HR 7327 RDS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Strengthening and Enhancing Cyber-capabilities by Uti-
lizing Risk Exposure Technology Act’’ or the ‘‘SECURE 
Technology Act’’. 
(b) TABLE OF CONTENTS.—The table of contents for 
this Act is as follows: 
Sec. 1. Short title; table of contents. 
TITLE I—DEPARTMENT OF HOMELAND SECURITY INFORMATION 
SECURITY AND OTHER MATTERS 
Sec. 101. Department 
of 
Homeland 
Security 
disclosure 
of 
security 
vulnerabilities. 
Sec. 102. Department of Homeland Security bug bounty pilot program. 
Sec. 103. Congressional submittal of reports relating to certain special access 
programs and similar programs. 
TITLE II—FEDERAL ACQUISITION SUPPLY CHAIN SECURITY 
Sec. 201. Short title. 
Sec. 202. Federal acquisition supply chain security. 
Sec. 203. Authorities of executive agencies relating to mitigating supply chain 
risks in the procurement of covered articles. 
Sec. 204. Federal Information Security Modernization Act. 
Sec. 205. Effective date. 
TITLE 
I—DEPARTMENT 
OF 
HOMELAND SECURITY INFOR-
MATION 
SECURITY 
AND 
OTHER MATTERS 
SEC. 101. DEPARTMENT OF HOMELAND SECURITY DISCLO-
SURE OF SECURITY VULNERABILITIES. 
(a) VULNERABILITY DISCLOSURE POLICY.—The Sec-
retary of Homeland Security shall establish a policy appli-
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
(c) CONSULTATION.— 
(1) IN GENERAL.—In developing the security 
vulnerability disclosure policy under subsection (a), 
the Secretary of Homeland Security shall consult 
with each of the following: 
(A) The Attorney General regarding how 
to ensure that individuals, organizations, and 
companies that comply with the requirements of 
the policy developed under subsection (a) are 
protected from prosecution under section 1030 
of title 18, United States Code, civil lawsuits, 
and similar provisions of law with respect to 
specific activities authorized under the policy. 
(B) The Secretary of Defense and the Ad-
ministrator of General Services regarding les-
sons that may be applied from existing vulner-
ability disclosure policies. 
(C) Non-governmental security researchers. 
(2) NONAPPLICABILITY OF FACA.—The Federal 
Advisory Committee Act (5 U.S.C. App.) shall not 
apply to any consultation under this section. 
(d) PUBLIC AVAILABILITY.—The Secretary of Home-
land Security shall make the policy developed under sub-
section (a) publicly available. 
(e) SUBMISSION TO CONGRESS.— 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
(1) DISCLOSURE
POLICY
AND
REMEDIATION 
PROCESS.—Not later than 90 days after the date of 
the enactment of this Act, the Secretary of Home-
land Security shall submit to the appropriate con-
gressional committees a copy of the policy required 
under subsection (a) and the remediation process re-
quired under subsection (b). 
(2) REPORT AND BRIEFING.— 
(A) REPORT.—Not later than one year 
after establishing the policy required under sub-
section (a), the Secretary of Homeland Security 
shall submit to the appropriate congressional 
committees a report on such policy and the re-
mediation process required under subsection 
(b). 
(B) ANNUAL BRIEFINGS.—One year after 
the date of the submission of the report under 
subparagraph (A), and annually thereafter for 
each of the next three years, the Secretary of 
Homeland Security shall provide to the appro-
priate congressional committees a briefing on 
the policy required under subsection (a) and the 
process required under subsection (b). 
(C) MATTERS
FOR
INCLUSION.—The re-
port required under subparagraph (A) and the 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
briefings required under subparagraph (B) shall 
include each of the following with respect to the 
policy required under subsection (a) and the 
process required under subsection (b) for the 
period covered by the report or briefing, as the 
case may be: 
(i) The number of unique security 
vulnerabilities reported. 
(ii) The number of previously un-
known security vulnerabilities mitigated or 
remediated. 
(iii) The number of unique individ-
uals, organizations, and companies that re-
ported security vulnerabilities. 
(iv) The average length of time be-
tween 
the 
reporting 
of 
security 
vulnerabilities and mitigation or remedi-
ation of such vulnerabilities. 
(f) DEFINITIONS.—In this section: 
(1) The term ‘‘security vulnerability’’ has the 
meaning given that term in section 102(17) of the 
Cybersecurity Information Sharing Act of 2015 (6 
U.S.C. 1501(17)), in information technology. 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
(2) The term ‘‘information system’’ has the 
meaning given that term by section 3502 of title 44, 
United States Code. 
(3) The term ‘‘appropriate information system’’ 
means an information system that the Secretary of 
Homeland Security selects for inclusion under the 
vulnerability disclosure policy required by subsection 
(a). 
(4) The term ‘‘appropriate congressional com-
mittees’’ means— 
(A) the Committee on Homeland Security, 
the Committee on Armed Services, the Com-
mittee on Energy and Commerce, and the Per-
manent Select Committee on Intelligence of the 
House of Representatives; and 
(B) the Committee on Homeland Security 
and Governmental Affairs, the Committee on 
Armed Services, the Committee on Commerce, 
Science, and Transportation, and the Select 
Committee on Intelligence of the Senate. 
SEC. 102. DEPARTMENT OF HOMELAND SECURITY BUG 
BOUNTY PILOT PROGRAM. 
(a) DEFINITIONS.—In this section: 
(1) The term ‘‘appropriate congressional com-
mittees’’ means— 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
(A) the Committee on Homeland Security 
and Governmental Affairs of the Senate; 
(B) the Select Committee on Intelligence 
of the Senate; 
(C) the Committee on Homeland Security 
of the House of Representatives; and 
(D) Permanent Select Committee on Intel-
ligence of the House of Representatives. 
(2) The term ‘‘bug bounty program’’ means a 
program under which— 
(A) individuals, organizations, and compa-
nies are temporarily authorized to identify and 
report vulnerabilities of appropriate information 
systems of the Department; and 
(B) eligible individuals, organizations, and 
companies receive compensation in exchange for 
such reports. 
(3) The term ‘‘Department’’ means the Depart-
ment of Homeland Security. 
(4) The term ‘‘eligible individual, organization, 
or company’’ means an individual, organization, or 
company that meets such criteria as the Secretary 
determines in order to receive compensation in com-
pliance with Federal laws. 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
(5) The term ‘‘information system’’ has the 
meaning given the term in section 3502 of title 44, 
United States Code. 
(6) The term ‘‘pilot program’’ means the bug 
bounty pilot program required to be established 
under subsection (b)(1). 
