```

[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 4651 Reported in Senate (RS)]

<DOC>

                                                       Calendar No. 737
118th CONGRESS
  2d Session
                                S. 4651

                          [Report No. 118-317]

 To require agencies to use information and communications technology 
 products obtained from original equipment manufacturers or authorized 
                   resellers, and for other purposes.

_______________________________________________________________________

                   IN THE SENATE OF THE UNITED STATES

                             July 10, 2024

  Mr. Cornyn (for himself, Mr. Peters, and Mr. Ossoff) introduced the 
 following bill; which was read twice and referred to the Committee on 
               Homeland Security and Governmental Affairs

            December 19 (legislative day, December 16), 2024

               Reported by Mr. Peters, with an amendment
 [Strike out all after the enacting clause and insert the part printed 
                               in italic]

_______________________________________________________________________

                                 A BILL

 
 To require agencies to use information and communications technology 
 products obtained from original equipment manufacturers or authorized 
                   resellers, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

<DELETED>SECTION 1. SHORT TITLE.</DELETED>

<DELETED>    This Act may be cited as the ``Securing America's Federal 
Equipment in Supply Chains Act'' or the ``SAFE Supply Chains 
Act''.</DELETED>

<DELETED>SEC. 2. AGENCY USE OF IT PRODUCTS.</DELETED>

<DELETED>    (a) Definitions.--In this section:</DELETED>
        <DELETED>    (1) Agency.--The term ``agency'' has the meaning 
        given the term in section 3502 of title 44, United States 
        Code.</DELETED>
        <DELETED>    (2) Appropriate congressional committees.--The 
        term ``appropriate congressional committees'' means the 
        Committee on Homeland Security and Governmental Affairs of the 
        Senate and the Committee on Oversight and Accountability of the 
        House of Representatives.</DELETED>
        <DELETED>    (3) Authorized reseller.--The term ``authorized 
        reseller'' means a reseller, after market manufacturer, 
        supplier, or distributor of a covered product with a direct or 
        prime contractual arrangement with, or the express written 
        authority of, the original equipment manufacturer of the 
        covered product to manufacture, buy, stock, repackage, sell, 
        resell, repair, service, otherwise support, or distribute the 
        covered product.</DELETED>
        <DELETED>    (4) Covered product.--The term ``covered 
        product''--</DELETED>
                <DELETED>    (A) means an information and 
                communications technology end-use hardware product or 
                component, including software and firmware that 
                comprise the end-use hardware product or component; 
                and</DELETED>
                <DELETED>    (B) does not include--</DELETED>
                        <DELETED>    (i) other software; or</DELETED>
                        <DELETED>    (ii) an end-use hardware product--
                        </DELETED>
                                <DELETED>    (I) in which there is 
                                embedded information and communications 
                                technology; and</DELETED>
                                <DELETED>    (II) the principal 
                                function of which is not the creation, 
                                manipulation, storage, display, 
                                receipt, or transmission of electronic 
                                data and information.</DELETED>
        <DELETED>    (5) End-use product.--The term ``end-use product'' 
        means a product ready for use by the maintainer, integrator, or 
        end user of the product.</DELETED>
        <DELETED>    (6) Information and communications technology.--
        The term ``information and communications technology''--
        </DELETED>
                <DELETED>    (A) has the meaning given the term in 
                section 4713 of title 41, United States Code; 
                and</DELETED>
                <DELETED>    (B) includes information and 
                communications technologies covered by definitions 
                contained in the Federal Acquisition Regulation, 
                including definitions added after the date of the 
                enactment of this Act by the Federal Acquisition 
                Regulatory Council pursuant to notice and 
                comment.</DELETED>
        <DELETED>    (7) Original equipment manufacturer.--The term 
        ``original equipment manufacturer'' means a company that 
        manufactures a covered product that the company--</DELETED>
                <DELETED>    (A) designed from self-sourced or 
                purchased components; and</DELETED>
                <DELETED>    (B) sells under the name of the 
                company.</DELETED>
<DELETED>    (b) Prohibition on Procurement and Use.--Subject to 
subsection (c) and notwithstanding sections 1905 through 1907 of title 
41, United States Code, the head of an agency may not procure or 
obtain, renew a contract to procure or obtain, or use a covered product 
that is procured from an entity other than--</DELETED>
        <DELETED>    (1) an original equipment manufacturer; 
        or</DELETED>
        <DELETED>    (2) an authorized reseller.</DELETED>
<DELETED>    (c) Waiver.--</DELETED>
        <DELETED>    (1) In general.--Upon written notice to the 
        Director of the Office of Management and Budget, the head of an 
