```

[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 5310 Reported in Senate (RS)]

<DOC>

                                                       Calendar No. 702
118th CONGRESS
  2d Session
                                S. 5310

                          [Report No. 118-296]

To amend title 41, United States Code, to make changes with respect to 
   the Federal Acquisition Security Council, and for other purposes.

_______________________________________________________________________

                   IN THE SENATE OF THE UNITED STATES

                           November 13, 2024

    Mr. Peters (for himself, Mr. Rounds, and Mr. Scott of Florida) 
introduced the following bill; which was read twice and referred to the 
        Committee on Homeland Security and Governmental Affairs

                           December 16, 2024

               Reported by Mr. Peters, with an amendment
 [Strike out all after the enacting clause and insert the part printed 
                               in italic]

_______________________________________________________________________

                                 A BILL

 
To amend title 41, United States Code, to make changes with respect to 
   the Federal Acquisition Security Council, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

<DELETED>SECTION 1. SHORT TITLE.</DELETED>

<DELETED>    This Act may be cited as the ``Federal Acquisition 
Security Council Improvement Act of 2024''.</DELETED>

<DELETED>SEC. 2. CHANGES WITH RESPECT TO THE FEDERAL ACQUISITION 
              SECURITY COUNCIL.</DELETED>

<DELETED>    (a) Definition of Source of Concern, Covered Source of 
Concern, Recommended Order, and Designated Order.--Section 1321 of 
title 41, United States Code, is amended--</DELETED>
        <DELETED>    (1) by redesignating paragraphs (5) through (8) as 
        paragraphs (7) through (10);</DELETED>
        <DELETED>    (2) by inserting after paragraph (4) the following 
        new paragraph:</DELETED>
        <DELETED>    ``(5) Covered source of concern.--The term 
        `covered source of concern' means a source of concern that is 
        specifically designated as a `covered source of concern' by a 
        statute that states that such designation is for the purposes 
        of this subchapter.</DELETED>
        <DELETED>    ``(6) Designated order.--The term `designated 
        order' means an order described under section 1323(c)(3).''; 
        and</DELETED>
        <DELETED>    (3) by adding at the end the following new 
        paragraph:</DELETED>
        <DELETED>    ``(11) Recommended order.--The term `recommended 
        order' means an order recommended under section 
        1323(c)(2).</DELETED>
        <DELETED>    ``(12) Source of concern.--</DELETED>
                <DELETED>    ``(A) In general.--The term `source of 
                concern' means a source--</DELETED>
                        <DELETED>    ``(i) subject to the jurisdiction, 
                        direction, or control of the government of a 
                        foreign adversary, or operates on behalf of the 
                        government of a foreign adversary; or</DELETED>
                        <DELETED>    ``(ii) that poses a risk to the 
                        national security of the United States based on 
                        collaboration with, whole or partial ownership 
                        or control by, or being affiliated with a 
                        military, internal security force, or 
                        intelligence agency of a foreign 
                        adversary.</DELETED>
                <DELETED>    ``(B) Foreign adversary defined.--In this 
                paragraph, the term `foreign adversary' has the meaning 
                given the term `covered nation' in section 4872(d) of 
                title 10.''.</DELETED>
<DELETED>    (b) Establishment and Members of Council.--Section 1322 of 
title 41, United States Code, is amended--</DELETED>
        <DELETED>    (1) in subsection (a), by striking ``executive 
        branch'' and inserting ``Executive Office of the 
        President'';</DELETED>
        <DELETED>    (2) in subsection (b)--</DELETED>
                <DELETED>    (A) by amending paragraph (1) to read as 
                follows:</DELETED>
        <DELETED>    ``(1) In general.--The members of the Council 
        shall be as follows:</DELETED>
                <DELETED>    ``(A) The Administrator for Federal 
                Procurement Policy.</DELETED>
                <DELETED>    ``(B) The Deputy Director for Management 
                of the Office of Management and Budget.</DELETED>
                <DELETED>    ``(C) The following officials, each of 
                whom shall occupy a position at the level of Assistant 
                Secretary or Deputy Assistant Secretary (or 
                equivalent):</DELETED>
                        <DELETED>    ``(i) Two officials from the 
                        Office of the Director of National 
                        Intelligence, one of which shall be from the 
                        National Counterintelligence and Security 
                        Center.</DELETED>
                        <DELETED>    ``(ii) Two officials from the 
                        Department of Defense, one of which shall be 
                        from the National Security Agency.</DELETED>
                        <DELETED>    ``(iii) Two officials from the 
                        Department of Homeland Security, one of which 
                        shall be from the Cybersecurity and 
                        Infrastructure Security Agency.</DELETED>
                        <DELETED>    ``(iv) One official from the 
                        General Services Administration.</DELETED>
                        <DELETED>    ``(v) One official from the Office 
                        of the National Cyber Director.</DELETED>
                        <DELETED>    ``(vi) Two officials from the 
                        Department of Justice, one of which shall be 
                        from the Federal Bureau of 
                        Investigation.</DELETED>
                        <DELETED>    ``(vii) Two officials from the 
                        Department of Commerce, one of which shall be 
                        from the National Institute of Standards and 
                        Technology and one of which shall be from the 
                        Bureau of Industry and Security.</DELETED>
                        <DELETED>    ``(viii) An official from any 
                        executive agency not listed under clauses (i) 
                        through (vii) whose temporary or permanent 
                        participation is determined by the Chairperson 
                        of the Council to be necessary to carry out the 
                        functions of the Council while maintaining the 
                        intended balance in subject matter 
                        expertise.''; and</DELETED>
                <DELETED>    (B) in paragraph (2)--</DELETED>
                        <DELETED>    (i) in the heading, by striking 
                        ``Lead representatives'' and inserting 
                        ``Members'';</DELETED>
                        <DELETED>    (ii) by amending subparagraph 
                        (A)(i) to read as follows:</DELETED>
                        <DELETED>    ``(i) In general.--The head of 
                        each executive agency listed under paragraph 
                        (1)(C) shall designate the official or 
                        officials from that agency who shall serve on 
                        the Council in accordance with such 
                        paragraph.'';</DELETED>
                        <DELETED>    (iii) by amending subparagraph 
                        (A)(ii) to read as follows:</DELETED>
                        <DELETED>    ``(ii) Requirements.--To the 
                        extent feasible, any official designated under 
                        clause (i) shall have expertise in supply chain 
                        risk management, acquisitions, law, or 
                        information and communications technology.''; 
                        and</DELETED>
                        <DELETED>    (iv) by amending subparagraph (B) 
                        to read as follows:</DELETED>
                <DELETED>    ``(B) Functions.--A member of the Council 
                shall--</DELETED>
                        <DELETED>    ``(i) regularly participate in the 
                        activities of the Council;</DELETED>
                        <DELETED>    ``(ii) ensure that any information 
                        requested by the Council from the agency 
                        represented by the member is provided to the 
                        Council; and</DELETED>
                        <DELETED>    ``(iii) ensure that the head of 
                        the agency represented by the member and other 
                        appropriate personnel of the agency are aware 
                        of the activities of the Council.'';</DELETED>
        <DELETED>    (3) in subsection (c)--</DELETED>
                <DELETED>    (A) by amending paragraph (1) to read as 
                follows:</DELETED>
        <DELETED>    ``(1) In general.--The Chairperson of the Council 
        shall be--</DELETED>
                <DELETED>    ``(A) the National Cyber Director; 
                or</DELETED>
                <DELETED>    ``(B) another member of the Council 
                designated by the National Cyber Director.''; 
                and</DELETED>
                <DELETED>    (B) in paragraph (2)--</DELETED>
                        <DELETED>    (i) in subparagraph (B), by 
                        striking ``(b)(1)(H)'' and inserting 
                        ``(b)(1)(C)(vii)''; and</DELETED>
                        <DELETED>    (ii) in subparagraph (C), by 
                        striking ``lead representative of each agency 
                        represented on the Council'' and inserting 
                        ``members of the Council''; and</DELETED>
        <DELETED>    (4) in subsection (d)--</DELETED>
                <DELETED>    (A) by striking ``The Council'' and 
                inserting the following:</DELETED>
        <DELETED>    ``(1) Council meetings.--The Council''; 
        and</DELETED>
                <DELETED>    (B) by adding at the end the 
                following:</DELETED>
        <DELETED>    ``(2) Other meetings.--The Chairperson of the 
        Council shall meet, not less frequently than semiannually, 
        with--</DELETED>
                <DELETED>    ``(A) the Secretary of Homeland Security, 
                the Secretary of Defense, and the Director of National 
                Intelligence; or</DELETED>
                <DELETED>    ``(B) in the case that any of the 
                officials under subparagraph (A) delegated authority to 