(7) The term ‘‘Secretary’’ means the Secretary 
of Homeland Security. 
(b) BUG BOUNTY PILOT PROGRAM.— 
(1) ESTABLISHMENT.—Not later than 180 days 
after the date of enactment of this Act, the Sec-
retary shall establish, within the Office of the Chief 
Information Officer, a bug bounty pilot program to 
minimize vulnerabilities of appropriate information 
systems of the Department. 
(2) RESPONSIBILITIES OF SECRETARY.—In es-
tablishing and conducting the pilot program, the 
Secretary shall— 
(A) designate appropriate information sys-
tems to be included in the pilot program; 
(B) provide compensation to eligible indi-
viduals, organizations, and companies for re-
ports 
of 
previously 
unidentified 
security 
vulnerabilities within the information systems 
designated under subparagraph (A); 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
(C) establish criteria for individuals, orga-
nizations, and companies to be considered eligi-
ble for compensation under the pilot program in 
compliance with Federal laws; 
(D) consult with the Attorney General on 
how to ensure that approved individuals, orga-
nizations, or companies that comply with the 
requirements of the pilot program are protected 
from prosecution under section 1030 of title 18, 
United States Code, and similar provisions of 
law, and civil lawsuits for specific activities au-
thorized under the pilot program; 
(E) consult with the Secretary of Defense 
and the heads of other departments and agen-
cies that have implemented programs to provide 
compensation for reports of previously undis-
closed vulnerabilities in information systems, re-
garding lessons that may be applied from such 
programs; and 
(F) develop an expeditious process by 
which an individual, organization, or company 
can register with the Department, submit to a 
background check as determined by the Depart-
ment, and receive a determination as to eligi-
bility; and 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
(G) engage qualified interested persons, in-
cluding non-government sector representatives, 
about the structure of the pilot program as con-
structive and to the extent practicable. 
(3) CONTRACT
AUTHORITY.—In establishing 
the pilot program, the Secretary, subject to the 
availability of appropriations, may award 1 or more 
competitive contracts to an entity, as necessary, to 
manage the pilot program. 
(c) REPORT TO CONGRESS.—Not later than 180 days 
after the date on which the pilot program is completed, 
the Secretary shall submit to the appropriate congres-
sional committees a report on the pilot program, which 
shall include— 
(1) the number of individuals, organizations, or 
companies that participated in the pilot program, 
broken down by the number of individuals, organiza-
tions, or companies that— 
(A) registered; 
(B) were determined eligible; 
(C) submitted security vulnerabilities; and 
(D) received compensation; 
(2) the number and severity of vulnerabilities 
reported as part of the pilot program; 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
(3) the number of previously unidentified secu-
rity vulnerabilities remediated as a result of the pilot 
program; 
(4) the current number of outstanding pre-
viously unidentified security vulnerabilities and De-
partment remediation plans; 
(5) the average length of time between the re-
porting of security vulnerabilities and remediation of 
the vulnerabilities; 
(6) the types of compensation provided under 
the pilot program; and 
(7) the lessons learned from the pilot program. 
(d) AUTHORIZATION OF APPROPRIATIONS.—There is 
authorized to be appropriated to the Department 
$250,000 for fiscal year 2019 to carry out this section. 
SEC. 103. CONGRESSIONAL SUBMITTAL OF REPORTS RE-
LATING TO CERTAIN SPECIAL ACCESS PRO-
GRAMS AND SIMILAR PROGRAMS. 
The National Defense Authorization Act for Fiscal 
Year 1994 (50 U.S.C. 3348) is amended— 
(1) by striking ‘‘Congress’’ each place it ap-
pears and inserting ‘‘the congressional oversight 
committees’’; 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
(2) in subsection (f)(1), by striking ‘‘appro-
priate oversight committees’’ and inserting ‘‘congres-
sional oversight committees’’; and 
(3) in subsection (g)— 
(A) by redesignating paragraphs (1) and 
(2) as paragraphs (2) and (3), respectively; and 
(B) by inserting before paragraph (2), as 
so redesignated, the following: 
‘‘(1) CONGRESSIONAL
OVERSIGHT
COMMIT-
TEES.—The term ‘congressional oversight commit-
tees’ means— 
‘‘(A) congressional leadership and author-
izing and appropriations congressional commit-
tees with jurisdiction or shared jurisdiction over 
a department or agency; 
‘‘(B) the Committee on Homeland Security 
and Governmental Affairs of the Senate; and 
‘‘(C) the Committee on Oversight and Gov-
ernment Reform of the House of Representa-
tives.’’. 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
TITLE 
II—FEDERAL 
ACQUISI-
TION SUPPLY CHAIN SECU-
RITY 
SEC. 201. SHORT TITLE. 
This title may be cited as the ‘‘Federal Acquisition 
Supply Chain Security Act of 2018’’. 
SEC. 202. FEDERAL ACQUISITION SUPPLY CHAIN SECURITY. 
(a) IN GENERAL.—Chapter 13 of title 41, United 
States Code, is amended by adding at the end the fol-
lowing new subchapter: 
‘‘SUBCHAPTER III—FEDERAL ACQUISITION 
SUPPLY CHAIN SECURITY 
‘‘§ 1321. Definitions 
‘‘In this subchapter: 
‘‘(1) APPROPRIATE
CONGRESSIONAL
COMMIT-
TEES
AND
LEADERSHIP.—The term ‘appropriate 
congressional committees and leadership’ means— 
‘‘(A) the Committee on Homeland Security 
and Governmental Affairs, the Committee on 
the Judiciary, the Committee on Appropria-
tions, the Committee on Armed Services, the 
Committee on Commerce, Science, and Trans-
portation, the Select Committee on Intelligence, 
and the majority and minority leader of the 
Senate; and 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
term in section 3(4) of the National Security Act of 
1947 (50 U.S.C. 3003(4)). 
‘‘(7) NATIONAL SECURITY SYSTEM.—The term 
‘national security system’ has the meaning given 
that term in section 3552 of title 44. 
‘‘(8) SUPPLY CHAIN RISK.—The term ‘supply 
chain risk’ has the meaning given that term in sec-
tion 4713 of this title. 
‘‘§ 1322. Federal Acquisition Security Council estab-
lishment and membership 
‘‘(a) ESTABLISHMENT.—There is established in the 
executive branch a Federal Acquisition Security Council. 
‘‘(b) MEMBERSHIP.— 
‘‘(1) IN
GENERAL.—The following agencies 
shall be represented on the Council: 
‘‘(A) The Office of Management and 
Budget. 
‘‘(B) The General Services Administration. 
