I 

116TH CONGRESS 

1ST SESSION H. R. 3320 

To amend the Homeland Security Act of 2002 to authorize the Secretary 

of Homeland Security to implement certain requirements for information 

relating to supply chain risk, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JUNE 18, 2019 

Mr. KING of New York (for himself, Mr. THOMPSON of Mississippi, Miss RICE

of New York, Mr. CORREA, Mr. ROGERS of Alabama, Mr. ROSE of New 

York, and Mr. PAYNE) introduced the following bill; which was referred 

to the Committee on Homeland Security 

A BILL 

To amend the Homeland Security Act of 2002 to authorize 

the Secretary of Homeland Security to implement certain 

requirements for information relating to supply chain 

risk, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Securing the Home5 land Security Supply Chain Act of 2019’’. 


pbinns on DSK79D2C42PROD with BILLS
2 

•HR 3320 IH

1 SEC. 2. DEPARTMENT OF HOMELAND SECURITY REQUIRE2 MENTS FOR INFORMATION RELATING TO 

3 SUPPLY CHAIN RISK. 

4 (a) IN GENERAL.—Subtitle D of title VIII of the 

5 Homeland Security Act of 2002 (6 U.S.C. 391 et seq.) 

6 is amended by adding at the end the following new section: 

7 ‘‘SEC. 836. REQUIREMENTS FOR INFORMATION RELATING 

8 TO SUPPLY CHAIN RISK. 

9 ‘‘(a) AUTHORITY.—Subject to subsection (b), the 

10 Secretary may— 

11 ‘‘(1) carry out a covered procurement action; 

12 ‘‘(2) limit, notwithstanding any other provision 

13 of law, in whole or in part, the disclosure of informa14 tion, including classified information, relating to the 

15 basis for carrying out such an action; and 

16 ‘‘(3) exclude, in whole or in part, a source car17 ried out in the course of such an action applicable 

18 to a covered procurement of the Department. 

19 ‘‘(b) DETERMINATION AND NOTIFICATION.—Except 

20 as authorized by subsection (c) to address an urgent na21 tional security interest, the Secretary may exercise the au22 thority provided in subsection (a) only after— 

23 ‘‘(1) obtaining a joint recommendation, in un24 classified or classified form, from the Chief Acquisi25 tion Officer and the Chief Information Officer of the 

26 Department, including a review of any risk assessVerDate Sep 11 2014 05:20 Jun 21, 2019 Jkt 034408 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H3320.IH H3320

pbinns on DSK79D2C42PROD with BILLS
3 

•HR 3320 IH

1 ment made available by an appropriate person or en2 tity, that there is a significant supply chain risk in 

3 a covered procurement; 

4 ‘‘(2) notifying any source named in the joint 

5 recommendation described in paragraph (1) advis6 ing— 

7 ‘‘(A) that a recommendation has been ob8 tained; 

9 ‘‘(B) to the extent consistent with the na10 tional security and law enforcement interests, 

11 the basis for such recommendation; 

12 ‘‘(C) that, within 30 days after receipt of 

13 notice, such source may submit information and 

14 argument in opposition to such recommenda15 tion; and 

16 ‘‘(D) of the procedures governing the con17 sideration of such submission and the possible 

18 exercise of the authority provided in subsection 

19 (a); 

20 ‘‘(3) notifying the relevant components of the 

21 Department that such risk assessment has dem22 onstrated significant supply chain risk to a covered 

23 procurement; 

24 ‘‘(4) making a determination in writing, in un25 classified or classified form, that after considering 


pbinns on DSK79D2C42PROD with BILLS
4 

•HR 3320 IH

1 any information submitted by a source under para2 graph (2), and in consultation with the Chief Infor3 mation Officer of the Department, that— 

4 ‘‘(A) use of authority under subsection 

5 (a)(1) is necessary to protect national security 

6 by reducing supply chain risk; 

7 ‘‘(B) less intrusive measures are not rea8 sonably available to reduce such risk; 

9 ‘‘(C) a decision to limit disclosure of infor10 mation under subsection (a)(2) is necessary to 

11 protect national security interest; and 

12 ‘‘(D) the use of such authorities will apply 

13 to a single covered procurement or a class of 

14 covered procurements, and otherwise specifies 

15 the scope of such determination; 

16 ‘‘(5) providing to the Committee on Homeland 

17 Security of the House of Representatives and the 

18 Committee on Homeland Security and Governmental 

19 Affairs of the Senate a classified or unclassified no20 tice of the determination made under paragraph (4) 

21 that includes— 

22 ‘‘(A) the joint recommendation described 

23 in paragraph (1); 


pbinns on DSK79D2C42PROD with BILLS
5 

•HR 3320 IH

1 ‘‘(B) a summary of any risk assessment re2 viewed in support of such joint recommenda3 tion; and 

4 ‘‘(C) a summary of the basis for such de5 termination, including a discussion of less in6 trusive measures that were considered and why 

7 such measures were not reasonably available to 

8 reduce supply chain risk; 

9 ‘‘(6) notifying the Director of the Office of 

10 Management and Budget, and the heads of other 

11 Federal agencies as appropriate, in a manner and to 

12 the extent consistent with the requirements of na13 tional security; and 

14 ‘‘(7) taking steps to maintain the confidentiality 

15 of any notifications under this subsection. 