                an official under section 1323(c)(6)(C), with the 
                delegated official.''.</DELETED>
<DELETED>    (c) Functions and Authorities.--Section 1323 of title 41, 
United States Code, is amended--</DELETED>
        <DELETED>    (1) in subsection (a)--</DELETED>
                <DELETED>    (A) by striking ``supply chain'' each 
                place it appears and inserting ``acquisition security 
                and supply chain'';</DELETED>
                <DELETED>    (B) in paragraph (1), as amended by 
                subparagraph (A), by striking ``, particularly'' and 
                inserting ``that arise'';</DELETED>
                <DELETED>    (C) in paragraph (2), as amended by 
                subparagraph (A), by inserting ``associated with the 
                acquisition and use of covered articles'' after 
                ``risk'';</DELETED>
                <DELETED>    (D) in paragraph (6)--</DELETED>
                        <DELETED>    (i) by striking ``posed by'' and 
                        inserting ``associated with''; and</DELETED>
                        <DELETED>    (ii) by inserting ``and use'' 
                        before ``of covered articles'';</DELETED>
                <DELETED>    (E) by redesignating paragraph (7) as 
                paragraph (12);</DELETED>
                <DELETED>    (F) in paragraph (12), as redesignated by 
                subparagraph (E), by striking ``posed by acquisitions'' 
                and inserting ``associated with the acquisition''; 
                and</DELETED>
                <DELETED>    (G) by inserting after paragraph (6) the 
                following new paragraphs:</DELETED>
        <DELETED>    ``(7) Implementing a prioritization scheme for 
        evaluating the security risks associated with the acquisition 
        and use of covered articles provided or produced by a covered 
        source of concern.</DELETED>
        <DELETED>    ``(8) Evaluating each covered source of concern to 
        determine whether to issue a designated order with respect to 
        the covered source of concern or a covered article produced or 
        provided by the covered source of concern.</DELETED>
        <DELETED>    ``(9) Evaluating sources of concern to determine 
        whether to issue a recommended order with respect to the source 
        of concern, or any covered article produced or provided by the 
        source of concern.</DELETED>
        <DELETED>    ``(10) Monitoring the issuance of designated 
        orders under subsection (c)(6)(B), as required, by the 
        Secretary of Homeland Security, the Secretary of Defense, and 
        the Director of National Intelligence with the requirement to 
        issue designated orders under subsection (c)(6)(B) and 
        providing technical assistance to those agencies on compliance 
        matters.</DELETED>
        <DELETED>    ``(11) Reporting to Congress annually on the 
        security risks associated with the acquisition and use of 
        covered articles produced or provided by sources of 
        concern.'';</DELETED>
        <DELETED>    (2) in subsection (b)--</DELETED>
                <DELETED>    (A) by striking ``The Council'' and 
                inserting the following:</DELETED>
        <DELETED>    ``(1) In general.--The Council''; and</DELETED>
                <DELETED>    (B) in paragraph (1), as so redesignated, 
                by striking ``a program office and''; and</DELETED>
                <DELETED>    (C) by adding at the end the following new 
                paragraph:</DELETED>
        <DELETED>    ``(2) Federal acquisition security council program 
        office.--</DELETED>
                <DELETED>    ``(A) Establishment.--The Council shall 
                establish a Federal Acquisition Security Council 
                Program Office (referred to in this paragraph as the 
                `Program Office') within the Office of the National 
                Cyber Director to carry out the functions of the 
                Council duties described under subparagraph 
                (B).</DELETED>
                <DELETED>    ``(B) Duties.--The Program Office shall 
                provide to the Council and any committees, working 
                groups, or other constituent bodies established by the 
                Council under paragraph (1)--</DELETED>
                        <DELETED>    ``(i) administrative, legal, and 
                        policy support; and</DELETED>
                        <DELETED>    ``(ii) analysis and subject matter 
                        expertise on information communications 
                        technology, acquisition security, and supply 
                        chain risk.</DELETED>
                <DELETED>    ``(C) Structure.--The head of the Program 
                Office shall be a senior official from the Office of 
                the National Cyber Director that occupies a position at 
                the level of Assistant Secretary or Deputy Assistant 
                Secretary (or equivalent).</DELETED>
                <DELETED>    ``(D) Prohibition.--The Program Office may 
                not provide administrative support to the Council for 
                any activities of the Council carried out pursuant to a 
                provision of law other than a provision of law under 
                this subchapter.</DELETED>
                <DELETED>    ``(E) Funding and resources.--The Program 
                Office may use the staff and resources of the Office of 
                the National Cyber Director or maintain dedicated staff 
                and resources, as appropriate, in the performance of 
                the duties of the Office.</DELETED>
                <DELETED>    ``(F) Shared staffing authority.--
                </DELETED>
                        <DELETED>    ``(i) In general.--The Program 
                        Office may accept officers or employees of the 
                        United States or members of the Armed Forces on 
                        a detail from an element of the intelligence 
                        community (as such term is defined in section 3 
                        of the National Security Act of 1947 (50 U.S.C. 
                        3003)) or from another element of the Federal 
                        Government on a nonreimbursable basis, as 
                        jointly agreed to by the heads of the receiving 
                        and detailing elements, for a period not to 
                        exceed three years.</DELETED>
                        <DELETED>    ``(ii) Rule of construction.--
                        Nothing in this subparagraph may be construed 
                        as imposing any limitation on any other 
                        authority for reimbursable or nonreimbursable 
                        details.</DELETED>
                        <DELETED>    ``(iii) Nonreimbursable detail.--A 
                        nonreimbursable detail made under this 
                        subparagraph shall not be considered an 
                        augmentation of the appropriations of the 
                        receiving element of the Program Office or the 
                        Office of the National Cyber 
                        Director.</DELETED>
                <DELETED>    ``(G) Sunset.--The Program Office shall 
                terminate on the date described under section 
                1328.'';</DELETED>
        <DELETED>    (3) in subsection (c)--</DELETED>
                <DELETED>    (A) in paragraph (1)--</DELETED>
                        <DELETED>    (i) in the matter preceding 
                        subparagraph (A), by striking ``supply chain 
                        risk'' and inserting ``acquisition security and 
                        supply chain risk associated with the 
                        acquisition of covered articles'';</DELETED>
                        <DELETED>    (ii) in subparagraph (A), by 
                        inserting ``recommended'' before ``exclusion 
                        orders'';</DELETED>
                        <DELETED>    (iii) in subparagraph (B), by 
                        inserting ``recommended'' before ``removal 
                        orders'';</DELETED>
                        <DELETED>    (iv) in subparagraph (C), by 
                        striking ``; and'' and inserting a 
                        semicolon;</DELETED>
                        <DELETED>    (v) in subparagraph (D), by 
                        striking the period at the end and inserting 
                        ``; and''; and</DELETED>
                        <DELETED>    (vi) by adding at the end the 
                        following new subparagraph:</DELETED>
                <DELETED>    ``(E) issuing designated 
                orders.'';</DELETED>
                <DELETED>    (B) in paragraph (2)--</DELETED>
                        <DELETED>    (i) in the heading, by striking 
                        ``Recommendations'' and inserting ``Recommended 
                        orders'';</DELETED>
                        <DELETED>    (ii) by striking ``use'' and 
                        inserting ``, using'';</DELETED>
                        <DELETED>    (iii) by striking ``subsection 
                        (a)(3)'' and inserting ``subsection 
                        (a)(4)'';</DELETED>
                        <DELETED>    (iv) by striking 
                        ``recommendations'' and inserting ``recommend 
                        orders'';</DELETED>
                        <DELETED>    (v) by inserting ``to the 
                        officials described under clause (iii) of 
                        paragraph (6)(A) for issuance under such 
                        paragraph'' after ``thereof,'';</DELETED>
                        <DELETED>    (vi) by striking ``Such 
                        recommendations'' and inserting ``Any such 
                        order recommended'';</DELETED>
                        <DELETED>    (vii) in subparagraph (D), by 
                        striking ``supply chain risk'' and inserting 
                        ``acquisition security and supply chain risk 
                        associated with the acquisition of covered 
                        articles''; and</DELETED>
                        <DELETED>    (viii) in subparagraph (E), by 
                        striking ``exclusion or removal'';</DELETED>
                <DELETED>    (C) by redesignating paragraphs (3) 
                through (7) as paragraphs (4) through (8);</DELETED>
                <DELETED>    (D) by inserting after paragraph (2) the 
                following new paragraph:</DELETED>
        <DELETED>    ``(3) Designated orders.--</DELETED>
                <DELETED>    ``(A) Exclusion or removal of covered 
                sources of concern.--</DELETED>
                        <DELETED>    ``(i) In general.--Not later than 
                        270 days after a source of concern is 