‘‘(C) The Department of Homeland Secu-
rity, including the Cybersecurity and Infra-
structure Security Agency. 
‘‘(D) The Office of the Director of Na-
tional Intelligence, including the National Coun-
terintelligence and Security Center. 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
‘‘(E) The Department of Justice, including 
the Federal Bureau of Investigation. 
‘‘(F) The Department of Defense, includ-
ing the National Security Agency. 
‘‘(G) The Department of Commerce, in-
cluding the National Institute of Standards and 
Technology. 
‘‘(H) Such other executive agencies as de-
termined by the Chairperson of the Council. 
‘‘(2) LEAD REPRESENTATIVES.— 
‘‘(A) DESIGNATION.— 
‘‘(i) IN GENERAL.—Not later than 45 
days after the date of the enactment of the 
Federal Acquisition Supply Chain Security 
Act of 2018, the head of each agency rep-
resented on the Council shall designate a 
representative of that agency as the lead 
representative of the agency on the Coun-
cil. 
‘‘(ii) 
REQUIREMENTS.—The 
rep-
resentative of an agency designated under 
clause (i) shall have expertise in supply 
chain risk management, acquisitions, or in-
formation and communications technology. 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
‘‘(B) FUNCTIONS.—The lead representa-
tive of an agency designated under subpara-
graph (A) shall ensure that appropriate per-
sonnel, including leadership and subject matter 
experts of the agency, are aware of the business 
of the Council. 
‘‘(c) CHAIRPERSON.— 
‘‘(1) DESIGNATION.—Not later than 45 days 
after the date of the enactment of the Federal Ac-
quisition Supply Chain Security Act of 2018, the Di-
rector of the Office of Management and Budget 
shall designate a senior-level official from the Office 
of Management and Budget to serve as the Chair-
person of the Council. 
‘‘(2) FUNCTIONS.—The Chairperson shall per-
form functions that include— 
‘‘(A) subject to subsection (d), developing 
a schedule for meetings of the Council; 
‘‘(B) designating executive agencies to be 
represented on the Council under subsection 
(b)(1)(H); 
‘‘(C) in consultation with the lead rep-
resentative of each agency represented on the 
Council, developing a charter for the Council; 
and 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
‘‘(D) not later than 7 days after comple-
tion of the charter, submitting the charter to 
the appropriate congressional committees and 
leadership. 
‘‘(d) MEETINGS.—The Council shall meet not later 
than 60 days after the date of the enactment of the Fed-
eral Acquisition Supply Chain Security Act of 2018 and 
not less frequently than quarterly thereafter. 
‘‘§ 1323. Functions and authorities 
‘‘(a) IN GENERAL.—The Council shall perform func-
tions that include the following: 
‘‘(1) Identifying and recommending develop-
ment by the National Institute of Standards and 
Technology of supply chain risk management stand-
ards, guidelines, and practices for executive agencies 
to use when assessing and developing mitigation 
strategies to address supply chain risks, particularly 
in the acquisition and use of covered articles under 
section 1326(a) of this title. 
‘‘(2) Identifying or developing criteria for shar-
ing information with executive agencies, other Fed-
eral entities, and non-Federal entities with respect to 
supply chain risk, including information related to 
the exercise of authorities provided under this sec-
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
tion and sections 1326 and 4713 of this title. At a 
minimum, such criteria shall address— 
‘‘(A) the content to be shared; 
‘‘(B) the circumstances under which shar-
ing is mandated or voluntary; and 
‘‘(C) the circumstances under which it is 
appropriate for an executive agency to rely on 
information made available through such shar-
ing in exercising the responsibilities and au-
thorities provided under this section and section 
4713 of this title. 
‘‘(3) Identifying an appropriate executive agen-
cy to— 
‘‘(A) accept information submitted by exec-
utive agencies based on the criteria established 
under paragraph (2); 
‘‘(B) facilitate the sharing of information 
received under subparagraph (A) to support 
supply chain risk analyses under section 1326 
of this title, recommendations under this sec-
tion, and covered procurement actions under 
section 4713 of this title; 
‘‘(C) share with the Council information 
regarding covered procurement actions by exec-
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
utive agencies taken under section 4713 of this 
title; and 
‘‘(D) inform the Council of orders issued 
under this section. 
‘‘(4) Identifying, as appropriate, executive agen-
cies to provide— 
‘‘(A) shared services, such as support for 
making risk assessments, validation of products 
that may be suitable for acquisition, and miti-
gation activities; and 
‘‘(B) common contract solutions to support 
supply chain risk management activities, such 
as subscription services or machine-learning-en-
hanced analysis applications to support in-
formed decision making. 
‘‘(5) Identifying and issuing guidance on addi-
tional steps that may be necessary to address supply 
chain risks arising in the course of executive agen-
cies providing shared services, common contract so-
lutions, acquisitions vehicles, or assisted acquisitions. 
‘‘(6) Engaging with the private sector and other 
nongovernmental stakeholders in performing the 
functions described in paragraphs (1) and (2) and 
on issues relating to the management of supply 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
chain risks posed by the acquisition of covered arti-
cles. 
‘‘(7) Carrying out such other actions, as deter-
mined by the Council, that are necessary to reduce 
the supply chain risks posed by acquisitions and use 
of covered articles. 
‘‘(b) PROGRAM OFFICE
AND COMMITTEES.—The 
Council may establish a program office and any commit-
tees, working groups, or other constituent bodies the 
Council deems appropriate, in its sole and unreviewable 
discretion, to carry out its functions. 
‘‘(c) AUTHORITY FOR EXCLUSION OR REMOVAL OR-
DERS.— 
‘‘(1) CRITERIA.—To reduce supply chain risk, 
the Council shall establish criteria and procedures 
for— 
‘‘(A) recommending orders applicable to 
executive agencies requiring the exclusion of 
sources or covered articles from executive agen-
cy procurement actions (in this section referred 
to as ‘exclusion orders’); 
‘‘(B) recommending orders applicable to 
executive agencies requiring the removal of cov-
ered articles from executive agency information 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
systems (in this section referred to as ‘removal 
orders’); 
‘‘(C) requesting and approving exceptions 
to an issued exclusion or removal order when 
warranted by circumstances, including alter-
native mitigation actions or other findings relat-
ing to the national interest, including national 
security reviews, national security investiga-
tions, or national security agreements; and 
‘‘(D) ensuring that recommended orders do 
not conflict with standards and guidelines 
issued under section 11331 of title 40 and that 
the Council consults with the Director of the 
National Institute of Standards and Technology 
regarding any recommended orders that would 
implement standards and guidelines developed 
by the National Institute of Standards and 
Technology. 
