IB 

Union Calendar No. 146 

116TH CONGRESS 

1ST SESSION H. R. 3320 

[Report No. 116–188] 

To amend the Homeland Security Act of 2002 to authorize the Secretary 

of Homeland Security to implement certain requirements for information 

relating to supply chain risk, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JUNE 18, 2019 

Mr. KING of New York (for himself, Mr. THOMPSON of Mississippi, Miss RICE

of New York, Mr. CORREA, Mr. ROGERS of Alabama, Mr. ROSE of New 

York, and Mr. PAYNE) introduced the following bill; which was referred 

to the Committee on Homeland Security 

AUGUST 27, 2019 

Additional sponsors: Mr. MCCAUL and Mr. HAGEDORN

AUGUST 27, 2019 

Reported with an amendment, committed to the Committee of the Whole 

House on the State of the Union, and ordered to be printed 

[Strike out all after the enacting clause and insert the part printed in italic] 

[For text of introduced bill, see copy of bill as introduced on June 18, 2019] 


pamtmann on DSKBC07HB2PROD with BILLS
2 

•HR 3320 RH

A BILL 

To amend the Homeland Security Act of 2002 to authorize 

the Secretary of Homeland Security to implement certain 

requirements for information relating to supply chain 

risk, and for other purposes. 


pamtmann on DSKBC07HB2PROD with BILLS
3 

•HR 3320 RH

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Securing the Homeland 

5 Security Supply Chain Act of 2019’’. 

6 SEC. 2. DEPARTMENT OF HOMELAND SECURITY REQUIRE7 MENTS FOR INFORMATION RELATING TO 

8 SUPPLY CHAIN RISK. 

9 (a) IN GENERAL.—Subtitle D of title VIII of the 

10 Homeland Security Act of 2002 (6 U.S.C. 391 et seq.) is 

11 amended by adding at the end the following new section: 

12 ‘‘SEC. 836. REQUIREMENTS FOR INFORMATION RELATING 

13 TO SUPPLY CHAIN RISK. 

14 ‘‘(a) AUTHORITY.—Subject to subsection (b), the Sec15 retary may— 

16 ‘‘(1) carry out a covered procurement action; 

17 ‘‘(2) limit, notwithstanding any other provision 

18 of law, in whole or in part, the disclosure of informa19 tion, including classified information, relating to the 

20 basis for carrying out such an action; and 

21 ‘‘(3) exclude, in whole or in part, a source car22 ried out in the course of such an action applicable to 

23 a covered procurement of the Department. 

24 ‘‘(b) DETERMINATION AND NOTIFICATION.—Except as 

25 authorized by subsection (c) to address an urgent national 


pamtmann on DSKBC07HB2PROD with BILLS
4 

•HR 3320 RH

1 security interest, the Secretary may exercise the authority 

2 provided in subsection (a) only after— 

3 ‘‘(1) obtaining a joint recommendation, in un4 classified or classified form, from the Chief Acquisi5 tion Officer and the Chief Information Officer of the 

6 Department, including a review of any risk assess7 ment made available by an appropriate person or en8 tity, including the national risk management center 

9 at the Cybersecurity and Infrastructure Security 

10 Agency, that there is a significant supply chain risk 

11 in a covered procurement; 

12 ‘‘(2) notifying any source named in the joint rec13 ommendation described in paragraph (1) advising— 

14 ‘‘(A) that a recommendation has been ob15 tained; 

16 ‘‘(B) to the extent consistent with the na17 tional security and law enforcement interests, the 

18 basis for such recommendation; 

19 ‘‘(C) that, within 30 days after receipt of 

20 notice, such source may submit information and 

21 argument in opposition to such recommendation; 

22 and 

23 ‘‘(D) of the procedures governing the consid24 eration of such submission and the possible exer25 cise of the authority provided in subsection (a); 


pamtmann on DSKBC07HB2PROD with BILLS
5 

•HR 3320 RH

1 ‘‘(3) notifying the relevant components of the De2 partment that such risk assessment has demonstrated 

3 significant supply chain risk to a covered procure4 ment; 

5 ‘‘(4) making a determination in writing, in un6 classified or classified form, that after considering 

