DEPUTY SECRETARY OF DEFENSE 

1010 DEFENSE PENTAGON 

WASHINGTON, DC 20301-1010 

MEMORANDUM FOR SECRETARIES OF MILITARY DEPARTMENTS 

CHAIRMAN OF THE JOINT CHIEFS OF STAFF 

UNDER SECRET ARIES OF DEFENSE 

CHIEF MANAGEMENT OFFICER 

CHIEF, NATIONAL GUARD BUREAU 

MAR 1 3 2018 

COMMANDERS OF THE CO MBA TANT COMMANDS 

GENERAL COUNSEL OF THE DEPARTMENT OF DEFENSE 

DIRECTOR OF COST ASSESSMENT AND PROGRAM 

EVALUATION 

INSPECTOR GENERAL OF THE DEPARTMENT OF DEFENSE 

DIRECTOR OF OPERATIONAL TEST AND EVALUATION 

CHIEF INFORMATION OFFICER OF THE DEP ARMENT 

DEFENSE 

ASSISTANT SECRETARY OF DEFENSE FOR LEGISLATIVE 

AFFAIRS 

ASSISTANT TO THE SECRETARY OF DEFENSE FOR PUBLIC 

AFFAIRS 

DIRECTOR OF NET ASSESSMENT 

DIRECTORS OF DEFENSE AGENCIES 

DIRECTORS OF DOD FIELD ACTIVITIES 

SUBJECT: Enhanced Section 806 Procedures for Supply Chain Risk Management in Support of 

DoD Trusted Systems and Networks 

Our adversaries continue to discover new methods to sabotage, disrupt, or otherwise 

degrade our systems and extract DoD information. It is critical that DoD components are extra 

vigilant in managing supply chain risk practices when procuring and integrating information and 

communications technology (ICT), whether as a product or as a service, into DoD national 

security systems (NSS). These activities are vital for protecting the systems and integrity of 

information relied upon by our warfighters. 

DoD is enhancing its procedures to proactively address supply chain threats that present 

counterintelligence risk to our enterprise, utilizing authorities in section 806 of the Ike Skelton 

National Defense Authorization Act for FY 2011 (Public Law 111-383), as amended. These 

procedures ensure that enterprise risk is assessed and mitigated in a timely manner and future 

procurements of the risky products are blocked when necessary. 

The attached document provides details of these new procedures, roles, and 

responsibilities, which are effective immediately for all DoD Components acquiring or 

0 I I I ·- osooo2sa2-ts-1cM0003n s01 a ·· 
sustaining DoD NSS. These changes will be integrated into an update to DoD Instruction 

5200.44 in the next 12 months. 

Attachment: 

As stated 

2 
ENHANCED PROCEDURES FOR ENTERPRISE-WIDE USE OF SECTION 806 

SUPPLY CHAIN RISK MANAGEMENT AUTHORITIES FOR DOD NATIONAL 

SECURITY SYSTEMS 

1. Trusted Systems and Networks (TSN). DoD Instruction (DoDI) 5200.44, "Protection of 

Mission Critical Functions to Achieve Trusted Systems and Networks," outlines a risk 

management approach that spans the entire system life cycle, including criticality analyses to 

identify critical functions and components; use of all-source intelligence on suppliers of 

critical components; and use of TSN processes, tools, and techniques to manage risk. 

a. Per DoDI 5200.44, all DoD national security systems (NSS), including information 

systems and weapon systems, or systems that have a "high" rating in any of the 

system categorization security objectives are required to implement TSN processes to 

address supply chain risk. 

b. For more information on these processes, see the DoDI 5200.44, DoD Chief 

Information Officer (CIO) Memorandum, "Guidance for the Procurement and 

Integration of Information and Communications Technology Components into 

Critical Information Systems and Networks" (March 24, 2016), and the Defense 

Acquisition Guide, Chapter 9, "Program Protection." 