‘‘(2) RECOMMENDATIONS.—The Council shall 
use the criteria established under paragraph (1), in-
formation made available under subsection (a)(3), 
and any other information the Council determines 
appropriate to issue recommendations, for applica-
tion to executive agencies or any subset thereof, re-
garding the exclusion of sources or covered articles 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
from any executive agency procurement action, in-
cluding source selection and consent for a contractor 
to subcontract, or the removal of covered articles 
from executive agency information systems. Such 
recommendations shall include— 
‘‘(A) information necessary to positively 
identify the sources or covered articles rec-
ommended for exclusion or removal; 
‘‘(B) information regarding the scope and 
applicability of the recommended exclusion or 
removal order; 
‘‘(C) a summary of any risk assessment re-
viewed or conducted in support of the rec-
ommended exclusion or removal order; 
‘‘(D) a summary of the basis for the rec-
ommendation, including a discussion of less in-
trusive measures that were considered and why 
such measures were not reasonably available to 
reduce supply chain risk; 
‘‘(E) a description of the actions necessary 
to implement the recommended exclusion or re-
moval order; and 
‘‘(F) where practicable, in the Council’s 
sole and unreviewable discretion, a description 
of mitigation steps that could be taken by the 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
source that may result in the Council rescinding 
a recommendation. 
‘‘(3) NOTICE OF RECOMMENDATION AND RE-
VIEW.—A notice of the Council’s recommendation 
under paragraph (2) shall be issued to any source 
named in the recommendation advising— 
‘‘(A) that a recommendation has been 
made; 
‘‘(B) of the criteria the Council relied upon 
under paragraph (1) and, to the extent con-
sistent with national security and law enforce-
ment interests, of information that forms the 
basis for the recommendation; 
‘‘(C) that, within 30 days after receipt of 
notice, the source may submit information and 
argument in opposition to the recommendation; 
‘‘(D) of the procedures governing the re-
view and possible issuance of an exclusion or re-
moval order pursuant to paragraph (5); and 
‘‘(E) where practicable, in the Council’s 
sole and unreviewable discretion, a description 
of mitigation steps that could be taken by the 
source that may result in the Council rescinding 
the recommendation. 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
‘‘(4) CONFIDENTIALITY.—Any notice issued to 
a source under paragraph (3) shall be kept confiden-
tial until— 
‘‘(A) an exclusion or removal order is 
issued pursuant to paragraph (5); and 
‘‘(B) the source has been notified pursuant 
to paragraph (6). 
‘‘(5) EXCLUSION AND REMOVAL ORDERS.— 
‘‘(A) 
ORDER
ISSUANCE.—Recommenda-
tions of the Council under paragraph (2), to-
gether with any information submitted by a 
source under paragraph (3) related to such a 
recommendation, shall be reviewed by the fol-
lowing officials, who may issue exclusion and 
removal orders based upon such recommenda-
tions: 
‘‘(i) The Secretary of Homeland Secu-
rity, for exclusion and removal orders ap-
plicable to civilian agencies, to the extent 
not covered by clause (ii) or (iii). 
‘‘(ii) The Secretary of Defense, for ex-
clusion and removal orders applicable to 
the Department of Defense and national 
security systems other than sensitive com-
partmented information systems. 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
‘‘(iii) The Director of National Intel-
ligence, for exclusion and removal orders 
applicable to the intelligence community 
and sensitive compartmented information 
systems, to the extent not covered by 
clause (ii). 
‘‘(B) DELEGATION.—The officials identi-
fied in subparagraph (A) may not delegate any 
authority under this subparagraph to an official 
below the level one level below the Deputy Sec-
retary or Principal Deputy Director, except that 
the Secretary of Defense may delegate author-
ity for removal orders to the Commander of the 
United States Cyber Command, who may not 
redelegate such authority to an official below 
the level one level below the Deputy Com-
mander. 
‘‘(C) FACILITATION
OF
EXCLUSION
OR-
DERS.—If officials identified under this para-
graph from the Department of Homeland Secu-
rity, the Department of Defense, and the Office 
of the Director of National Intelligence issue or-
ders collectively resulting in a governmentwide 
exclusion, the Administrator for General Serv-
ices and officials at other executive agencies re-
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
sponsible for management of the Federal Sup-
ply Schedules, governmentwide acquisition con-
tracts and multi-agency contracts shall help fa-
cilitate implementation of such orders by re-
moving the covered articles or sources identified 
in the orders from such contracts. 
‘‘(D) REVIEW
OF
EXCLUSION
AND
RE-
MOVAL ORDERS.—The officials identified under 
this paragraph shall review all exclusion and re-
moval orders issued under subparagraph (A) 
not less frequently than annually pursuant to 
procedures established by the Council. 
‘‘(E) RESCISSION.—Orders issued pursu-
ant to subparagraph (A) may be rescinded by 
an authorized official from the relevant issuing 
agency. 
‘‘(6) NOTIFICATIONS.—Upon issuance of an ex-
clusion or removal order pursuant to paragraph 
(5)(A), the official identified under that paragraph 
who issued the order shall— 
‘‘(A) notify any source named in the order 
of— 
‘‘(i) the exclusion or removal order; 
and 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
‘‘(ii) to the extent consistent with na-
tional security and law enforcement inter-
ests, information that forms the basis for 
the order; 
‘‘(B) provide classified or unclassified no-
tice of the exclusion or removal order to the ap-
propriate congressional committees and leader-
ship; and 
‘‘(C) provide the exclusion or removal 
order to the agency identified in subsection 
(a)(3). 
‘‘(7) COMPLIANCE.—Executive agencies shall 
comply with exclusion and removal orders issued 
pursuant to paragraph (5). 
‘‘(d) AUTHORITY TO REQUEST INFORMATION.—The 
Council may request such information from executive 
agencies as is necessary for the Council to carry out its 
functions. 
‘‘(e) RELATIONSHIP
TO OTHER COUNCILS.—The 
Council shall consult and coordinate, as appropriate, with 
other relevant councils and interagency committees, in-
cluding the Chief Information Officers Council, the Chief 
Acquisition Officers Council, the Federal Acquisition Reg-
ulatory Council, and the Committee on Foreign Invest-
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
ment in the United States, with respect to supply chain 
risks posed by the acquisition and use of covered articles. 
‘‘(f) RULES
OF CONSTRUCTION.—Nothing in this 
section shall be construed— 
‘‘(1) to limit the authority of the Office of Fed-
eral Procurement Policy to carry out the responsibil-
ities of that Office under any other provision of law; 
or 
‘‘(2) to authorize the issuance of an exclusion 
or removal order based solely on the fact of foreign 
ownership of a potential procurement source that is 
otherwise qualified to enter into procurement con-
tracts with the Federal Government. 