                        designated as a covered source of concern 
                        pursuant to paragraph (2), the Council--
                        </DELETED>
                                <DELETED>    ``(I) shall provide to the 
                                officials described under clause (iii) 
                                of paragraph (6)(B) for issuance under 
                                such paragraph orders requiring--
                                </DELETED>
                                        <DELETED>    ``(aa) the 
                                        exclusion of the covered source 
                                        of concern from any executive 
                                        agency procurement action, 
                                        including source selection and 
                                        consent for a contractor; 
                                        or</DELETED>
                                        <DELETED>    ``(bb) the removal 
                                        of covered articles produced or 
                                        provided by the covered source 
                                        of concern from the information 
                                        system of executive agencies; 
                                        or</DELETED>
                                <DELETED>    ``(II) report to Congress 
                                why the Council has determined to not 
                                issue an order described under 
                                subclause (I) with respect to the 
                                covered source of concern or covered 
                                articles produced or provided by the 
                                covered source of concern.</DELETED>
                        <DELETED>    ``(ii) Contents of order.--Any 
                        order provided under clause (i) shall include--
                        </DELETED>
                                <DELETED>    ``(I) information 
                                regarding the scope and applicability 
                                of the order, including any information 
                                necessary to positively identify the 
                                covered source of concern or covered 
                                articles produced or provided by the 
                                covered source of concern required to 
                                be excluded or removed under the 
                                order;</DELETED>
                                <DELETED>    ``(II) a summary of any 
                                risk assessment reviewed or conducted 
                                in support of the order;</DELETED>
                                <DELETED>    ``(III) a summary of the 
                                basis for the order, including a 
                                discussion of less intrusive measures 
                                that were considered and why such 
                                measures were not reasonably available 
                                to reduce security risk;</DELETED>
                                <DELETED>    ``(IV) a description of 
                                the actions necessary to implement the 
                                order; and</DELETED>
                                <DELETED>    ``(V) where practicable, 
                                in the Council's sole and unreviewable 
                                discretion, a description of mitigation 
                                steps that could be taken by the 
                                covered source of concern that may 
                                result in the Council rescinding the 
                                order.</DELETED>
                <DELETED>    ``(B) Exclusion or removal of second order 
                sources or covered articles.--</DELETED>
                        <DELETED>    ``(i) Issuance.--In the case that 
                        the Council provides an order under 
                        subparagraph (A), the Council may also provide 
                        an order to the officials described under 
                        paragraph (6)(A)(iii) requiring the exclusion 
                        of sources or covered articles from executive 
                        agency procurement actions or removal of 
                        covered articles from executive agency 
                        information systems if--</DELETED>
                                <DELETED>    ``(I) such covered 
                                articles or such sources use a covered 
                                source of concern in the performance of 
                                a contract with the executive agency; 
                                or</DELETED>
                                <DELETED>    ``(II) such sources enter 
                                into a contract, the performance of 
                                which such source knows or has reason 
                                to believe will require, in the 
                                performance of a contract with the 
                                executive agency, the use of a covered 
                                source of concern or the use of a 
                                covered article produced or provided by 
                                a covered source of concern.</DELETED>
                        <DELETED>    ``(ii) Effective date 
                        considerations.--Any effective date prescribed 
                        by the Council for an order issued pursuant to 
                        clause (i) shall take into account--</DELETED>
                                <DELETED>    ``(I) the risk posed by 
                                the covered source of concern or the 
                                covered article produced or provided by 
                                the covered source of concern to the 
                                national security of the United 
                                States;</DELETED>
                                <DELETED>    ``(II) the likelihood of 
                                the covered source of concern or the 
                                covered article produced or provided by 
                                the covered source of concern causing 
                                imminent threat to public health and 
                                safety;</DELETED>
                                <DELETED>    ``(III) the availability 
                                of an alternative source or covered 
                                article produced or provided by an 
                                alternative source; and</DELETED>
                                <DELETED>    ``(IV) an assessment of 
                                the potential direct or quantifiable 
                                costs that may be incurred by the 
                                Federal Government, a State, local, or 
                                Tribal government, or by the private 
                                sector, as a result of compliance by 
                                the head of an executive agency with 
                                such an exclusion or removal order, as 
                                necessary.'';</DELETED>
                <DELETED>    (E) in paragraph (4), as so redesignated--
                </DELETED>
                        <DELETED>    (i) in the paragraph heading, by 
                        striking ``of recommendation and review'' and 
                        inserting ``and review of recommended and 
                        designated orders'';</DELETED>
                        <DELETED>    (ii) by striking `` the 
                        recommendation'' each place it appears, and 
                        inserting `` the order'';</DELETED>
                        <DELETED>    (iii) in the matter preceding 
                        subparagraph (A), by striking ``A notice of the 
                        Council's recommendation under paragraph (2)'' 
                        and inserting ``Before the Council recommends 
                        an order under paragraph (2) or issues an order 
                        under paragraph (3), a notice'';</DELETED>
                        <DELETED>    (iv) in subparagraph (A), by 
                        striking ``a recommendation has been made'' and 
                        inserting ``the order will be recommended or 
                        issued'';</DELETED>
                        <DELETED>    (v) in subparagraph (D), by 
                        striking ``paragraph (5); and'' and inserting 
                        ``paragraph (6);'';</DELETED>
                        <DELETED>    (vi) in subparagraph (E), by 
                        striking the period at the end and inserting 
                        ``; and''; and</DELETED>
                        <DELETED>    (vii) by adding at the end the 
                        following new subparagraph:</DELETED>
                <DELETED>    ``(F) Until an order is issued pursuant to 
                paragraph (6), information collected under this 
                paragraph shall be exempt from public disclosure and 
                shall be treated as information described in section 
                552(b)(3) of title 5, United States Code (commonly 
                referred to as the `Freedom of Information 
                Act').'';</DELETED>
                <DELETED>    (F) in paragraph (5), as so redesignated--
                </DELETED>
                        <DELETED>    (i) by striking ``paragraph (3)'' 
                        and inserting ``paragraph (4)'';</DELETED>
                        <DELETED>    (ii) in subparagraph (A), by 
                        striking ``paragraph (5)'' and inserting 
                        ``paragraph (6)''; and</DELETED>
                        <DELETED>    (iii) in subparagraph (B), by 
                        striking ``paragraph (6)'' and inserting 
                        ``paragraph (7)'';</DELETED>
                <DELETED>    (G) in paragraph (6), as so redesignated--
                </DELETED>
                        <DELETED>    (i) by amending subparagraph (A) 
                        to read as follows:</DELETED>
                <DELETED>    ``(A) Issuance of recommended orders.--
                </DELETED>
                        <DELETED>    ``(i) Modifications to order.--
                        After considering any response properly 
                        submitted by a source under paragraph (4) 
                        related to an order to be recommended under 
                        paragraph (2), the Council shall--</DELETED>
                                <DELETED>    ``(I) make such 
                                modifications to the order as the 