2. Section 806 Supply Chain Risk Management Authorities. Section 806 of the Ike Skelton 

National Defense Authorization Act (NDAA) for FY 2011 (Public Law 111-383), as 

amended (section 806), authorizes certain DoD officials to take specific procurement actions 

to mitigate against supply chain risk in the procurement oflCT for NSS. These authorities 

and procedures are implemented at Defense Federal Acquisition Regulation Supplement 

(DFARS) Subpart 239.73, "Requirements for Information Relating to Supply Chain Risk." 

Section 806 and the implementing DF ARS procedures are: 

a. Structured with important safeguards, checks, and balances, such as requiring 

multiple findings, determinations, and concurrences by specified senior DoD officials 

(with strict limits on redelegation), and requiring congressional notification when the 

authority is used; and 

b. Available for use in individual procurements as well as on a "class" basis, where the 

findings and determinations are applicable to and available for any eligible DoD 

procurement transaction that is within the scope of the class established in the 

determination. 

3. Enhanced Procedures for Enterprise Use of section 806. To supplement existing TSN, 

Program Protection, and section 806 policies and guidance, an enhanced enterprise supply 

chain risk management (SCRM) procedure will be established. The DoD CIO and the Under 

Secretary of Defense for Acquisition and Sustainment (USD(A&S)) will immediately 

implement the following process to ensure ICT suppliers or products that represent a 

"critical" or "high" ( or selected "medium") counterintelligence risk are addressed at the DoD 

enterprise level. 
a. Delegation of Authority and Assignment of Responsibilities. Section 806 and the 

DF ARS assign responsibilities, and allow delegation of authority, to the Under Secretary 

of Defense for Acquisition, Technology, and Logistics (USD(AT &L)), which are hereby 

transferred or redelegated in view of the transition of USD(A T &L) to the new offices of 

the USD for Research and Engineering (R&E) and USD(A&S) (pursuant to section 901 

of the NDAA for FY2017, as amended, and codified at 10 U.S.C. 133a & 133b), as 

follows: 

1) Pursuant to DFARS 239.7303(b)(l), the USD(A&S) is hereby delegated the 

authority of the Secretary of Defense to make determinations pursuant to DF ARS 

239.7304(b), and to take actions authorized by 239.7305, for any organizational 

unit of the Department of Defense, including the Military Departments 

(MILDEPs), and the DoD Fourth Estate (i.e., OSD, the Office of the Chairman of 

the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office 

of the Inspector General of the Department of Defense, the Defense Agencies, the 

DoD Field Activities, and all other organizational entities within the DoD that are 

not in the MILDEPs) (collectively "DoD Components"), and any such 

determination shall be binding on the DoD Component(s) concerned. This 

authority of the USD(A&S) is distinct from the authority of the Secretaries of the 

MILDEPs described in paragraph 3.f., and cannot be further redelegated. 

2) The remainder of the authorities and responsibilities that are provided for 

USD(A T &L) in section 806, and the current version of the implementing DF ARS 

Subpart 239.73, are transferred to the USD(R&E) and the USD(A&S) in the 

manner set forth in this memorandum. 

b. DFARS Clauses. Effective immediately, DoD Components will not purchase ICT for 

NSS except through contract vehicles that include the clause at DF ARS 252.239-7018, 

Supply Chain Risk. DoD Components will immediately take steps to include this clause 

and appropriate provisions to enable use of authorities in section 806, as prescribed at 

DFARS 239.7306. 

c. Notice of Certain Threat Assessments. The Director, Defense Intelligence Agency 

(DIA) will notify DoD CIO, USD(R&E), USD(A&S), the Secretaries of the MILDEPS, 

Commander, U.S. Cyber Command (CDRUSCYBERCOM), and the Director, Defense 

Security Service (DIRDSS) when a "critical" or "high" threat rating on a supplier threat 

assessment has been completed, as well as when selected "medium" threat assessments 

have been identified in accordance with criteria to be established by DoD CIO, 

USD(R&E), USD(A&S), the Secretaries of the MILDEPs, CDRUSCYBERCOM, and 

DIRDSS within 30 days of the date of this memorandum. 