‘‘§ 1324. Strategic plan 
‘‘(a) IN GENERAL.—Not later than 180 days after 
the date of the enactment of the Federal Acquisition Sup-
ply Chain Security Act of 2018, the Council shall develop 
a strategic plan for addressing supply chain risks posed 
by the acquisition of covered articles and for managing 
such risks that includes— 
‘‘(1) the criteria and processes required under 
section 1323(a) of this title, including a threshold 
and requirements for sharing relevant information 
about such risks with all executive agencies and, as 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
appropriate, with other Federal entities and non- 
Federal entities; 
‘‘(2) an identification of existing authorities for 
addressing such risks; 
‘‘(3) an identification and promulgation of best 
practices and procedures and available resources for 
executive agencies to assess and mitigate such risks; 
‘‘(4) recommendations for any legislative, regu-
latory, or other policy changes to improve efforts to 
address such risks; 
‘‘(5) recommendations for any legislative, regu-
latory, or other policy changes to incentivize the 
adoption of best practices for supply chain risk man-
agement by the private sector; 
‘‘(6) an evaluation of the effect of implementing 
new policies or procedures on existing contracts and 
the procurement process; 
‘‘(7) a plan for engaging with executive agen-
cies, the private sector, and other nongovernmental 
stakeholders to address such risks; 
‘‘(8) a plan for identification, assessment, miti-
gation, and vetting of supply chain risks from exist-
ing and prospective information and communications 
technology made available by executive agencies to 
other executive agencies through common contract 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
solutions, shared services, acquisition vehicles, or 
other assisted acquisition services; and 
‘‘(9) plans to strengthen the capacity of all ex-
ecutive agencies to conduct assessments of— 
‘‘(A) the supply chain risk posed by the ac-
quisition of covered articles; and 
‘‘(B) compliance with the requirements of 
this subchapter. 
‘‘(b) SUBMISSION TO CONGRESS.—Not later than 7 
calendar days after completion of the strategic plan re-
quired by subsection (a), the Chairperson of the Council 
shall submit the plan to the appropriate congressional 
committees and leadership. 
‘‘§ 1325. Annual report 
‘‘Not later than December 31 of each year, the Chair-
person of the Council shall submit to the appropriate con-
gressional committees and leadership a report on the ac-
tivities of the Council during the preceding 12-month pe-
riod. 
‘‘§ 1326. Requirements for executive agencies 
‘‘(a) IN GENERAL.—The head of each executive agen-
cy shall be responsible for— 
‘‘(1) assessing the supply chain risk posed by 
the acquisition and use of covered articles and avoid-
ing, mitigating, accepting, or transferring that risk, 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
as appropriate and consistent with the standards, 
guidelines, and practices identified by the Council 
under section 1323(a)(1); and 
‘‘(2) prioritizing supply chain risk assessments 
conducted under paragraph (1) based on the criti-
cality of the mission, system, component, service, or 
asset. 
‘‘(b) INCLUSIONS.—The responsibility for assessing 
supply chain risk described in subsection (a) includes— 
‘‘(1) developing an overall supply chain risk 
management strategy and implementation plan and 
policies and processes to guide and govern supply 
chain risk management activities; 
‘‘(2) integrating supply chain risk management 
practices throughout the life cycle of the system, 
component, service, or asset; 
‘‘(3) limiting, avoiding, mitigating, accepting, or 
transferring any identified risk; 
‘‘(4) sharing relevant information with other ex-
ecutive agencies as determined appropriate by the 
Council in a manner consistent with section 1323(a) 
of this title; 
‘‘(5) reporting on progress and effectiveness of 
the agency’s supply chain risk management con-
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
sistent with guidance issued by the Office of Man-
agement and Budget and the Council; and 
‘‘(6) ensuring that all relevant information, in-
cluding classified information, with respect to acqui-
sitions of covered articles that may pose a supply 
chain risk, consistent with section 1323(a) of this 
title, is incorporated into existing processes of the 
agency for conducting assessments described in sub-
section (a) and ongoing management of acquisition 
programs, including any identification, investigation, 
mitigation, or remediation needs. 
‘‘(c) INTERAGENCY ACQUISITIONS.— 
‘‘(1) IN GENERAL.—Except as provided in para-
graph (2), in the case of an interagency acquisition, 
subsection (a) shall be carried out by the head of the 
executive agency whose funds are being used to pro-
cure the covered article. 
‘‘(2) ASSISTED ACQUISITIONS.—In an assisted 
acquisition, the parties to the acquisition shall deter-
mine, as part of the interagency agreement gov-
erning the acquisition, which agency is responsible 
for carrying out subsection (a). 
‘‘(3) DEFINITIONS.—In this subsection, the 
terms ‘assisted acquisition’ and ‘interagency acquisi-
tion’ have the meanings given those terms in section 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
2.101 of title 48, Code of Federal Regulations (or 
any corresponding similar regulation or ruling). 
‘‘(d) ASSISTANCE.—The Secretary of Homeland Se-
curity may— 
‘‘(1) assist executive agencies in conducting risk 
assessments described in subsection (a) and imple-
menting mitigation requirements for information 
and communications technology; and 
‘‘(2) provide such additional guidance or tools 
as are necessary to support actions taken by execu-
tive agencies. 
‘‘§ 1327. Judicial review procedures 
‘‘(a) IN GENERAL.—Except as provided in subsection 
(b) and chapter 71 of this title, and notwithstanding any 
other provision of law, an action taken under section 1323 
or 4713 of this title, or any action taken by an executive 
agency to implement such an action, shall not be subject 
to administrative review or judicial review, including bid 
protests before the Government Accountability Office or 
in any Federal court. 
‘‘(b) PETITIONS.— 
‘‘(1) IN
GENERAL.—Not later than 60 days 
after a party is notified of an exclusion or removal 
order under section 1323(c)(6) of this title or a cov-
ered procurement action under section 4713 of this 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
title, the party may file a petition for judicial review 
in the United States Court of Appeals for the Dis-
trict of Columbia Circuit claiming that the issuance 
of the exclusion or removal order or covered procure-
ment action is unlawful. 
‘‘(2) STANDARD OF REVIEW.—The Court shall 
hold unlawful a covered action taken under sections 
1323 or 4713 of this title, in response to a petition 
that the court finds to be— 
‘‘(A) arbitrary, capricious, an abuse of dis-
cretion, or otherwise not in accordance with 
law; 
‘‘(B) contrary to constitutional right, 
power, privilege, or immunity; 
‘‘(C) in excess of statutory jurisdiction, au-
thority, or limitation, or short of statutory 
right; 
‘‘(D) lacking substantial support in the ad-
ministrative record taken as a whole or in clas-
sified information submitted to the court under 
paragraph (3); or 
‘‘(E) not in accord with procedures re-
quired by law. 