        agency may waive the prohibition under subsection (b) with 
        respect to a covered product if the head of the agency 
        determines that--</DELETED>
                <DELETED>    (A) the waiver is necessary in the 
                interest of national security; or</DELETED>
                <DELETED>    (B) procuring, obtaining, or using the 
                covered product is necessary--</DELETED>
                        <DELETED>    (i) for the purpose of 
                        scientifically valid research (as defined in 
                        section 102 the Education Sciences Reform Act 
                        of 2002 (20 U.S.C. 9501)); or</DELETED>
                        <DELETED>    (ii) to avoid jeopardizing the 
                        performance of mission critical 
                        functions.</DELETED>
        <DELETED>    (2) Notice.--The notice described in paragraph 
        (1)--</DELETED>
                <DELETED>    (A) shall--</DELETED>
                        <DELETED>    (i) specify, with respect to the 
                        waiver under paragraph (1)--</DELETED>
                                <DELETED>    (I) the justification for 
                                the waiver;</DELETED>
                                <DELETED>    (II) any security 
                                mitigations that have been implemented; 
                                and</DELETED>
                                <DELETED>    (III) with respect to a 
                                waiver that necessitates a security 
                                mitigation, the plan of action and 
                                milestones to avoid future waivers for 
                                subsequent similar purchases; 
                                and</DELETED>
                        <DELETED>    (ii) be submitted in an 
                        unclassified form; and</DELETED>
                <DELETED>    (B) may include a classified 
                annex.</DELETED>
        <DELETED>    (3) Duration.--With respect to a waiver for the 
        purpose of research, as described in paragraph (1)(B)(i), the 
        waiver shall be effective for the duration of the research 
        identified in the waiver.</DELETED>
<DELETED>    (d) Reports to Congress.--</DELETED>
        <DELETED>    (1) In general.--Not later than 1 year after the 
        date of enactment of this Act, and annually thereafter until 
        the date that is 6 years after the date of enactment of this 
        Act, the Director of the Office of Management and Budget shall 
        submit to the appropriate congressional committees a report 
        that lists--</DELETED>
                <DELETED>    (A) the number and types of covered 
                products for which a waiver under subsection (c)(1) was 
                granted during the 1-year period preceding the date of 
                the submission of the report; and</DELETED>
                <DELETED>    (B) the legal authority under which each 
                waiver described in subparagraph (A) was granted, such 
                as whether the waiver was granted pursuant to 
                subparagraph (A) or (B) of subsection (c)(1).</DELETED>
        <DELETED>    (2) Classification of report.--Each report 
        submitted under this subsection--</DELETED>
                <DELETED>    (A) shall be submitted in unclassified 
                form; and</DELETED>
                <DELETED>    (B) may include a classified annex that 
                contains the information described in paragraph 
                (1)(B).</DELETED>
<DELETED>    (e) Effective Date.--This section shall take effect on the 
date that is 1 year after the date of enactment of this Act.</DELETED>

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Securing America's Federal Equipment 
Supply Chains Act'' or the ``SAFE Supply Chains Act''.

SEC. 2. AGENCY USE OF IT PRODUCTS.

    (a) Definitions.--In this section:
            (1) Agency.--The term ``agency'' has the meaning given the 
        term in section 3502 of title 44, United States Code.
            (2) Appropriate congressional committees.--The term 
        ``appropriate congressional committees'' means the Committee on 
        Homeland Security and Governmental Affairs of the Senate and 
        the Committee on Oversight and Accountability of the House of 
        Representatives.
            (3) Authorized reseller.--The term ``authorized reseller'' 
        means a reseller, after market manufacturer, supplier, or 
        distributor of a covered product with a direct or prime 
        contractual arrangement with, or the express written authority 
        of, the original equipment manufacturer of the covered product 
        to manufacture, buy, stock, repackage, sell, resell, repair, 
        service, otherwise support, or distribute the covered product.
            (4) Covered product.--The term ``covered product''--
                    (A) means an information and communications 
                technology end-use hardware product or component, 
                including software and firmware that comprise the end-
                use hardware product or component; and
                    (B) does not include--
                            (i) other software; or
                            (ii) an end-use hardware product--
                                    (I) in which there is embedded 
                                information and communications 
                                technology; and
                                    (II) the principal function of 
                                which is not the creation, 
                                manipulation, storage, display, 
                                receipt, or transmission of electronic 
                                data and information.