                                Council considers appropriate; 
                                and</DELETED>
                                <DELETED>    ``(II) provide the order 
                                (together with any information 
                                submitted by a source under paragraph 
                                (4) related to such order) to the 
                                officials described under clause 
                                (iii).</DELETED>
                        <DELETED>    ``(ii) Order.--Not later than 90 
                        days after receiving a recommended order, the 
                        officials described under clause (iii) shall--
                        </DELETED>
                                <DELETED>    ``(I) issue the order to 
                                the heads of the applicable agencies; 
                                or</DELETED>
                                <DELETED>    ``(II) submit a 
                                notification to the Council that the 
                                order will not be issued, that includes 
                                in the notification to the Council, all 
                                the reasons for why the order will not 
                                be issued.</DELETED>
                        <DELETED>    ``(iii) Officials.--The officials 
                        described in this clause are as 
                        follows:</DELETED>
                                <DELETED>    ``(I) The Secretary of 
                                Homeland Security, for exclusion and 
                                removal orders applicable to civilian 
                                agencies, to the extent not covered by 
                                subclause (II) or (III).</DELETED>
                                <DELETED>    ``(II) The Secretary of 
                                Defense, for exclusion and removal 
                                orders applicable to the Department of 
                                Defense and national security systems 
                                other than sensitive compartmented 
                                information systems.</DELETED>
                                <DELETED>    ``(III) The Director of 
                                National Intelligence, for exclusion 
                                and removal orders applicable to the 
                                intelligence community and sensitive 
                                compartmented information systems, to 
                                the extent not covered by subclause 
                                (II).'';</DELETED>
                        <DELETED>    (ii) by redesignating 
                        subparagraphs (B) through (E) as subparagraphs 
                        (C) through (F), respectively;</DELETED>
                        <DELETED>    (iii) by inserting after 
                        subparagraph (A) the following new 
                        subparagraph:</DELETED>
                <DELETED>    ``(B) Issuance of designated order.--
                </DELETED>
                        <DELETED>    ``(i) Modifications.--After 
                        considering any response properly submitted by 
                        a source under paragraph (4) related to a 
                        designated order, the Council shall--</DELETED>
                                <DELETED>    ``(I)(aa) make any such 
                                modifications to the order as the 
                                Council considers appropriate; 
                                or</DELETED>
                                <DELETED>    ``(bb) if the Council 
                                determines that the issuance of a 
                                designated order is not warranted, 
                                rescind the designated order and notify 
                                the source of the rescission; 
                                and</DELETED>
                                <DELETED>    ``(II) except in the case 
                                that the Council rescinds the 
                                designated order under subclause 
                                (I)(bb), provide the designated order 
                                (including any modifications made to 
                                such order by the Council) to the 
                                officials described in clause 
                                (iii).</DELETED>
                        <DELETED>    ``(ii) Issuance.--The officials 
                        described in clause (iii) shall, not later than 
                        90 days after receiving a designated order, 
                        issue the order to the heads of the applicable 
                        agencies.</DELETED>
                        <DELETED>    ``(iii) Officials.--The officials 
                        described in this clause are as 
                        follows:</DELETED>
                                <DELETED>    ``(I) The Secretary of 
                                Homeland Security, for exclusion and 
                                removal orders applicable to civilian 
                                agencies, to the extent not covered by 
                                subclause (II) or (III).</DELETED>
                                <DELETED>    ``(II) The Secretary of 
                                Defense, for exclusion and removal 
                                orders applicable to the Department of 
                                Defense and national security systems 
                                other than sensitive compartmented 
                                information systems.</DELETED>
                                <DELETED>    ``(III) The Director of 
                                National Intelligence, for exclusion 
                                and removal orders applicable to the 
                                intelligence community and sensitive 
                                compartmented information systems, to 
                                the extent not covered by subclause 
                                (II).</DELETED>
                        <DELETED>    ``(iv) Waiver.--An official 
                        described under clause (iii) may waive for a 
                        period of not more than 365 days the 
                        application of an order issued by such official 
                        under clause (ii) with respect to a covered 
                        source of concern or a covered article produced 
                        or provided by a covered source of concern if 
                        the official submits, not later than 30 days 
                        after making such waiver, a written 
                        notification to the Council, the appropriate 
                        congressional committees, and leadership that 
                        contains the justification for such waiver, 
                        which may include a classified annex.</DELETED>
                        <DELETED>    ``(v) Renewal of waiver.--An 
                        official described under clause (iii) may renew 
                        a waiver under clause (iv) for an additional 
                        period of not more than 365 days if--</DELETED>
                                <DELETED>    ``(I) the renewal of the 
                                waiver is in the national security 
                                interests of the United States; 
                                and</DELETED>
                                <DELETED>    ``(II) the official 
                                submits, not later than 30 days after 
                                renewing such waiver, a written 
                                notification to the Council, the 
                                appropriate congressional committees, 
                                and leadership that includes the 
                                justification for renewing the 
                                wavier.</DELETED>
                        <DELETED>    ``(vi) National security waiver.--
                        An official described under clause (iii) may 
                        waive the application of an order issued by 
                        such official under clause (ii) with respect to 
                        a covered source of concern or a covered 
                        article produced or provided by a covered 
                        source of concern for any activity subject to 
                        the reporting requirements under title V of the 
                        National Security Act of 1947 (50 U.S.C. 3091 
                        et seq.) or any authorized intelligence 
                        activities of the United States.</DELETED>
                        <DELETED>    ``(vii) Rescission of order.--An 
                        exclusion or removal order issued under this 
                        subparagraph by an official may be rescinded 
                        only by the Council.'';</DELETED>
                        <DELETED>    (iv) in subparagraph (C), as so 
                        redesignated--</DELETED>
                                <DELETED>    (I) by striking 
                                ``subparagraph (A)'' and inserting 
                                ``subparagraph (A)(iii) or 
                                (B)(iii)'';</DELETED>
                                <DELETED>    (II) by striking ``this 
                                subparagraph'' and inserting 
                                ``subparagraph (A)(iii) or (B)(iii)''; 
                                and</DELETED>
                                <DELETED>    (III) by striking ``, 
                                except'' and all that follows through 
                                ``Deputy Commander'';</DELETED>
                        <DELETED>    (v) in subparagraph (D), as so 
                        redesignated--</DELETED>
                                <DELETED>    (I) by striking ``this 
                                paragraph'' and inserting 
                                ``subparagraph (A)(iii) or (B)(iii)''; 
                                and</DELETED>
                                <DELETED>    (II) by striking 
                                ``help'';</DELETED>
                        <DELETED>    (vi) in subparagraph (E), as so 
                        redesignated, by striking ``this paragraph'' 
                        and inserting ``subparagraph (A)''; 
                        and</DELETED>
                        <DELETED>    (vii) by adding after subparagraph 
                        (F), as so redesignated, the following new 
                        subparagraph:</DELETED>
                <DELETED>    ``(G) Effective date of orders.--The 
                effective date of an order issued under this paragraph 