‘‘(3) EXCLUSIVE
JURISDICTION.—The United 
States Court of Appeals for the District of Columbia 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
Circuit shall have exclusive jurisdiction over claims 
arising under sections 1323(c)(5) or 4713 of this 
title against the United States, any United States 
department or agency, or any component or official 
of any such department or agency, subject to review 
by the Supreme Court of the United States under 
section 1254 of title 28. 
‘‘(4) ADMINISTRATIVE
RECORD
AND
PROCE-
DURES.— 
‘‘(A) IN
GENERAL.—The procedures de-
scribed in this paragraph shall apply to the re-
view of a petition under this section. 
‘‘(B) ADMINISTRATIVE RECORD.— 
‘‘(i) FILING OF RECORD.—The United 
States shall file with the court an adminis-
trative record, which shall consist of the 
information that the appropriate official 
relied upon in issuing an exclusion or re-
moval order under section 1323(c)(5) or a 
covered procurement action under section 
4713 of this title. 
‘‘(ii) UNCLASSIFIED, NONPRIVILEGED 
INFORMATION.—All unclassified informa-
tion contained in the administrative record 
that is not otherwise privileged or subject 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
to statutory protections shall be provided 
to the petitioner with appropriate protec-
tions for any privileged or confidential 
trade secrets and commercial or financial 
information. 
‘‘(iii) IN CAMERA AND EX PARTE.— 
The following information may be included 
in the administrative record and shall be 
submitted only to the court ex parte and in 
camera: 
‘‘(I) Classified information. 
‘‘(II) Sensitive security informa-
tion, as defined by section 1520.5 of 
title 49, Code of Federal Regulations. 
‘‘(III) Privileged law enforcement 
information. 
‘‘(IV) Information obtained or 
derived from any activity authorized 
under the Foreign Intelligence Sur-
veillance Act of 1978 (50 U.S.C. 1801 
et seq.), except that, with respect to 
such information, subsections (c), (e), 
(f), (g), and (h) of section 106 (50 
U.S.C. 1806), subsections (d), (f), (g), 
(h), and (i) of section 305 (50 U.S.C. 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
1825), subsections (c), (e), (f), (g), 
and (h) of section 405 (50 U.S.C. 
1845), and section 706 (50 U.S.C. 
1881e) of that Act shall not apply. 
‘‘(V) Information subject to privi-
lege or protections under any other 
provision of law. 
‘‘(iv) UNDER SEAL.—Any information 
that is part of the administrative record 
filed ex parte and in camera under clause 
(iii), or cited by the court in any decision, 
shall be treated by the court consistent 
with the provisions of this subparagraph 
and shall remain under seal and preserved 
in the records of the court to be made 
available consistent with the above provi-
sions in the event of further proceedings. 
In no event shall such information be re-
leased to the petitioner or as part of the 
public record. 
‘‘(v) RETURN.—After the expiration 
of the time to seek further review, or the 
conclusion of further proceedings, the 
court shall return the administrative 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
record, including any and all copies, to the 
United States. 
‘‘(C) EXCLUSIVE REMEDY.—A determina-
tion by the court under this subsection shall be 
the exclusive judicial remedy for any claim de-
scribed in this section against the United 
States, any United States department or agen-
cy, or any component or official of any such de-
partment or agency. 
‘‘(D) RULE OF CONSTRUCTION.—Nothing 
in this section shall be construed as limiting, 
superseding, or preventing the invocation of, 
any privileges or defenses that are otherwise 
available at law or in equity to protect against 
the disclosure of information. 
‘‘(c) DEFINITION.—In this section, the term ‘classi-
fied information’— 
‘‘(1) has the meaning given that term in section 
1(a) of the Classified Information Procedures Act 
(18 U.S.C. App.); and 
‘‘(2) includes— 
‘‘(A) any information or material that has 
been determined by the United States Govern-
ment pursuant to an Executive order, statute, 
or regulation to require protection against un-
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
authorized disclosure for reasons of national se-
curity; and 
‘‘(B) any restricted data, as defined in sec-
tion 11 of the Atomic Energy Act of 1954 (42 
U.S.C. 2014). 
‘‘§ 1328. Termination 
‘‘This subchapter shall terminate on the date that is 
5 years after the date of the enactment of the Federal 
Acquisition Supply Chain Security Act of 2018.’’. 
(b) CLERICAL AMENDMENT.—The table of sections 
at the beginning of chapter 13 of such title is amended 
by adding at the end the following new items: 
‘‘SUBCHAPTER III—FEDERAL ACQUISITION SUPPLY CHAIN SECURITY 
‘‘Sec. 
‘‘1321. Definitions. 
‘‘1322. Federal Acquisition Security Council establishment and membership. 
‘‘1323. Functions and authorities. 
‘‘1324. Strategic plan. 
‘‘1325. Annual report. 
‘‘1326. Requirements for executive agencies. 
‘‘1327. Judicial review procedures. 
‘‘1328. Termination.’’. 
(c) EFFECTIVE DATE.—The amendments made by 
this section shall take effect on the date that is 90 days 
after the date of the enactment of this Act and shall apply 
to contracts that are awarded before, on, or after that 
date. 
(d) IMPLEMENTATION.— 
(1) INTERIM FINAL RULE.—Not later than one 
year after the date of the enactment of this Act, the 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
Federal Acquisition Security Council shall prescribe 
an interim final rule to implement subchapter III of 
chapter 13 of title 41, United States Code, as added 
by subsection (a). 
(2) FINAL
RULE.—Not later than one year 
after prescribing the interim final rule under para-
graph (1) and considering public comments with re-
spect to such interim final rule, the Council shall 
prescribe a final rule to implement subchapter III of 
chapter 13 of title 41, United States Code, as added 
by subsection (a). 
(3) FAILURE TO ACT.— 
(A) IN GENERAL.—If the Council does not 
issue a final rule in accordance with paragraph 
(2) on or before the last day of the one-year pe-
riod referred to in that paragraph, the Council 
shall submit to the appropriate congressional 
committees and leadership, not later than 10 
days after such last day and every 90 days 
thereafter until the final rule is issued, a report 
explaining why the final rule was not timely 
issued and providing an estimate of the earliest 
date on which the final rule will be issued. 