16 ‘‘(c) PROCEDURES TO ADDRESS URGENT NATIONAL

17 SECURITY INTERESTS.—In any case in which the Sec18 retary determines that national security interests require 

19 the immediate exercise of the authorities under subsection 

20 (a), the Secretary— 

21 ‘‘(1) may, to the extent necessary to address 

22 any such national security interest, and subject to 

23 the conditions specified in paragraph (2)— 

24 ‘‘(A) temporarily delay the notice required 

25 by subsection (b)(2); 


pbinns on DSK79D2C42PROD with BILLS
6 

•HR 3320 IH

1 ‘‘(B) make the determination required by 

2 subsection (b)(4), regardless of whether the no3 tice required by subsection (b)(2) has been pro4 vided or whether the notified source at issue 

5 has submitted any information in response to 

6 such notice; 

7 ‘‘(C) temporarily delay the notice required 

8 by subsections (b)(4) and (b)(5); and 

9 ‘‘(D) exercise the authority provided in 

10 subsection (a) in accordance with such deter11 mination; and 

12 ‘‘(2) shall take actions necessary to comply with 

13 all requirements of subsection (b) as soon as prac14 ticable after addressing the urgent national security 

15 interest that is the subject of paragraph (1), includ16 ing— 

17 ‘‘(A) providing the notice required by sub18 section (b)(2); 

19 ‘‘(B) promptly considering any information 

20 submitted by the source at issue in response to 

21 such notice, and making any appropriate modi22 fications to the determination required by sub23 section (b)(4) based on such information; and 

24 ‘‘(C) providing the notice required by sub25 sections (b)(5) and (b)(6), including a descripVerDate Sep 11 2014 05:20 Jun 21, 2019 Jkt 034408 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H3320.IH H3320

pbinns on DSK79D2C42PROD with BILLS
7 

•HR 3320 IH

1 tion of such urgent national security, and any 

2 modifications to such determination made in ac3 cordance with subparagraph (B). 

4 ‘‘(d) ANNUAL REVIEW OF DETERMINATIONS.—The 

5 Secretary shall annually review all determinations made 

6 under subsection (b). 

7 ‘‘(e) DELEGATION.—The Secretary may not delegate 

8 the authority provided in subsection (a) or the responsi9 bility identified in subsection (d) to an official below the 

10 Deputy Secretary. 

11 ‘‘(f) LIMITATION OF REVIEW.—Notwithstanding any 

12 other provision of law, no action taken by the Secretary 

13 under subsection (a) may be subject to review in a bid 

14 protest before the Government Accountability Office or in 

15 any Federal court. 

16 ‘‘(g) CONSULTATION.—In developing procedures and 

17 guidelines for the implementation of the authorities de18 scribed in this section, the Secretary shall review the pro19 cedures and guidelines utilized by the Department of De20 fense to carry out similar authorities. 

21 ‘‘(h) DEFINITIONS.—In this section: 

22 ‘‘(1) COVERED ARTICLE.—The term ‘covered 

23 article’ means: 

24 ‘‘(A) Information technology, including 

25 cloud computing services of all types. 


pbinns on DSK79D2C42PROD with BILLS
8 

•HR 3320 IH

1 ‘‘(B) Telecommunications equipment. 

2 ‘‘(C) Telecommunications services. 

3 ‘‘(D) The processing of information on a 

4 Federal or non-Federal information system, 

5 subject to the requirements of the Controlled 

6 Unclassified Information program of the De7 partment. 

8 ‘‘(E) Hardware, systems, devices, software, 

9 or services that include embedded or incidental 

10 information technology. 