                may not be more than one year after the order is 
                issued.'';</DELETED>
                <DELETED>    (H) in paragraph (7), as so redesignated, 
                by striking ``paragraph (5)(A)'' and inserting 
                ``subparagraph (A) or (B) of paragraph (6)''; 
                and</DELETED>
                <DELETED>    (I) in paragraph (8), as so redesignated, 
                by striking ``paragraph (5)'' and inserting ``paragraph 
                (6)'';</DELETED>
        <DELETED>    (4) in subsection (e), by inserting ``the Chief 
        Data Officers Council,'' before ``the Chief Acquisition''; 
        and</DELETED>
        <DELETED>    (5) in subsection (f)(2), by striking the period 
        at the end and inserting ``unless such source is specifically 
        designated by statute as a covered source of concern for the 
        purposes of this subchapter.''.</DELETED>
<DELETED>    (d) Strategic Plan.--Section 1324(a) of title 41, United 
States Code, is amended--</DELETED>
        <DELETED>    (1) by inserting ``, and periodically thereafter'' 
        after ``2018'';</DELETED>
        <DELETED>    (2) in the matter preceding paragraph (1), by 
        inserting ``acquisition security and'' before ``supply chain 
        risks'';</DELETED>
        <DELETED>    (3) in paragraph (8), by inserting ``acquisition 
        security and'' before ``supply chain risks''; and</DELETED>
        <DELETED>    (4) in paragraph (9)(A), by inserting 
        ``acquisition security and'' before ``supply chain 
        risk''.</DELETED>
<DELETED>    (e) Requirements for Executive Agencies.--Section 1326 of 
title 41, United States Code, is amended--</DELETED>
        <DELETED>    (1) by striking ``supply chain'' each place such 
        term appears and inserting ``security and supply 
        chain'';</DELETED>
        <DELETED>    (2) in subsection (a)--</DELETED>
                <DELETED>    (A) in paragraph (1), by striking ``; 
                and'' and inserting a semicolon;</DELETED>
                <DELETED>    (B) in paragraph (2), by striking the 
                period at the end and inserting ``; and''; 
                and</DELETED>
                <DELETED>    (C) by adding at the end the 
                following:</DELETED>
        <DELETED>    ``(3) providing any information requested by the 
        Chairperson of the Council for the purpose of carrying out 
        activities of this subchapter, subject to applicable law or 
        policy on control and handling of classified, sensitive, or 
        proprietary information.''; and</DELETED>
        <DELETED>    (3) in subsection (b)(6), by striking ``may pose'' 
        and all that follows through ``risk'' and inserting ``may pose 
        a security or supply chain risk''.</DELETED>
<DELETED>    (f) Judicial Procedure.--Section 1327(b) of title 41, 
United States Code, is amended--</DELETED>
        <DELETED>    (1) in paragraph (1), by striking ``section 
        1323(c)(6)'' and inserting ``section 1323(c)(7)'';</DELETED>
        <DELETED>    (2) in paragraph (3), by striking ``sections 
        1323(c)(5)'' and inserting ``sections 1323(c)(6)''; 
        and</DELETED>
        <DELETED>    (3) in paragraph (4), by amending subparagraph 
        (B)(i) to read as follows:</DELETED>
                        <DELETED>    ``(i) Filing of record.--The 
                        United States shall file with the court an 
                        administrative record, which shall consist of--
                        </DELETED>
                                <DELETED>    ``(I) the information the 
                                Council relied upon in issuing a 
                                designated order under section 
                                1323(c)(6); and</DELETED>
                                <DELETED>    ``(II) the information 
                                that the appropriate official relied 
                                upon in issuing an exclusion or removal 
                                order under section 1323(c)(6) or a 
                                covered procurement action under 
                                section 4713.''.</DELETED>
<DELETED>    (g) Additional Provisions.--Subchapter III of chapter 13 
of title 41, United States Code, is amended by adding at the end the 
following new section:</DELETED>
<DELETED>``Sec. 1329. Additional provisions</DELETED>
<DELETED>    ``(a) Compliance With Existing Prohibitions.--In 
implementing this subchapter, the Council shall coordinate, as 
applicable and practicable, with the head of an agency to assist with 
compliance by the agency with--</DELETED>
        <DELETED>    ``(1) section 889 of the John S. McCain National 
        Defense Authorization Act of 2019 (Public Law 115-232; 41 
        U.S.C. 3901 note);</DELETED>
        <DELETED>    ``(2) section 5949 of the James M. Inhofe National 
        Defense Authorization Act of 2023 (Public Law 117-263; 41 
        U.S.C. 4713 note); and</DELETED>
        <DELETED>    ``(3) sections 1821 through 1833 of the American 
        Security Drone Act of 2023 (Public Law 118-31).</DELETED>
<DELETED>    ``(b) Update to Regulations.--Not later than two years 
after the date of the enactment of this section, the Federal 
Acquisition Security Council shall update any regulations the Council 
determines necessary.''.</DELETED>
<DELETED>    (h) Technical and Conforming Changes.--Subchapter III of 
chapter 13 of title 41, United States Code, is amended--</DELETED>
        <DELETED>    (1) in the table of sections for the subchapter by 
        adding after the item related to section 1328 the 
        following:</DELETED>

<DELETED>``1329. Additional provisions.'';
        <DELETED>    (2) in section 1321(1)(B), by striking 
        ``Government Reform'' and inserting ``Accountability''; 
        and</DELETED>
        <DELETED>    (3) by striking ``of this title'' each place the 
        term appears.</DELETED>

<DELETED>SEC. 3. REALLOCATING EXISTING RESOURCES.</DELETED>

<DELETED>    Section 5949(l) of the James M. Inhofe National Defense 
Authorization Act for Fiscal Year 2023 (Public Law 117-263) is 
amended--</DELETED>
        <DELETED>    (1) in paragraph (1), by striking ``Office of 
        Management and Budget'' and inserting ``Office of the National 
        Cyber Director''; and</DELETED>
        <DELETED>    (2) in paragraph (2), by striking ``Office of 
        Management and Budget'' and inserting ``Office of the National 
        Cyber Director''.</DELETED>

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Federal Acquisition Security Council 
Improvement Act of 2024''.

SEC. 2. CHANGES WITH RESPECT TO THE FEDERAL ACQUISITION SECURITY 
              COUNCIL.

    (a) Definition of Source of Concern, Covered Source of Concern, 
Recommended Order, and Designated Order.--Section 1321 of title 41, 
United States Code, is amended--
            (1) by redesignating paragraphs (5) through (8) as 
        paragraphs (7) through (10);
            (2) by inserting after paragraph (4) the following:
            ``(5) Covered source of concern.--The term `covered source 
        of concern' means a source of concern that is specifically 
        designated as a `covered source of concern' by a statute that 
        states that such designation is for the purposes of this 
        subchapter.
            ``(6) Designated order.--The term `designated order' means 
        an order described under section 1323(c)(3).''; and
            (3) by adding at the end the following:
            ``(11) Recommended order.--The term `recommended order' 
        means an order recommended under section 1323(c)(2).
            ``(12) Source of concern.--
                    ``(A) In general.--The term `source of concern' 
                means a source--
                            ``(i) subject to the jurisdiction, 
                        direction, or control of the government of a 
                        foreign adversary, or operates on behalf of the 
                        government of a foreign adversary; or
                            ``(ii) that poses a risk to the national 
                        security of the United States based on 
                        collaboration with, whole or partial ownership 
                        or control by, or being affiliated with a 
                        military, internal security force, or 
                        intelligence agency of a foreign adversary.
                    ``(B) Foreign adversary defined.--In this 
                paragraph, the term `foreign adversary' has the meaning 
                given the term `covered nation' in section 4872(d) of 
                title 10.''.
    (b) Establishment and Members of Council.--Section 1322 of title 
41, United States Code, is amended--
            (1) in subsection (a), by striking ``executive branch'' and 
        inserting ``Executive Office of the President'';
            (2) in subsection (b)--
                    (A) by amending paragraph (1) to read as follows:
            ``(1) In general.--The members of the Council shall be as 
        follows:
                    ``(A) The Administrator for Federal Procurement 
                Policy.
                    ``(B) The Deputy Director for Management of the 
                Office of Management and Budget.
                    ``(C) The following officials, each of whom shall 
                occupy a position at the level of Assistant Secretary 
                or Deputy Assistant Secretary (or equivalent):
                            ``(i) Two officials from the Office of the 
                        Director of National Intelligence, one of which 
                        shall be from the National Counterintelligence 
                        and Security Center.
                            ``(ii) Two officials from the Department of 
                        Defense, one of which shall be one from the 
                        National Security Agency.
                            ``(iii) Two officials from the Department 
                        of Homeland Security, one of which shall be one 
                        from the Cybersecurity and Infrastructure 
                        Security Agency.
                            ``(iv) An official from the General 
                        Services Administration.
                            ``(v) An official from the Office of the 
                        National Cyber Director.
                            ``(vi) Two officials from the Department of 
                        Justice, one of which shall be one from the 
                        Federal Bureau of Investigation.
                            ``(vii) Two officials from the Department 
                        of Commerce, one of which shall be from the 
                        National Institute of Standards and Technology 
                        and one of which shall be from the Bureau of 
                        Industry and Security.