(B) APPROPRIATE
CONGRESSIONAL
COM-
MITTEES AND LEADERSHIP DEFINED.—In this 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
paragraph, the term ‘‘appropriate congressional 
committees and leadership’’ has the meaning 
given that term in section 1321 of title 41, 
United States Code, as added by subsection (a). 
SEC. 203. AUTHORITIES OF EXECUTIVE AGENCIES RELAT-
ING TO MITIGATING SUPPLY CHAIN RISKS IN 
THE PROCUREMENT OF COVERED ARTICLES. 
(a) IN GENERAL.—Chapter 47 of title 41, United 
States Code, is amended by adding at the end the fol-
lowing new section: 
‘‘§ 4713. Authorities relating to mitigating supply 
chain risks in the procurement of cov-
ered articles 
‘‘(a) AUTHORITY.—Subject to subsection (b), the 
head of an executive agency may carry out a covered pro-
curement action. 
‘‘(b) DETERMINATION AND NOTIFICATION.—Except 
as authorized by subsection (c) to address an urgent na-
tional security interest, the head of an executive agency 
may exercise the authority provided in subsection (a) only 
after— 
‘‘(1) obtaining a joint recommendation, in un-
classified or classified form, from the chief acquisi-
tion officer and the chief information officer of the 
agency, or officials performing similar functions in 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
the case of executive agencies that do not have such 
officials, which includes a review of any risk assess-
ment made available by the executive agency identi-
fied under section 1323(a)(3) of this title, that there 
is a significant supply chain risk in a covered pro-
curement; 
‘‘(2) providing notice of the joint recommenda-
tion described in paragraph (1) to any source named 
in the joint recommendation advising— 
‘‘(A) that a recommendation is being con-
sidered or has been obtained; 
‘‘(B) to the extent consistent with the na-
tional security and law enforcement interests, of 
information that forms the basis for the rec-
ommendation; 
‘‘(C) that, within 30 days after receipt of 
the notice, the source may submit information 
and argument in opposition to the recommenda-
tion; and 
‘‘(D) of the procedures governing the con-
sideration of the submission and the possible 
exercise of the authority provided in subsection 
(a); 
‘‘(3) making a determination in writing, in un-
classified or classified form, after considering any in-
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
formation submitted by a source under paragraph 
(2) and in consultation with the chief information 
security officer of the agency, that— 
‘‘(A) use of the authority under subsection 
(a) is necessary to protect national security by 
reducing supply chain risk; 
‘‘(B) less intrusive measures are not rea-
sonably available to reduce such supply chain 
risk; and 
‘‘(C) the use of such authorities will apply 
to a single covered procurement or a class of 
covered procurements, and otherwise specifies 
the scope of the determination; and 
‘‘(4) providing a classified or unclassified notice 
of the determination made under paragraph (3) to 
the appropriate congressional committees and lead-
ership that includes— 
‘‘(A) the joint recommendation described 
in paragraph (1); 
‘‘(B) a summary of any risk assessment re-
viewed in support of the joint recommendation 
required by paragraph (1); and 
‘‘(C) a summary of the basis for the deter-
mination, including a discussion of less intru-
sive measures that were considered and why 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
such measures were not reasonably available to 
reduce supply chain risk. 
‘‘(c) PROCEDURES TO ADDRESS URGENT NATIONAL 
SECURITY INTERESTS.—In any case in which the head of 
an executive agency determines that an urgent national 
security interest requires the immediate exercise of the au-
thority provided in subsection (a), the head of the agen-
cy— 
‘‘(1) may, to the extent necessary to address 
such national security interest, and subject to the 
conditions in paragraph (2)— 
‘‘(A) temporarily delay the notice required 
by subsection (b)(2); 
‘‘(B) make the determination required by 
subsection (b)(3), regardless of whether the no-
tice required by subsection (b)(2) has been pro-
vided or whether the notified source has sub-
mitted any information in response to such no-
tice; 
‘‘(C) temporarily delay the notice required 
by subsection (b)(4); and 
‘‘(D) exercise the authority provided in 
subsection (a) in accordance with such deter-
mination within 60 calendar days after the day 
the determination is made; and 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
‘‘(2) shall take actions necessary to comply with 
all requirements of subsection (b) as soon as prac-
ticable after addressing the urgent national security 
interest, including— 
‘‘(A) providing the notice required by sub-
section (b)(2); 
‘‘(B) promptly considering any information 
submitted by the source in response to such no-
tice, and making any appropriate modifications 
to the determination based on such information; 
‘‘(C) providing the notice required by sub-
section (b)(4), including a description of the ur-
gent national security interest, and any modi-
fications to the determination made in accord-
ance with subparagraph (B); and 
‘‘(D) providing notice to the appropriate 
congressional committees and leadership within 
7 calendar days of the covered procurement ac-
tions taken under this section. 
‘‘(d) CONFIDENTIALITY.—The notice required by 
subsection (b)(2) shall be kept confidential until a deter-
mination with respect to a covered procurement action has 
been made pursuant to subsection (b)(3). 
‘‘(e) DELEGATION.—The head of an executive agency 
may not delegate the authority provided in subsection (a) 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
or the responsibility identified in subsection (f) to an offi-
cial below the level one level below the Deputy Secretary 
or Principal Deputy Director. 
‘‘(f) ANNUAL REVIEW OF DETERMINATIONS.—The 
head of an executive agency shall conduct an annual re-
view of all determinations made by such head under sub-
section (b) and promptly amend any covered procurement 
action as appropriate. 
‘‘(g) REGULATIONS.—The Federal Acquisition Regu-
latory Council shall prescribe such regulations as may be 
necessary to carry out this section. 
‘‘(h) REPORTS REQUIRED.—Not less frequently than 
annually, the head of each executive agency that exercised 
the authority provided in subsection (a) or (c) during the 
preceding 12-month period shall submit to the appropriate 
congressional committees and leadership a report summa-
rizing the actions taken by the agency under this section 
during that 12-month period. 
‘‘(i) RULE OF CONSTRUCTION.—Nothing in this sec-
tion shall be construed to authorize the head of an execu-
tive agency to carry out a covered procurement action 
based solely on the fact of foreign ownership of a potential 
procurement source that is otherwise qualified to enter 
into procurement contracts with the Federal Government. 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
‘‘(j) TERMINATION.—The authority provided under 
subsection (a) shall terminate on the date that is 5 years 
after the date of the enactment of the Federal Acquisition 
Supply Chain Security Act of 2018. 
