Future review of the transaction 

shall not be precluded, where additional 

information becomes available to the 

Secretary. 

§ 7.104 First interagency consultation. 

Upon finding that an ICTS 

Transaction likely meets the criteria set 

forth in § 7.103(c) during the initial 

review under § 7.103, the Secretary shall 

notify the appropriate agency heads 

and, in consultation with them, shall 

determine whether the ICTS 

Transaction meets the criteria set forth 

in § 7.103(c). 

§ 7.105 Initial determination. 

(a) If, after the consultation required 

by § 7.104, the Secretary determines that 

the ICTS Transaction does not meet the 

criteria set forth in § 7.103(c): 

(1) The transaction shall no longer be 

under review; and 

(2) Future review of the transaction 

shall not be precluded, where additional 

information becomes available to the 

Secretary. 

(b) If, after the consultation required 

by § 7.104, the Secretary determines that 

the ICTS Transaction meets the criteria 

set forth in § 7.103(c), the Secretary 

shall: 

(1) Make an initial written 

determination, which shall be dated and 

signed by the Secretary, that: 

(i) Explains why the ICTS Transaction 

meets the criteria set forth in § 7.103(c); 

and 

(ii) Sets forth whether the Secretary 

has initially determined to prohibit the 

ICTS Transaction or to propose 

mitigation measures, by which the ICTS 

Transaction may be permitted; and 

(2) Notify the parties to the ICTS 

Transaction either through publication 

in the Federal Register or by serving a 

copy of the initial determination on the 

parties via registered U.S. mail, 

facsimile, and electronic transmission, 

or third-party commercial carrier, to an 

addressee’s last known address or by 

personal delivery. 

(c) Notwithstanding the fact that the 

initial determination to prohibit or 

propose mitigation measures on an ICTS 

Transaction may, in whole or in part, 

rely upon classified national security 

information, or sensitive but 

unclassified information, the initial 

determination will contain no classified 

national security information, nor 

reference thereto, and, at the Secretary’s 

discretion, may not contain sensitive 

but unclassified information. 

§ 7.106 Recordkeeping requirement. 

Upon notification that an ICTS 

Transaction is under review or that an 

initial determination concerning an 

ICTS Transaction has been made, a 

notified person must immediately take 

steps to retain any and all records 

relating to such transaction. 

§ 7.107 Procedures governing response 

and mitigation. 

Within 30 days of service of the 

Secretary’s notification pursuant to 

§ 7.105, a party to an ICTS Transaction 

may respond to the Secretary’s initial 

determination or assert that the 

circumstances resulting in the initial 

determination no longer apply, and thus 

seek to have the initial determination 

rescinded or mitigated pursuant to the 

following administrative procedures: 

(a) A party may submit arguments or 

evidence that the party believes 

establishes that insufficient basis exists 

for the initial determination, including 

any prohibition of the ICTS Transaction; 

(b) A party may propose remedial 

steps on the party’s part, such as 

corporate reorganization, disgorgement 

of control of the foreign adversary, 

engagement of a compliance monitor, or 

similar steps, which the party believes 

would negate the basis for the initial 

determination; 

(c) Any submission must be made in 

writing; 

(d) A party responding to the 

Secretary’s initial determination may 

request a meeting with the Department, 

and the Department may, at its 

discretion, agree or decline to conduct 

such meetings prior to making a final 

determination pursuant to § 7.109; 

(e) This rule creates no right in any 

person to obtain access to information 

in the possession of the U.S. 

Government that was considered in 

making the initial determination to 

prohibit the ICTS Transaction, to 

include classified national security 

information or sensitive but unclassified 

information; and 

(f) (f) If the Department receives no 

response from the parties within 30 

days after service of the initial 

determination to the parties, the 

Secretary may determine to issue a final 

determination without the need to 

engage in the consultation process 

provided in section 7.108 of this rule. 

§ 7.108 Second interagency consultation. 

(a) Upon receipt of any submission by 

a party to an ICTS Transaction under 

§ 7.107, the Secretary shall consider 


khammond on DSKJM1Z7X2PROD with RULES
4928 Federal Register / Vol. 86, No. 11 / Tuesday, January 19, 2021 / Rules and Regulations 

whether and how any information 

provided—including proposed 

mitigation measures—affects an initial 

determination of whether the ICTS 

Transaction meets the criteria set forth 

in § 7.103(c). 

(b) After considering the effect of any 

submission by a party to an ICTS 

Transaction under § 7.107 consistent 

with paragraph (a), the Secretary shall 

consult with and seek the consensus of 

all appropriate agency heads prior to 

issuing a final determination as to 

whether the ICTS Transaction shall be 

prohibited, not prohibited, or permitted 

pursuant to the adoption of negotiated 

mitigation measures. 

(c) If consensus is unable to be 

reached, the Secretary shall notify the 

President of the Secretary’s proposed 

final determination and any appropriate 

agency head’s opposition thereto. 

(d) After receiving direction from the 

President regarding the Secretary’s 

proposed final determination and any 

appropriate agency head’s opposition 

thereto, the Secretary shall issue a final 

determination pursuant to § 7.109. 

§ 7.109 Final determination. 

(a) For each transaction for which the 

Secretary issues an initial determination 

that an ICTS Transaction is prohibited, 

the Secretary shall issue a final 

determination as to whether the ICTS 

Transaction is: 

(1) Prohibited; 

(2) Not prohibited; or 

(3) Permitted, at the Secretary’s 

discretion, pursuant to the adoption of 

negotiated mitigation measures. 