7 any information submitted by a source under para8 graph (2), and in consultation with the Chief Infor9 mation Officer of the Department, that— 

10 ‘‘(A) use of authority under subsection 

11 (a)(1) is necessary to protect national security 

12 by reducing supply chain risk; 

13 ‘‘(B) less intrusive measures are not reason14 ably available to reduce such risk; 

15 ‘‘(C) a decision to limit disclosure of infor16 mation under subsection (a)(2) is necessary to 

17 protect national security interest; and 

18 ‘‘(D) the use of such authorities will apply 

19 to a single covered procurement or a class of cov20 ered procurements, and otherwise specifies the 

21 scope of such determination; 

22 ‘‘(5) providing to the Committee on Homeland 

23 Security of the House of Representatives and the 

24 Committee on Homeland Security and Governmental 

25 Affairs of the Senate a classified or unclassified notice 


pamtmann on DSKBC07HB2PROD with BILLS
6 

•HR 3320 RH

1 of the determination made under paragraph (4) that 

2 includes— 

3 ‘‘(A) the joint recommendation described in 

4 paragraph (1); 

5 ‘‘(B) a summary of any risk assessment re6 viewed in support of such joint recommendation; 

7 and 

8 ‘‘(C) a summary of the basis for such deter9 mination, including a discussion of less intrusive 

10 measures that were considered and why such 

11 measures were not reasonably available to reduce 

12 supply chain risk; 

13 ‘‘(6) notifying the Director of the Office of Man14 agement and Budget, and the heads of other Federal 

15 agencies as appropriate, in a manner and to the ex16 tent consistent with the requirements of national secu17 rity; and 

18 ‘‘(7) taking steps to maintain the confidentiality 

19 of any notifications under this subsection. 

20 ‘‘(c) PROCEDURES TO ADDRESS URGENT NATIONAL

21 SECURITY INTERESTS.—In any case in which the Secretary 

22 determines that national security interests require the im23 mediate exercise of the authorities under subsection (a), the 

24 Secretary— 


pamtmann on DSKBC07HB2PROD with BILLS
7 

•HR 3320 RH

1 ‘‘(1) may, to the extent necessary to address any 

2 such national security interest, and subject to the con3 ditions specified in paragraph (2)— 

4 ‘‘(A) temporarily delay the notice required 

5 by subsection (b)(2); 

6 ‘‘(B) make the determination required by 

7 subsection (b)(4), regardless of whether the notice 

8 required by subsection (b)(2) has been provided 

9 or whether the notified source at issue has sub10 mitted any information in response to such no11 tice; 

12 ‘‘(C) temporarily delay the notice required 

13 by subsections (b)(4) and (b)(5); and 

14 ‘‘(D) exercise the authority provided in sub15 section (a) in accordance with such determina16 tion; and 

17 ‘‘(2) shall take actions necessary to comply with 

18 all requirements of subsection (b) as soon as prac19 ticable after addressing the urgent national security 

20 interest that is the subject of paragraph (1), includ21 ing— 

22 ‘‘(A) providing the notice required by sub23 section (b)(2); 

24 ‘‘(B) promptly considering any information 

25 submitted by the source at issue in response to 


pamtmann on DSKBC07HB2PROD with BILLS
8 

•HR 3320 RH

1 such notice, and making any appropriate modi2 fications to the determination required by sub3 section (b)(4) based on such information; and 

4 ‘‘(C) providing the notice required by sub5 sections (b)(5) and (b)(6), including a descrip6 tion of such urgent national security, and any 

7 modifications to such determination made in ac8 cordance with subparagraph (B). 

9 ‘‘(d) ANNUAL REVIEW OF DETERMINATIONS.—The 

10 Secretary shall annually review all determinations made 

11 under subsection (b). 