‘‘(k) DEFINITIONS.—In this section: 
‘‘(1) APPROPRIATE
CONGRESSIONAL
COMMIT-
TEES
AND
LEADERSHIP.—The term ‘appropriate 
congressional committees and leadership’ means— 
‘‘(A) the Committee on Homeland Security 
and Governmental Affairs, the Committee on 
the Judiciary, the Committee on Appropria-
tions, the Committee on Armed Services, the 
Committee on Commerce, Science, and Trans-
portation, the Select Committee on Intelligence, 
and the majority and minority leader of the 
Senate; and 
‘‘(B) the Committee on Oversight and Gov-
ernment Reform, the Committee on the Judici-
ary, the Committee on Appropriations, the 
Committee on Homeland Security, the Com-
mittee on Armed Services, the Committee on 
Energy and Commerce, the Permanent Select 
Committee on Intelligence, and the Speaker and 
minority leader of the House of Representa-
tives. 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
‘‘(2) COVERED
ARTICLE.—The term ‘covered 
article’ means— 
‘‘(A) information technology, as defined in 
section 11101 of title 40, including cloud com-
puting services of all types; 
‘‘(B) telecommunications equipment or 
telecommunications service, as those terms are 
defined in section 3 of the Communications Act 
of 1934 (47 U.S.C. 153); 
‘‘(C) the processing of information on a 
Federal or non-Federal information system, 
subject to the requirements of the Controlled 
Unclassified Information program; or 
‘‘(D) hardware, systems, devices, software, 
or services that include embedded or incidental 
information technology. 
‘‘(3) COVERED PROCUREMENT.—The term ‘cov-
ered procurement’ means— 
‘‘(A) a source selection for a covered arti-
cle involving either a performance specification, 
as provided in subsection (a)(3)(B) of section 
3306 of this title, or an evaluation factor, as 
provided in subsection (b)(1)(A) of such section, 
relating to a supply chain risk, or where supply 
chain risk considerations are included in the 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
agency’s determination of whether a source is a 
responsible source as defined in section 113 of 
this title; 
‘‘(B) the consideration of proposals for and 
issuance of a task or delivery order for a cov-
ered article, as provided in section 4106(d)(3) 
of this title, where the task or delivery order 
contract includes a contract clause establishing 
a requirement relating to a supply chain risk; 
‘‘(C) any contract action involving a con-
tract for a covered article where the contract in-
cludes a clause establishing requirements relat-
ing to a supply chain risk; or 
‘‘(D) any other procurement in a category 
of procurements determined appropriate by the 
Federal Acquisition Regulatory Council, with 
the advice of the Federal Acquisition Security 
Council. 
‘‘(4) COVERED
PROCUREMENT
ACTION.—The 
term ‘covered procurement action’ means any of the 
following actions, if the action takes place in the 
course of conducting a covered procurement: 
‘‘(A) The exclusion of a source that fails to 
meet qualification requirements established 
under section 3311 of this title for the purpose 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
of reducing supply chain risk in the acquisition 
or use of covered articles. 
‘‘(B) The exclusion of a source that fails to 
achieve an acceptable rating with regard to an 
evaluation factor providing for the consideration 
of supply chain risk in the evaluation of pro-
posals for the award of a contract or the 
issuance of a task or delivery order. 
‘‘(C) The determination that a source is 
not a responsible source as defined in section 
113 of this title based on considerations of sup-
ply chain risk. 
‘‘(D) The decision to withhold consent for 
a contractor to subcontract with a particular 
source or to direct a contractor to exclude a 
particular source from consideration for a sub-
contract under the contract. 
‘‘(5) 
INFORMATION
AND
COMMUNICATIONS 
TECHNOLOGY.—The term ‘information and commu-
nications technology’ means— 
‘‘(A) information technology, as defined in 
section 11101 of title 40; 
‘‘(B) information systems, as defined in 
section 3502 of title 44; and 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
‘‘(C) telecommunications equipment and 
telecommunications services, as those terms are 
defined in section 3 of the Communications Act 
of 1934 (47 U.S.C. 153). 
‘‘(6) SUPPLY CHAIN RISK.—The term ‘supply 
chain risk’ means the risk that any person may sab-
otage, maliciously introduce unwanted function, ex-
tract data, or otherwise manipulate the design, in-
tegrity, manufacturing, production, distribution, in-
stallation, operation, maintenance, disposition, or re-
tirement of covered articles so as to surveil, deny, 
disrupt, or otherwise manipulate the function, use, 
or operation of the covered articles or information 
stored or transmitted on the covered articles. 
‘‘(7) EXECUTIVE
AGENCY.—Notwithstanding 
section 3101(c)(1), this section applies to the De-
partment of Defense, the Coast Guard, and the Na-
tional Aeronautics and Space Administration.’’. 
(b) CLERICAL AMENDMENT.—The table of sections 
at the beginning of chapter 47 of such title is amended 
by adding at the end the following new item: 
‘‘4713. Authorities relating to mitigating supply chain risks in the procurement 
of covered articles.’’. 
(c) EFFECTIVE DATE.—The amendments made by 
this section shall take effect on the date that is 90 days 
after the date of the enactment of this Act and shall apply 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
to contracts that are awarded before, on, or after that 
date. 
SEC. 204. FEDERAL INFORMATION SECURITY MODERNIZA-
TION ACT. 
(a) IN GENERAL.—Title 44, United States Code, is 
amended— 
(1) in section 3553(a)(5), by inserting ‘‘and 
section 1326 of title 41’’ after ‘‘compliance with the 
requirements of this subchapter’’; and 
(2) in section 3554(a)(1)(B)— 
(A) by inserting ‘‘, subchapter III of chap-
ter 13 of title 41,’’ after ‘‘complying with the 
requirements of this subchapter’’; 
(B) in clause (iv), by striking ‘‘; and’’ and 
inserting a semicolon; and 
(C) by adding at the end the following new 
clause: 
‘‘(vi) responsibilities relating to as-
sessing and avoiding, mitigating, transfer-
ring, or accepting supply chain risks under 
section 1326 of title 41, and complying 
with exclusion and removal orders issued 
under section 1323 of such title; and’’. 
(b) RULE OF CONSTRUCTION.—Nothing in this title 
shall be construed to alter or impede any authority or re-
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS
HR 7327 RDS
sponsibility under section 3553 of title 44, United States 
Code. 
SEC. 205. EFFECTIVE DATE. 
This title shall take effect on the date that is 90 days 
after the date of the enactment of this Act. 
Passed the House of Representatives December 19, 
2018. 
Attest: 
KAREN L. HAAS, 
Clerk. 
VerDate Sep 11 2014 
21:13 Dec 20, 2018
Jkt 089200
PO 00000
Frm 00055
Fmt 6652
Sfmt 6201
E:\BILLS\H7327.RDS
H7327
kjohnson on DSK79L0C42 with BILLS