                            ``(viii) An official from any executive 
                        agency not listed under clauses (i) through 
                        (vii) whose temporary or permanent 
                        participation is determined by the Chairperson 
                        of the Council to be necessary to carry out the 
                        functions of the Council while maintaining the 
                        intended balance in subject matter 
                        expertise.''; and
                    (B) in paragraph (2)--
                            (i) in the heading, by striking ``Lead 
                        representatives'' and inserting ``Members'';
                            (ii) by amending subparagraph (A)(i) to 
                        read as follows:
                            ``(i) In general.--The head of each 
                        executive agency listed under paragraph (1)(C) 
                        shall designate the official or officials from 
                        that agency who shall serve on the Council in 
                        accordance with such paragraph.'';
                            (iii) by amending subparagraph (A)(ii) to 
                        read as follows:
                            ``(ii) Requirements.--To the extent 
                        feasible, any official designated under clause 
                        (i) shall have expertise in supply chain risk 
                        management, acquisitions, law, or information 
                        and communications technology.'';
                            (iv) by amending subparagraph (B) to read 
                        as follows:
                    ``(B) Functions.--A member of the Council shall--
                            ``(i) regularly participate in the 
                        activities of the Council;
                            ``(ii) ensure that any information 
                        requested by the Council from the agency 
                        represented by the member is provided to the 
                        Council; and
                            ``(iii) ensure that the head of the agency 
                        represented by the member and other appropriate 
                        personnel of the agency are aware of the 
                        activities of the Council.'';
            (3) in subsection (c)--
                    (A) by amending paragraph (1) to read as follows:
            ``(1) In general.--The Chairperson of the Council shall 
        be--
                    ``(A) the National Cyber Director; or
                    ``(B) another member of the Council designated by 
                the National Cyber Director.''; and
                    (B) in paragraph (2)--
                            (i) in subparagraph (B), by striking 
                        ``(b)(1)(H)'' and inserting 
                        ``(b)(1)(C)(viii)''; and
                            (ii) in subparagraph (C), by striking 
                        ``lead representative of each agency 
                        represented on the Council'' and inserting 
                        ``members of the Council''; and
            (4) in subsection (d)--
                    (A) by striking ``The Council'' and inserting the 
                following:
            ``(1) Council meetings.--The Council''; and
                    (B) by adding at the end the following:
            ``(2) Other meetings.--The Chairperson of the Council shall 
        meet, not less frequently than semiannually, with--
                    ``(A) the Secretary of Homeland Security, Secretary 
                of Defense, and Director of National Intelligence; or
                    ``(B) in the case that any of the officials under 
                subparagraph (A) delegated authority to an official 
                under section 1323(c)(6)(C), with the delegated 
                official.''.
    (c) Functions and Authorities.--Section 1323 of title 41, United 
States Code is amended--
            (1) in subsection (a)--
                    (A) by striking ``supply chain'' each place it 
                appears and inserting ``acquisition security and supply 
                chain'';
                    (B) in paragraph (1), as amended by subparagraph 
                (A), by striking ``, particularly'' and inserting 
                ``that arise'';
                    (C) in paragraph (2), as amended by subparagraph 
                (A), by inserting ``associated with the acquisition and 
                use of covered articles'' after ``risk'';
                    (D) in paragraph (6), as amended by subparagraph 
                (A)--
                            (i) by striking ``posed by'' and inserting 
                        ``associated with''; and
                            (ii) by inserting ``and use'' before ``of 
                        covered articles'';
                    (E) in paragraph (7), by striking ``posed by 
                acquisitions'' and inserting ``associated with the 
                acquisition'';
                    (F) by redesignating paragraph (7) as paragraph 
                (12); and
                    (G) by inserting after paragraph (6) the following:
            ``(7) Implementing a prioritization scheme for evaluating 
        the security risks associated with the acquisition and use of 
        covered articles provided or produced by a covered source of 
        concern.
            ``(8) Evaluating each covered source of concern to 
        determine whether to issue a designated order with respect to 
        the covered source of concern or a covered article produced or 
        provided by the covered source of concern.
            ``(9) Evaluating sources of concern to determine whether to 
        issue a recommended order with respect to the source of 
        concern, or any covered article produced or provided by the 
        source of concern.
            ``(10) Monitoring and evaluating compliance by the 
        Secretary of Homeland Security, Secretary of Defense, and 
        Director of National Intelligence with the requirement to issue 
        designated orders under subsection (c)(6)(B).
            ``(11) Reporting to Congress annually on the security risks 
        associated with the acquisition and use of covered articles 
        produced or provided by sources of concern.'';
            (2) in subsection (b)--
                    (A) by striking ``The Council'' and inserting the 
                following:
            ``(1) In general.--The Council''; and
                    (B) in paragraph (1), as so redesignated, by 
                striking ``a program office and''; and
                    (C) by adding at the end the following:
            ``(2) Federal acquisition security council program 
        office.--
                    ``(A) Establishment.--The Council shall establish a 
                Federal Acquisition Security Council Program Office 
                (referred to in this paragraph as the `Program Office') 
                within the Office of the National Cyber Director to 
                carry out the functions of the Council duties described 
                under subparagraph (B).
                    ``(B) Duties.--The Program Office shall provide to 
                the Council, including any committees, working groups, 
                or other constituent bodies established by the Council 
                under paragraph (1)--
                            ``(i) administrative, legal, and policy 
                        support; and
                            ``(ii) analysis and subject matter 
                        expertise on information communications 
                        technology, acquisition security, and supply 
                        chain risk.
                    ``(C) Structure.--The head of the Program Office 
                shall be a senior official from the Office of the 
                National Cyber Director that occupies a position at the 
                level of Assistant Secretary or Deputy Assistant 
                Secretary (or equivalent).
                    ``(D) Prohibition.--The Program Office may not 
                provide administrative support to the Council for any 
                activities of the Council carried out pursuant to a 
                provision of law other than a provision of law under 
                this subchapter.
                    ``(E) Funding and resources.--The Program Office 
                may use the staff and resources of the Office of the 
                National Cyber Director or maintain dedicated staff and 
                resources, as appropriate, in the performance of the 
                duties of the Office.
                    ``(F) Shared staffing authority.--
                            ``(i) In general.--The Program Office may 
                        accept officers or employees of the United 
                        States or members of the Armed Forces on a 
                        detail from an element of the intelligence 
                        community (as such term is defined in section 3 
                        of the National Security Act of 1947 (50 U.S.C. 
                        3003)) or from another element of the Federal 
                        Government on a nonreimbursable basis, as 
                        jointly agreed to by the heads of the receiving 
                        and detailing elements, for a period not to 
                        exceed three years.
                            ``(ii) Rule of construction.--Nothing in 
                        this subparagraph may be construed as imposing 
                        any limitation on any other authority for 
                        reimbursable or nonreimbursable details.
                            ``(iii) Nonreimbursable detail.--A 
                        nonreimbursable detail made under this 
                        subparagraph shall not be considered an 
                        augmentation of the appropriations of the 
                        receiving element of the Program Office or the 
                        Office of the National Cyber Director.
                    ``(G) Sunset.--The Program Office shall terminate 
                on the date described under section 1328.'';
            (3) in subsection (c)--
                    (A) in paragraph (1)--
                            (i) in the matter preceding subparagraph 
                        (A), by striking ``supply chain risk'' and 
                        inserting ``acquisition security and supply 
                        chain risk associated with the acquisition of 
                        covered articles'';
                            (ii) in subparagraph (A), by inserting 
                        ``recommended'' before ``exclusion orders'';
                            (iii) in subparagraph (B), by inserting 
                        ``recommended'' before ``removal orders'';
                            (iv) in subparagraph (C), by striking ``; 
                        and'' and inserting a semicolon;
                            (v) in subparagraph (D), by striking the 
                        period at the end and inserting ``; and''; and
                            (vi) by adding at the end the following:
                    ``(E) issuing designated orders.'';
                    (B) in paragraph (2)--
                            (i) in the heading, by striking 
                        ``Recommendations'' and inserting ``Recommended 
                        orders'';
                            (ii) by striking ``use'' and inserting ``, 
                        using'';
                            (iii) by striking ``subsection (a)(3)'' and 
                        inserting ``subsection (a)(4)'';
                            (iv) by striking ``to issue 
                        recommendations'' and inserting ``, recommend 
                        orders'';
                            (v) by striking ``Such recommendations'' 
                        and inserting ``Any such order recommended'';
                            (vi) by inserting ``to the officials 
                        described under clause (iii) of paragraph 
                        (6)(A) for issuance under such paragraph'' 
                        after ``thereof,'';
                            (vii) in subparagraph (D), by striking 
                        ``supply chain risk'' and inserting 
                        ``acquisition security and supply chain risk 
                        associated with the acquisition of covered 
                        articles''; and
                            (viii) in subparagraph (E), by striking 
                        ``exclusion or removal'';
                    (C) by redesignating paragraphs (3) through (7) as 
                paragraphs (4) through (8);
                    (D) by inserting after paragraph (2) the following:
            ``(3) Designated orders.--
                    ``(A) Exclusion or removal of covered sources of 
                concern.--
                            ``(i) In general.--Not later than 270 days 
                        after a source of concern is designated as a 
                        covered source of concern, the Council--
                                    ``(I) shall provide to the 
                                officials described under clause (iii) 
                                of paragraph (6)(B) for issuance under 
                                such paragraph orders requiring--
                                            ``(aa) the exclusion of the 
                                        covered source of concern from 
                                        any executive agency 
                                        procurement action, including 
                                        source selection and consent 
                                        for a contractor; or
                                            ``(bb) the removal of 
                                        covered articles produced or 
                                        provided by the covered source 
                                        of concern from the information 
                                        system of executive agencies; 
                                        or
                                    ``(II) report to Congress why the 
                                Council has determined to not issue an 
                                order described under subclause (I) 
                                with respect to the covered source of 
                                concern or covered articles produced or 
                                provided by the covered source of 
                                concern.