12 ‘‘(e) DELEGATION.—The Secretary may not delegate 

13 the authority provided in subsection (a) or the responsi14 bility identified in subsection (d) to an official below the 

15 Deputy Secretary. 

16 ‘‘(f) LIMITATION OF REVIEW.—Notwithstanding any 

17 other provision of law, no action taken by the Secretary 

18 under subsection (a) may be subject to review in a bid pro19 test before the Government Accountability Office or in any 

20 Federal court. 

21 ‘‘(g) CONSULTATION.—In developing procedures and 

22 guidelines for the implementation of the authorities de23 scribed in this section, the Secretary shall review the proce24 dures and guidelines utilized by the Department of Defense 

25 to carry out similar authorities. 


pamtmann on DSKBC07HB2PROD with BILLS
9 

•HR 3320 RH

1 ‘‘(h) DEFINITIONS.—In this section: 

2 ‘‘(1) COVERED ARTICLE.—The term ‘covered ar3 ticle’ means: 

4 ‘‘(A) Information technology, including 

5 cloud computing services of all types. 

6 ‘‘(B) Telecommunications equipment. 

7 ‘‘(C) Telecommunications services. 

8 ‘‘(D) The processing of information on a 

9 Federal or non-Federal information system, sub10 ject to the requirements of the Controlled Unclas11 sified Information program of the Department. 

12 ‘‘(E) Hardware, systems, devices, software, 

13 or services that include embedded or incidental 

14 information technology. 

15 ‘‘(2) COVERED PROCUREMENT.—The term ‘cov16 ered procurement’ means— 

17 ‘‘(A) a source selection for a covered article 

18 involving either a performance specification, as 

19 provided in subsection (a)(3)(B) of section 3306 

20 of title 41, United States Code, or an evaluation 

21 factor, as provided in subsection (c)(1)(A) of 

22 such section, relating to supply chain risk, or 

23 with respect to which supply chain risk consider24 ations are included in the Department’s deterVerDate Sep 11 2014 20:08 Aug 27, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6203 E:\BILLS\H3320.RH H3320

pamtmann on DSKBC07HB2PROD with BILLS
10 

•HR 3320 RH

1 mination of whether a source is a responsible 

2 source as defined in section 113 of such title; 

3 ‘‘(B) the consideration of proposals for and 

4 issuance of a task or delivery order for a covered 

5 article, as provided in section 4106(d)(3) of title 

6 41, United States Code, with respect to which the 

7 task or delivery order contract includes a con8 tract clause establishing a requirement relating 

9 to supply chain risk; 

10 ‘‘(C) any contract action involving a con11 tract for a covered article with respect to which 

12 such contract includes a clause establishing re13 quirements relating to supply chain risk; or 

14 ‘‘(D) any procurement made via Govern15 ment Purchase Care for a covered article when 

16 supply chain risk has been identified as a con17 cern. 

18 ‘‘(3) COVERED PROCUREMENT ACTION.—The 

19 term ‘covered procurement action’ means any of the 

20 following actions, if such action takes place in the 

21 course of conducting a covered procurement: 

22 ‘‘(A) The exclusion of a source that fails to 

23 meet qualification requirements established pur24 suant to section 3311 of title 41, United States 


pamtmann on DSKBC07HB2PROD with BILLS
11 

•HR 3320 RH

1 Code, for the purpose of reducing supply chain 

2 risk in the acquisition or use of a covered article. 

3 ‘‘(B) The exclusion of a source that fails to 

4 achieve an acceptable rating with regard to an 

5 evaluation factor providing for the consideration 

6 of supply chain risk in the evaluation of pro7 posals for the award of a contract or the issuance 

8 of a task or delivery order. 

9 ‘‘(C) The determination that a source is not 

10 a responsible source based on considerations of 

11 supply chain risk. 

12 ‘‘(D) The decision to withhold consent for a 

13 contractor to subcontract with a particular 

14 source or to direct a contractor to exclude a par15 ticular source from consideration for a sub16 contract. 

17 ‘‘(4) INFORMATION SYSTEM.—The term ‘informa18 tion system’ has the meaning given such term in sec19 tion 3502 of title 44, United States Code. 

20 ‘‘(5) INFORMATION TECHNOLOGY.—The term ‘in21 formation technology’ has the meaning given such 

22 term in section 11101 of title 40, United States Code. 