11 ‘‘(2) COVERED PROCUREMENT.—The term ‘cov12 ered procurement’ means— 

13 ‘‘(A) a source selection for a covered arti14 cle involving either a performance specification, 

15 as provided in subsection (a)(3)(B) of section 

16 3306 of title 41, United States Code, or an 

17 evaluation factor, as provided in subsection 

18 (c)(1)(A) of such section, relating to supply 

19 chain risk, or with respect to which supply 

20 chain risk considerations are included in the 

21 Department’s determination of whether a 

22 source is a responsible source as defined in sec23 tion 113 of such title; 

24 ‘‘(B) the consideration of proposals for and 

25 issuance of a task or delivery order for a covVerDate Sep 11 2014 05:20 Jun 21, 2019 Jkt 034408 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H3320.IH H3320

pbinns on DSK79D2C42PROD with BILLS
9 

•HR 3320 IH

1 ered article, as provided in section 4106(d)(3) 

2 of title 41, United States Code, with respect to 

3 which the task or delivery order contract in4 cludes a contract clause establishing a require5 ment relating to supply chain risk; 

6 ‘‘(C) any contract action involving a con7 tract for a covered article with respect to which 

8 such contract includes a clause establishing re9 quirements relating to supply chain risk; or 

10 ‘‘(D) any procurement made via Govern11 ment Purchase Care for a covered article when 

12 supply chain risk has been identified as a con13 cern. 

14 ‘‘(3) COVERED PROCUREMENT ACTION.—The 

15 term ‘covered procurement action’ means any of the 

16 following actions, if such action takes place in the 

17 course of conducting a covered procurement: 

18 ‘‘(A) The exclusion of a source that fails to 

19 meet qualification requirements established pur20 suant to section 3311 of title 41, United States 

21 Code, for the purpose of reducing supply chain 

22 risk in the acquisition or use of a covered arti23 cle. 

24 ‘‘(B) The exclusion of a source that fails to 

25 achieve an acceptable rating with regard to an 


pbinns on DSK79D2C42PROD with BILLS
10 

•HR 3320 IH

1 evaluation factor providing for the consideration 

2 of supply chain risk in the evaluation of pro3 posals for the award of a contract or the 

4 issuance of a task or delivery order. 

5 ‘‘(C) The determination that a source is 

6 not a responsible source based on consider7 ations of supply chain risk. 

8 ‘‘(D) The decision to withhold consent for 

9 a contractor to subcontract with a particular 

10 source or to direct a contractor to exclude a 

11 particular source from consideration for a sub12 contract. 

13 ‘‘(4) INFORMATION SYSTEM.—The term ‘infor14 mation system’ has the meaning given such term in 

15 section 3502 of title 44, United States Code. 

16 ‘‘(5) INFORMATION TECHNOLOGY.—The term 

17 ‘information technology’ has the meaning given such 

18 term in section 11101 of title 40, United States 

19 Code. 

20 ‘‘(6) RESPONSIBLE SOURCE.—The term ‘re21 sponsible source’ has the meaning given such term 

22 in section 113 of title 41, United States Code. 

23 ‘‘(7) SUPPLY CHAIN RISK.—The term ‘supply 

24 chain risk’ means the risk that a malicious actor 

25 may sabotage, maliciously introduce an unwanted 


pbinns on DSK79D2C42PROD with BILLS
11 

•HR 3320 IH

1 function, extract or modify data, or otherwise ma2 nipulate the design, integrity, manufacturing, pro3 duction, distribution, installation, operation, or 

4 maintenance of a covered article so as to surveil, 

5 deny, disrupt, or otherwise manipulate the function, 

6 use, or operation of the information technology or 

7 information stored or transmitted on the covered ar8 ticles. 

9 ‘‘(8) TELECOMMUNICATIONS EQUIPMENT.—The 

10 term ‘telecommunications equipment’ has the mean11 ing given such term in section 3(52) of the Commu12 nications Act of 1934 (47 U.S.C. 153(52)). 

13 ‘‘(9) TELECOMMUNICATIONS SERVICE.—The 

14 term ‘telecommunications service’ has the meaning 

15 given such term in section 3(53) of the Communica16 tions Act of 1934 (47 U.S.C. 153(53)). 

17 ‘‘(i) EFFECTIVE DATE.—The requirements of this 

18 section shall take effect on the date that is 90 days after 

19 the date of the enactment of this Act and shall apply to— 

20 ‘‘(1) contracts awarded on or after such date; 

21 and 

22 ‘‘(2) task and delivery orders issued on or after 

23 such date pursuant to contracts awarded before, on, 

24 or after such date.’’. 


pbinns on DSK79D2C42PROD with BILLS
12 

•HR 3320 IH

1 (b) RULEMAKING.—Section 553 of title 5, United 

2 States Code, and section 1707 of title 41, United States 

3 Code, shall not apply to the Secretary of Homeland Secu4 rity when carrying out the authorities and responsibilities 

5 under section 836 of the Homeland Security Act of 2002, 

6 as added by subsection (a). 

7 (c) CLERICAL AMENDMENT.—The table of contents 

8 in section 1(b) of the Homeland Security Act of 2002 is 

9 amended by inserting after the item relating to section 

10 835 the following new item: 

‘‘Sec. 836. Requirements for information relating to supply chain risk.’’. 

Æ 


pbinns on DSK79D2C42PROD with BILLS