d. Assessment of Supply Chain Risk and Scoping of Mitigation Actions. The DoD CIO, 

USD(R&E), USD(A&S), and CDRUSCYBERCOM, in coordination with the MILDEPs, 

will: 

2 
1) Assess each of the supplier threat assessments provided by DIA and determine 

whether there is significant supply chain risk for DoD NSS; and 

2) Document a Scoping and Mitigation decision for all cases in which the use of 

section 806 authority is warranted, which decision shall: 

1. Indicate whether the assessment and determination of risk applies only to 

an individual procurement transaction ( e.g., a unique scenario that is 

unlikely to occur repeatedly across the enterprise), or applies to a class of 

procurements (i.e., any procurement that meets the class criteria specified 

in the scoping decision); and 

ii. Direct or recommend specific risk mitigation actions, such as use of the 

section 806 authority to block all procurement of the relevant ICT in any 

DoD NSS, or leaving full discretion regarding the application of the 

section 806 authority with the appropriate, authorized, DoD officials (see 

DFARS 239.7303 and 239.7304). 

e. Documenting the Joint Recommendation, Concurrence, and Determination to Use 

section 806 Authorities. For suppliers or products requiring action under section 806-

1) The DoD CIO, in coordination with the Under Secretary of Defense for 

Intelligence (USD(I)) and USD(A&S), will prepare and execute an action 

package that contains the Joint Recommendation of the DoD CIO and 

USD(A&S), on the basis of a risk assessment by USD(I) (i.e., the DIA threat 

assessment referenced in paragraph 3.c.), regarding the assessment of significant 

supply chain risk, and the scope of applicability and the required or recommended 

mitigations as identified and documented pursuant to paragraph 3.d. (which 

satisfies the requirements ofDFARS 239.7304(a)); 

2) The action package referenced in 1 ), immediately above may also contain: 

1. The advance Concurrence of USD(A&S) (including any conditions or 

limitations thereon) for any subsequent Determination by an Authorized 

Official in a Military Department (see DFARS 239.7303) to exercise the 

section 806 authority for a procurement that is within the scope of the 

Joint Recommendation, pursuant to DF ARS 239. 7304(b ); and 

11. The Determination by USD(A&S) (including any conditions or limitations 

thereon) to exercise section 806 authority for procurements by any DoD 

Component (including the MILDEPs and the DoD Fourth Estate) that are 

within the scope of the Joint Recommendation, pursuant to DF ARS 

239.7304(b). 

3) The signed Joint Recommendation, Concurrence, and Determination package will 

be stored by DoD CIO; and 

3 
4) USD(A&S) will send a notice of the section 806 Determination to Congress, as 

discussed further at paragraph 3 .j. 

f. Section 806 Determinations for the MILDEPs. After completion of the Joint 

Recommendation and Concurrence (when the Determination by USD(A&S) does not 

cover the MILDEPs), the Authorized Officials for the MILDEPS (i.e., the Secretaries of 

the MILDEPs, or their senior acquisition executives if delegated authority pursuant to 

DFARS 239.7303(b)(2)) may make the Determination required by DFARS 239.7304(b), 

and ensure that appropriate notice is provided to Congress (see paragraph 3 .j), prior to 

taking any covered procurement action authorized by DFARS 239.7305. Such 

Determination(s) to use section 806 within a MILDEP may be made for individual 

procurements, or as a Class Determination for that MILDEP. 

g. Procedures for Notifying the Acquisition Workforce. No later than 60 days of the 

date of this memorandum, the Director for Defense Procurement and Acquisition Policy 

(OPAP) will develop procedures that documents and informs the Acquisition Workforce 

regarding all section 806 Class Determinations made pursuant to paragraphs e., and f. 

h. Procedures for Notifying Vendors. No later than 60 days of the date of this 

memorandum, DP AP will develop procedures that will limit the disclosure of information 

relating to the basis for a section 806 Determination (pursuant to sec. 806(d) and DFARS 

239.7305(d)) and govern notification of entities within the scope of the Determination. 