                            ``(ii) Contents of order.--Any order 
                        provided under clause (i) shall include--
                                    ``(I) information regarding the 
                                scope and applicability of the order, 
                                including any information necessary to 
                                positively identify the covered source 
                                of concern or covered articles produced 
                                or provided by the covered source of 
                                concern required to be excluded or 
                                removed under the order;
                                    ``(II) a summary of any risk 
                                assessment reviewed or conducted in 
                                support of the order;
                                    ``(III) a summary of the basis for 
                                the order, including a discussion of 
                                less intrusive measures that were 
                                considered and why such measures were 
                                not reasonably available to reduce 
                                security risk;
                                    ``(IV) a description of the actions 
                                necessary to implement the order; and
                                    ``(V) where practicable, in the 
                                Council's sole and unreviewable 
                                discretion, a description of mitigation 
                                steps that could be taken by the 
                                covered source of concern that may 
                                result in the Council rescinding the 
                                order.
                    ``(B) Exclusion or removal of second order sources 
                or covered articles.--
                            ``(i) Issuance.--In the case that the 
                        Council provides an order under subparagraph 
                        (A), the Council may also provide an order to 
                        the officials described under paragraph 
                        (6)(A)(iii) requiring the exclusion of sources 
                        or covered articles from executive agency 
                        procurement actions or removal of covered 
                        articles from executive agency information 
                        systems if--
                                    ``(I) such covered articles or such 
                                sources use a covered source of concern 
                                in the performance of a contract with 
                                the executive agency; or
                                    ``(II) such sources enter into a 
                                contract, the performance of which such 
                                source knows or has reason to believe 
                                will require, in the performance of a 
                                contract with the executive agency, the 
                                use of a covered source of concern or 
                                the use of a covered article produced 
                                or provided by a covered source of 
                                concern.
                            ``(ii) Effective date considerations.--Any 
                        effective date prescribed by the Council for an 
                        order issued pursuant to clause (i) shall take 
                        into account--
                                    ``(I) the risk posed by the covered 
                                source of concern or the covered 
                                article produced or provided by the 
                                covered source of concern to the 
                                national security of the United States;
                                    ``(II) the likelihood of the 
                                covered source of concern or the 
                                covered article produced or provided by 
                                the covered source of concern causing 
                                imminent threat to public health and 
                                safety;
                                    ``(III) the availability of an 
                                alternative source or covered article 
                                produced or provided by an alternative 
                                source; and
                                    ``(IV) an assessment of the 
                                potential direct or quantifiable costs 
                                that may be incurred by the Federal 
                                Government, a State, local, or Tribal 
                                government, or by the private sector, 
                                as a result of compliance by the head 
                                of an executive agency with such an 
                                exclusion or removal order.'';
                    (E) in paragraph (4), as so redesignated--
                            (i) in the heading, by striking ``of 
                        recommendation and review'' and inserting ``and 
                        review of recommended and designated orders'';
                            (ii) by striking `` the recommendation'' 
                        each place the term appears, and inserting `` 
                        the order'';
                            (iii) in the matter preceding subparagraph 
                        (A), by striking ``A notice of the Council's 
                        recommendation under paragraph (2)'' and 
                        inserting ``Before the Council recommends an 
                        order under paragraph (2) or issues an order 
                        under paragraph (3), a notice'';
                            (iv) in subparagraph (A), by striking ``a 
                        recommendation has been made'' and inserting 
                        ``the order will be recommended or issued'';
                            (v) in subparagraph (D), by striking 
                        ``paragraph (5)'' and inserting ``paragraph 
                        (6)''; and
                            (vi) by inserting a new subparagraph to 
                        read as follows:
                    ``(F) Until an order is issued pursuant to 
                paragraph (6), information collected under this 
                paragraph shall be exempt from public disclosure and 
                shall be exempt from disclosure under section 
                552(b)(3)(B) of title 5, United States Code (commonly 
                referred to as the `Freedom of Information Act').'';
                    (F) in paragraph (5), as so redesignated--
                            (i) by striking ``paragraph (3)'' and 
                        inserting ``paragraph (4)'';
                            (ii) in subparagraph (A), by striking 
                        ``paragraph (5)'' and inserting ``paragraph 
                        (6)''; and
                            (iii) in subparagraph (B), by striking 
                        ``paragraph (6)'' and inserting ``paragraph 
                        (7)'';
                    (G) in paragraph (6), as so redesignated--
                            (i) by amending subparagraph (A) to read as 
                        follows:
                    ``(A) Issuance of recommended orders.--
                            ``(i) Modifications to order.--After 
                        considering any response properly submitted by 
                        a source under paragraph (4) related to an 
                        order to be recommended under paragraph (2), 
                        the Council shall--
                                    ``(I) make such modifications to 
                                the order as the Council considers 
                                appropriate; and
                                    ``(II) provide the order (together 
                                with any information submitted by a 
                                source under paragraph (4) related to 
                                such order) to the officials described 
                                under clause (iii).
                            ``(ii) Order.--Not later than 90 days after 
                        receiving a recommended order, the officials 
                        described under clause (iii) shall--
                                    ``(I) issue the order to the heads 
                                of the applicable agencies; or
                                    ``(II) submit a notification to the 
                                Council that the order will not be 
                                issued, that includes in the 
                                notification to the Council, all the 
                                reasons for why the order will not be 
                                issued.
                            ``(iii) Officials.--The officials described 
                        in this clause are as follows:
                                    ``(I) The Secretary of Homeland 
                                Security, for exclusion and removal 
                                orders applicable to civilian agencies, 
                                to the extent not covered by subclause 
                                (II) or (III).
                                    ``(II) The Secretary of Defense, 
                                for exclusion and removal orders 
                                applicable to the Department of Defense 
                                and national security systems other 
                                than sensitive compartmented 
                                information systems.
                                    ``(III) The Director of National 
                                Intelligence, for exclusion and removal 
                                orders applicable to the intelligence 
                                community and sensitive compartmented 
                                information systems, to the extent not 
                                covered by subclause (II).'';
                            (ii) by redesignating subparagraphs (B) 
                        through (E) as subparagraphs (C) through (F), 
                        respectively;
                            (iii) by inserting after subparagraph (A) 
                        the following:
                    ``(B) Issuance of designated order.--
                            ``(i) Modifications.--After considering any 
                        response properly submitted by a source under 
                        paragraph (4) related to a designated order, 
                        the Council shall--
                                    ``(I)(aa) make any such 
                                modifications to the order as the 
                                Council considers appropriate; or
                                            ``(bb) if the Council 
                                        determines that the issuance of 
                                        a designated order is not 
                                        warranted, rescind the 
                                        designated order and notify the 
                                        source of the rescission; and
                                    ``(II) except in the case that the 
                                Council rescinds the designated order 
                                under subclause (I)(bb), provide the 
                                designated order (including any 
                                modifications made to such order by the 
                                Council) to the officials described in 
                                clause (iii).
                            ``(ii) Issuance.--The officials described 
                        in clause (iii) shall, not later than 90 days 
                        after receiving a designated order, issue the 
                        order to the heads of the applicable agencies.