(b) Unless the Secretary determines in 

writing that additional time is 

necessary, the Secretary shall issue the 

final determination within 180 days of 

accepting a referral and commencing the 

initial review of the ICTS Transaction 

pursuant to § 7.103. 

(c) If the Secretary determines that an 

ICTS Transaction is prohibited, the 

Secretary shall have the discretion to 

direct the least restrictive means 

necessary to tailor the prohibition to 

address the undue or unacceptable risk 

posed by the ICTS Transaction. 

(d) The final determination shall: 

(1) Be written, signed, and dated; 

(2) Describe the Secretary’s 

determination; 

(3) Be unclassified and contain no 

reference to classified national security 

information; 

(4) Consider and address any 

information received from a party to the 

ICTS Transaction; 

(5) Direct, if applicable, the timing 

and manner of the cessation of the ICTS 

Transaction; 

(6) Explain, if applicable, that a final 

determination that the ICTS Transaction 

is not prohibited does not preclude the 

future review of transactions related in 

any way to the ICTS Transaction; 

(7) Include, if applicable, a 

description of the mitigation measures 

agreed upon by the party or parties to 

the ICTS Transaction and the Secretary; 

and 

(8) State the penalties a party will face 

if it fails to comply fully with any 

mitigation agreement or direction, 

including violations of IEEPA, or other 

violations of law. 

(e) The written, signed, and dated 

final determination shall be sent to: 

(1) The parties to the ICTS 

Transaction via registered U.S. mail and 

electronic mail; and 

(2) The appropriate agency heads. 

(f) The results of final written 

determinations to prohibit an ICTS 

Transaction shall be published in the 

Federal Register. The publication shall 

omit any confidential business 

information. 

§ 7.110 Classified national security 

information. 

In any review of a determination 

made under this part, if the 

determination was based on classified 

national security information, such 

information may be submitted to the 

reviewing court ex parte and in camera. 

This section does not confer or imply 

any right to review in any tribunal, 

judicial or otherwise. 

Subpart C—Enforcement 

§ 7.200 Penalties. 

(a) Maximum penalties. 

(1) Civil penalty. A civil penalty not 

to exceed the amount set forth in 

Section 206 of IEEPA, 50 U.S.C. 1705, 

may be imposed on any person who 

violates, attempts to violate, conspires 

to violate, or causes any knowing 

violation of any final determination or 

direction issued pursuant to this part, 

including any violation of a mitigation 

agreement issued or other condition 

imposed under this part. IEEPA 

provides for a maximum civil penalty 

not to exceed the greater of $250,000, 

subject to inflationary adjustment, or an 

amount that is twice the amount of the 

transaction that is the basis of the 

violation with respect to which the 

penalty is imposed. 

(2) Criminal penalty. A person who 

willfully commits, willfully attempts to 

commit, or willfully conspires to 

commit, or aids and abets in the 

commission of a violation of any final 

determination, direction, or mitigation 

agreement shall, upon conviction of a 

violation of IEEPA, be fined not more 

than $1,000,000, or if a natural person, 

may be imprisoned for not more than 20 

years, or both. 

(3) The Secretary may impose a civil 

penalty of not more than the maximum 

statutory penalty amount, which, when 

adjusted for inflation, is $307,922, or 

twice the amount of the transaction that 

is the basis of the violation, per 

violation on any person who violates 

any final determination, direction, or 

mitigation agreement issued pursuant to 

this part under IEEPA. 

(i) Notice of the penalty, including a 

written explanation of the penalized 

conduct specifying the laws and 

regulations allegedly violated and the 

amount of the proposed penalty, and 

notifying the recipient of a right to make 

a written petition within 30 days as to 

why a penalty should not be imposed, 

shall be served on the notified party or 

parties. 

(ii) The Secretary shall review any 

presentation and issue a final 

administrative decision within 30 days 

of receipt of the petition. 

(4) Any civil penalties authorized in 

this section may be recovered in a civil 

action brought by the United States in 

U.S. district court. 

(b) Adjustments to penalty amounts. 

(1) The civil penalties provided in 

IEEPA are subject to adjustment 

pursuant to the Federal Civil Penalties 

Inflation Adjustment Act of 1990 (Pub. 

L. 101–410, as amended, 28 U.S.C. 2461 

note). 

(2) The criminal penalties provided in 

IEEPA are subject to adjustment 

pursuant to 18 U.S.C. 3571. 

(c) The penalties available under this 

section are without prejudice to other 

penalties, civil or criminal, available 

under law. Attention is directed to 18 

U.S.C. 1001, which provides that 

whoever, in any matter within the 

jurisdiction of any department or agency 

in the United States, knowingly and 

willfully falsifies, conceals, or covers up 

by any trick, scheme, or device a 

material fact, or makes any false, 

fictitious, or fraudulent statements or 

representations, or makes or uses any 

false writing or document knowing the 

same to contain any false, fictitious, or 

fraudulent statement or entry, shall be 

fined under title 18, United States Code, 

or imprisoned not more than 5 years, or 

both. 

[FR Doc. 2021–01234 Filed 1–14–21; 4:15 pm] 

BILLING CODE 3510–20–P 


khammond on DSKJM1Z7X2PROD with RULES