For Class Determinations, This guidance shall require the following: 

1) Notification of each affected entity of each Class Determination and the scope of 

such Determination, including for: 

1. The initial Determination by any authorized official; and 

11. The results of the annual review of each such Determination (pursuant to 

paragraph k) 

2) Provision to the entity an opportunity to challenge the initial Class Determination 

or annual review not later than 30 days after receipt of any such notice, in 

accordance with the DP AP specified administrative procedures. 

1. Implementing and Documenting the Use of section 806 Authorities. All DoD 

Components shall implement and document the use of section 806 authorities pursuant to 

any Determination made pursuant to DFARS 239.7304: 

1) Covered Procurement Actions. The Component's Procurement Executive shall 

ensure that all necessary covered procurement actions (OF ARS 239.7305) are 

taken and appropriately reported, including: 

1. Ensuring that contracts are not awarded, and that consent to subcontract is 

withheld, for suppliers or products covered by any Determination, except 

as provided in paragraph i.2); and 

4 
11. Reporting to DP AP all section 806 covered procurement actions that are 

within the scope of any Determination, for inclusion in the annual report 

described in paragraph j.3). 

2) Exceptions to Covered Procurement Actions. The Component Acquisition 

Executive will identify and report all circumstances for which a covered 

procurement action that is otherwise required by a Class Determination should not 

be taken ( e.g., mission impact resulting from excluding the entity or product 

presents a greater risk to national security than the supply chain risk; a technical 

mitigation or other less intrusive measure is reasonably available to reduce the 

supply chain risk). The Component shall submit a request for exception that 

includes a detailed description of the circumstances and specific action being 

proposed that varies from the requirements of the Determination, and how these 

circumstances and actions effectively address the risk to national security that is 

described in the Determination. The Component shall not proceed with the 

proposed activity unless authorized to do so in accordance with procedures to be 

developed by USD(A&S) and DoD CIO within 60 days of the date of this 

memorandum. 

J. Procedures for Notifying Congress of the Use of section 806 Authorities. The notice 

to Congress that is required by DFARS 239.7304(c) will be accomplished as follows: 

1) Section 806 Class Determinations. For any Class Determination, the Authorized 

Official making that determination will: 

1. Provide notice to Congress of the initial Class Determination; and 

n. Report to DP AP for inclusion in the annual report to Congress as 

described in paragraph 3): 

1. The initial Class Determination; and 

2. All covered procurement actions made under any such Class 

Determination( s). 

2) Individual Procurements Not Covered by a Class Determination. For a 

Determination to use section 806 for an individual procurement that is not 

covered by a Class Determination, the Authorized Official making the 

determination will provide the required notice(s) to Congress, and will report that 

Determination to DPAP for inclusion in the annual report to Congress as 

described in paragraph 3). 

3) Annual Report. USD(A&S) shall submit an annual, aggregated report to 

Congress identifying all covered procurement actions taken by any DoD 

Component during the annual reporting period. 

k. Annual Review. All Determinations made pursuant to DFARS 239.7304(b) shall be 

reviewed annually. 

5 
I. DO DIN Operations, Security and Monitoring. These procedures in no way limit or 

alter the authority of CDRUSCYBERCOM to take all•necessary and appropriate action to 

secure, defend, and operate the DoD Information Network (DODIN) in accordance with 

existing authorities. CDRUSCYBERCOM, in coordination with the Director, National 

Security Agency, may independently conduct operational and technical observations and 

assessments to be considered in the scoping and mitigation process outlined above. 

CDRUSCYBERCOM will periodically monitor the DODIN for prohibited hardware, 

software, or services identified through the processes in this memorandum. 

6