            (5) End-use product.--The term ``end-use product'' means a 
        product ready for use by the maintainer, integrator, or end 
        user of the product.
            (6) Information and communications technology.--The term 
        ``information and communications technology''--
                    (A) has the meaning given the term in section 4713 
                of title 41, United States Code; and
                    (B) includes information and communications 
                technologies covered by definitions contained in the 
                Federal Acquisition Regulation, including definitions 
                added after the date of the enactment of this Act by 
                the Federal Acquisition Regulatory Council pursuant to 
                notice and comment.
            (7) Original equipment manufacturer.--The term ``original 
        equipment manufacturer'' means a company that manufactures a 
        covered product that the company--
                    (A) designed from self-sourced or purchased 
                components; and
                    (B) sells under the name of the company.
    (b) Prohibition on Procurement and Use.--Subject to subsection (c) 
and notwithstanding sections 1905 through 1907 of title 41, United 
States Code, the head of an agency may not procure or obtain, renew a 
contract to procure or obtain, or use a covered product that is 
procured from an entity other than--
            (1) an original equipment manufacturer; or
            (2) an authorized reseller.
    (c) Waiver.--
            (1) In general.--Upon written notice to the Director of the 
        Office of Management and Budget, the head of an agency may 
        waive the prohibition under subsection (b) with respect to a 
        covered product if the head of the agency determines that 
        procuring, obtaining, or using the covered product is 
        necessary--
                    (A) for the purpose of scientifically valid 
                research (as defined in section 102 the Education 
                Sciences Reform Act of 2002 (20 U.S.C. 9501)); or
                    (B) to avoid jeopardizing the performance of 
                mission critical functions.
            (2) Notice.--The notice described in paragraph (1)--
                    (A) shall--
                            (i) specify, with respect to the waiver 
                        under paragraph (1)--
                                    (I) the justification for the 
                                waiver;
                                    (II) any security mitigations that 
                                have been implemented; and
                                    (III) with respect to a waiver that 
                                necessitates a security mitigation, the 
                                plan of action and milestones to avoid 
                                future waivers for subsequent similar 
                                purchases; and
                            (ii) be submitted in an unclassified form; 
                        and
                    (B) may include a classified annex.
            (3) Duration.--With respect to a waiver for the purpose of 
        research, as described in paragraph (1)(A), the waiver shall be 
        effective for the duration of the research identified in the 
        waiver.
    (d) Vendor Technical Assistance.--The head of each agency shall 
establish procurement guidance to provide assistance to entities that 
are not eligible for procurements of covered products due to the 
prohibition under subsection (b) on the process of becoming an 
authorized reseller for covered products.
    (e) Reports to Congress.--
            (1) In general.--Not later than 1 year after the date of 
        enactment of this Act, and annually thereafter until the date 
        that is 6 years after the date of enactment of this Act, the 
        Director of the Office of Management and Budget shall submit to 
        the appropriate congressional committees a report that 
        provides--
                    (A) the number and types of covered products for 
                which a waiver under subsection (c)(1) was granted 
                during the 1-year period preceding the date of the 
                submission of the report;
                    (B) the legal authority under which each waiver 
                described in subparagraph (A) was granted, such as 
                whether the waiver was granted pursuant to subparagraph 
                (A) or (B) of subsection (c)(1); and
                    (C) any actions taken by the head of an agency to 
                reduce the number of waivers issued by the agency under 
                subsection (c)(1) with the goal of achieving full 
                compliance with the prohibition under subsection (b).
            (2) Classification of report.--Each report submitted under 
        this subsection--
                    (A) shall be submitted in unclassified form; and
                    (B) may include a classified annex that contains 
                the information described in paragraph (1)(B).
    (f) No New Funds.--No additional amounts are authorized to be 
appropriated for the purpose of carrying out this Act.
    (g) Effective Date.--This section shall take effect on the date 
that is 1 year after the date of enactment of this Act.
                                                       Calendar No. 737

118th CONGRESS

  2d Session

                                S. 4651

                          [Report No. 118-317]

_______________________________________________________________________

                                 A BILL

 To require agencies to use information and communications technology 
 products obtained from original equipment manufacturers or authorized 
                   resellers, and for other purposes.

_______________________________________________________________________

            December 19 (legislative day, December 16), 2024

                       Reported with an amendment
```