23 ‘‘(6) RESPONSIBLE SOURCE.—The term ‘respon24 sible source’ has the meaning given such term in sec25 tion 113 of title 41, United States Code. 


pamtmann on DSKBC07HB2PROD with BILLS
12 

•HR 3320 RH

1 ‘‘(7) SUPPLY CHAIN RISK.—The term ‘supply 

2 chain risk’ means the risk that a malicious actor may 

3 sabotage, maliciously introduce an unwanted func4 tion, extract or modify data, or otherwise manipulate 

5 the design, integrity, manufacturing, production, dis6 tribution, installation, operation, or maintenance of a 

7 covered article so as to surveil, deny, disrupt, or oth8 erwise manipulate the function, use, or operation of 

9 the information technology or information stored or 

10 transmitted on the covered articles. 

11 ‘‘(8) TELECOMMUNICATIONS EQUIPMENT.—The 

12 term ‘telecommunications equipment’ has the mean13 ing given such term in section 3(52) of the Commu14 nications Act of 1934 (47 U.S.C. 153(52)). 

15 ‘‘(9) TELECOMMUNICATIONS SERVICE.—The term 

16 ‘telecommunications service’ has the meaning given 

17 such term in section 3(53) of the Communications Act 

18 of 1934 (47 U.S.C. 153(53)). 

19 ‘‘(i) EFFECTIVE DATE.—The requirements of this sec20 tion shall take effect on the date that is 90 days after the 

21 date of the enactment of this Act and shall apply to— 

22 ‘‘(1) contracts awarded on or after such date; 

23 and 


pamtmann on DSKBC07HB2PROD with BILLS
13 

•HR 3320 RH

1 ‘‘(2) task and delivery orders issued on or after 

2 such date pursuant to contracts awarded before, on, 

3 or after such date.’’. 

4 (b) RULEMAKING.—Section 553 of title 5, United 

5 States Code, and section 1707 of title 41, United States 

6 Code, shall not apply to the Secretary of Homeland Secu7 rity when carrying out the authorities and responsibilities 

8 under section 836 of the Homeland Security Act of 2002, 

9 as added by subsection (a). 

10 (c) CLERICAL AMENDMENT.—The table of contents in 

11 section 1(b) of the Homeland Security Act of 2002 is 

12 amended by inserting after the item relating to section 835 

13 the following new item: 

‘‘Sec. 836. Requirements for information relating to supply chain risk.’’. 

14 SEC. 3. REPORT ON THREATS POSED BY FOREIGN STATE15 OWNED ENTITIES TO DHS INFORMATION 

16 TECHNOLOGY AND COMMUNICATIONS SYS17 TEMS. 

18 Not later than 180 days after the date of the enactment 

19 of this Act, the Under Secretary for Management of the De20 partment of Homeland Security, in coordination with the 

21 national risk management center of the Cybersecurity and 

22 Infrastructure Security Agency of the Department, shall 

23 submit to the Committee on Homeland Security of the 

24 House of Representatives and the Committee on Homeland 

25 Security and Governmental Affairs of the Senate a report 


pamtmann on DSKBC07HB2PROD with BILLS
14 

•HR 3320 RH

1 on cybersecurity threats posed by terrorist actors and for2 eign state-owned entities to the information technology and 

3 communications systems of Department of Homeland Secu4 rity, including information relating to the following: 

5 (1) The use of foreign state-owned entities’ infor6 mation and communications technology by the De7 partment of Homeland Security, listed by component. 

8 (2) The threats, in consultation with the Depart9 ment’s Office of Intelligence and Analysis, of foreign 

10 state-owned entities’ information and communica11 tions technology equipment that could impact the De12 partment. 


pamtmann on DSKBC07HB2PROD with BILLS

pamtmann on DSKBC07HB2PROD with BILLS
Union Calendar No. 146 

116TH CONGRESS 

1ST SESSION H. R. 3320 

[Report No. 116–188] 

A BILL 

To amend the Homeland Security Act of 2002 to 

poses. relating to supply chain risk, and for other purimplement certain requirements for information authorize the Secretary of Homeland Security to 

AUGUST 27, 2019 

Reported with an amendment, committed to the Comand ordered to be printed mittee of the Whole House on the State of the Union, 


pamtmann on DSKBC07HB2PROD with BILLS