                            ``(iii) Officials.--The officials described 
                        in this clause are as follows:
                                    ``(I) The Secretary of Homeland 
                                Security, for exclusion and removal 
                                orders applicable to civilian agencies, 
                                to the extent not covered by subclause 
                                (II) or (III).
                                    ``(II) The Secretary of Defense, 
                                for exclusion and removal orders 
                                applicable to the Department of Defense 
                                and national security systems other 
                                than sensitive compartmented 
                                information systems.
                                    ``(III) The Director of National 
                                Intelligence, for exclusion and removal 
                                orders applicable to the intelligence 
                                community and sensitive compartmented 
                                information systems, to the extent not 
                                covered by subclause (II).
                            ``(iv) Waiver.--An official described under 
                        clause (iii) may waive for a period of not more 
                        than 365 days the application of an order 
                        issued by such official under clause (ii) with 
                        respect to a covered source of concern or a 
                        covered article produced or provided by a 
                        covered source of concern if the official 
                        submits, not later than 30 days after making 
                        such waiver, a written notification to the 
                        Council, appropriate congressional committees, 
                        and leadership that contains the justification 
                        for such waiver.
                            ``(v) Renewal of waiver.--An official 
                        described under clause (iii) may renew a waiver 
                        under clause (iv) for an additional period of 
                        not more than 180 days if--
                                    ``(I) the renewal of the waiver is 
                                in the national security interests of 
                                the United States; and
                                    ``(II) the official submits, not 
                                later than 30 days after renewing such 
                                waiver, a written notification to the 
                                Council, appropriate congressional 
                                committees, and leadership that 
                                includes the justification for renewing 
                                the wavier.
                            ``(vi) National security waiver.--An 
                        official described under clause (iii) may waive 
                        the application of an order issued by such 
                        official under clause (ii) with respect to a 
                        covered source of concern or a covered article 
                        produced or provided by a covered source of 
                        concern for any activity subject to the 
                        reporting requirements under title V of the 
                        National Security Act of 1947 (50 U.S.C. 3091 
                        et seq.) or any authorized intelligence 
                        activities of the United States.
                            ``(vii) Rescission of order.--An exclusion 
                        or removal order issued under this subparagraph 
                        by an official may be rescinded only by the 
                        Council.''.
                            (iv) in subparagraph (C), as so 
                        redesignated--
                                    (I) by striking ``subparagraph 
                                (A)'' and inserting ``subparagraph 
                                (A)(iii) or (B)(iii)'';
                                    (II) by striking ``this 
                                subparagraph'' and inserting 
                                ``subparagraph (A)(iii) or (B)(iii)''; 
                                and
                                    (III) by striking ``, except'' and 
                                all that follows before the period at 
                                the end;
                            (v) in subparagraph (D), as so 
                        redesignated--
                                    (I) by striking ``this paragraph'' 
                                and inserting ``subparagraph (A)(iii) 
                                or (B)(iii)''; and
                                    (II) by striking ``help'';
                            (vi) in subparagraph (E), as so 
                        redesignated, by striking ``this paragraph'' 
                        and inserting ``subparagraph (A)''; and
                            (vii) by adding after subparagraph (F), as 
                        so redesignated, the following:
                    ``(G) Effective date of orders.--The effective date 
                of an order issued under this paragraph may not be more 
                than 365 days after the order is issued.'';
                    (H) in paragraph (7), as so redesignated, by 
                striking ``paragraph (5)(A)'' and inserting 
                ``subparagraph (A) or (B) of paragraph (6)''; and
                    (I) in paragraph (8), as so redesignated, by 
                striking ``paragraph (5)'' and inserting ``paragraph 
                (6)'';
            (4) in subsection (e), by inserting ``the Chief Data 
        Officers Council,'' before ``the Chief Acquisition''; and
            (5) in subsection (f)(2), by striking the period at the end 
        and inserting ``unless such source is specifically designated 
        by statute as a covered source of concern for the purposes of 
        this subchapter.''.
    (d) Strategic Plan.--Section 1324(a) of title 41, United States 
Code, is amended--
            (1) by inserting ``, and periodically thereafter'' after 
        ``2018'';
            (2) in the matter preceding paragraph (1), by inserting 
        ``acquisition security and'' before ``supply chain risks'';
            (3) in paragraph (8), by inserting ``acquisition security 
        and'' before ``supply chain risks''; and
            (4) in paragraph (9)(A), by inserting ``acquisition 
        security and'' before ``supply chain risk''.
    (e) Requirements for Executive Agencies.--Section 1326 of title 41, 
United States Code, is amended--
            (1) in subsection (a)--
                    (A) in paragraph (1), by striking ``; and'' and 
                inserting a semicolon;
                    (B) in paragraph (2), by striking the period at the 
                end and inserting ``; and''; and
                    (C) by adding at the end the following:
            ``(3) providing any information requested by the 
        Chairperson of the Council for the purpose of carrying out 
        activities of this subchapter, subject to applicable law or 
        policy on the control and handling of classified, sensitive, or 
        proprietary information.'''';
            (2) by striking ``supply chain'' each place such term 
        appears and inserting ``security and supply chain''; and
            (3) in subsection (b)(6), by striking ``supply chain'' and 
        inserting ``security or supply chain''.
    (f) Judicial Procedure.--Section 1327(b) of title 41, United States 
Code, is amended--
            (1) in paragraph (1), by striking ``section 1323(c)(6)'' 
        and inserting ``section 1323(c)(7)'';
            (2) in paragraph (3), by striking ``section 1323(c)(5)'' 
        and inserting ``sections 1323(c)(6)''; and
            (3) in paragraph (4), by amending subparagraph (B)(i) to 
        read as follows:
                            ``(i) Filing of record.--The United States 
                        shall file with the court an administrative 
                        record, which shall consist of--
                                    ``(I) the information the Council 
                                relied upon in issuing a designated 
                                order under 1323(c)(6); and
                                    ``(II) the information that the 
                                appropriate official relied upon in 
                                issuing an exclusion or removal order 
                                under section 1323(c)(6) or a covered 
                                procurement action under section 
                                4713.''.
    (g) Additional Provisions.--Subchapter III of chapter 13 of title 
41, United States Code, is amended by adding at the end the following:
``Sec. 1329. Additional provisions
    ``(a) Compliance With Existing Prohibitions.--In implementing this 
subchapter, the Council shall coordinate, as applicable and 
practicable, with the head of an agency to assist with compliance by 
the agency with--
            ``(1) section 889 of the John S. McCain National Defense 
        Authorization Act of 2019 (Public Law 115-232; 41 U.S.C. 3901 
        note);
            ``(2) section 5949 of the James M. Inhofe National Defense 
        Authorization Act of 2023 (Public Law 117-263; 41 U.S.C. 4713 
        note); and
            ``(3) sections 1821 through 1833 of the American Security 
        Drone Act of 2023 (Public Law 118-31).
    ``(b) Update to Regulations.--The Federal Acquisition Security 
Council shall update, within two years after the date of the enactment 
of this section, any regulations of the Council as necessary.''.
    (h) Technical and Conforming Changes.--Subchapter III of chapter 13 
of title 41, United States Code, is amended--
            (1) in the table of sections for the subchapter by adding 
        after the item related to section 1328 the following:

``1329. Additional provisions.'';
            (2) in section 1321(1)(B), by striking ``Government 
        Reform'' and inserting ``Accountability''; and
            (3) by striking ``of this title'' each place the term 
        appears.

SEC. 3. REALLOCATING EXISTING RESOURCES.

    Section 5949(l) of the James M. Inhofe National Defense 
Authorization Act for Fiscal Year 2023 (Public Law 117-263) is 
amended--
            (1) in paragraph (1), by striking ``Office of Management 
        and Budget'' and inserting ``Office of the National Cyber 
        Director''; and
            (2) in paragraph (2), by striking ``Office of Management 
        and Budget'' and inserting ``Office of the National Cyber 
        Director''.
                                                       Calendar No. 702

118th CONGRESS

  2d Session

                                S. 5310

                          [Report No. 118-296]

_______________________________________________________________________

                                 A BILL

To amend title 41, United States Code, to make changes with respect to 
   the Federal Acquisition Security Council, and for other purposes.

_______________________________________________________________________

                           December 16, 2024

                       Reported with an amendment
```