SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Securing the Home-
land Security Supply Chain Act of 2018’’. 
SEC. 2. DEPARTMENT OF HOMELAND SECURITY REQUIRE-
MENTS FOR INFORMATION RELATING TO 
SUPPLY CHAIN RISK. 
(a) IN GENERAL.—Subtitle D of title VIII of the 
Homeland Security Act of 2002 (6 U.S.C. 391 et seq.) 
is amended by adding at the end the following new section: 
‘‘SEC. 836. REQUIREMENTS FOR INFORMATION RELATING 
TO SUPPLY CHAIN RISK. 
‘‘(a) AUTHORITY.—Subject to subsection (b), the 
Secretary may— 
‘‘(1) carry out a covered procurement action; 
‘‘(2) limit, notwithstanding any other provision 
of law, in whole or in part, the disclosure of informa-
tion, including classified information, relating to the 
basis for carrying out such an action; and 
‘‘(3) exclude, in whole or in part, a source car-
ried out in the course of such an action applicable 
to a covered procurement of the Department. 
‘‘(b) DETERMINATION AND NOTIFICATION.—Except 
as authorized by subsection (c) to address an urgent na-
tional security interest, the Secretary may exercise the au-
thority provided in subsection (a) only after—
‘‘(1) obtaining a joint recommendation, in un-
classified or classified form, from the Chief Acquisi-
tion Officer and the Chief Information Officer of 
Department, including a review of any risk assess-
ment made available by an appropriate person or en-
tity, that there is a significant supply chain risk in 
a covered procurement; 
‘‘(2) notifying any source named in the joint 
recommendation described in paragraph (1) advis-
ing— 
‘‘(A) that a recommendation has been ob-
tained; 
‘‘(B) to the extent consistent with the na-
tional security and law enforcement interests, 
the basis for such recommendation; 
‘‘(C) that, within 30 days after receipt of 
notice, such source may submit information and 
argument in opposition to such recommenda-
tion; and 
‘‘(D) of the procedures governing the con-
sideration of such submission and the possible 
exercise of the authority provided in subsection 
(a); 
‘‘(3) notifying the relevant components of the 
Department that such risk assessment has dem-
onstrated significant supply chain risk to a covered 
procurement; and 
‘‘(4) making a determination in writing, in un-
classified or classified form, that after considering 
any information submitted by a source under para-
graph (2), and in consultation with the Chief Infor-
mation Officer of the Department, that— 
‘‘(A) use of authority under subsection 
(a)(1) is necessary to protect national security 
by reducing supply chain risk; 
‘‘(B) less intrusive measures are not rea-
sonably available to reduce such risk; 
‘‘(C) a decision to limit disclosure of infor-
mation under subsection (a)(2) is necessary to 
protect national security interest; and 
‘‘(D) the use of such authorities will apply 
to a single covered procurement or a class of 
covered procurements, and otherwise specifies 
the scope of such determination; 
‘‘(5) providing to the Committee on Homeland 
Security of the House of Representatives and the 
Committee on Homeland Security and Governmental 
Affairs of the Senate a classified or unclassified no-
tice of the determination made under paragraph (4) 
that includes—
‘‘(A) the joint recommendation described 
in paragraph (1); 
‘‘(B) a summary of any risk assessment re-
viewed in support of such joint recommenda-
tion; and 
‘‘(C) a summary of the basis for such de-
termination, including a discussion of less in-
trusive measures that were considered and why 
such measures were not reasonably available to 
reduce supply chain risk; 
‘‘(6) notifying the Director of the Office of 
Management and Budget, and the heads of other 
Federal agencies as appropriate, in a manner and to 
the extent consistent with the requirements of na-
tional security; and 
‘‘(7) taking steps to maintain the confidentiality 
of any notifications under this subsection. 
‘‘(c) PROCEDURES TO ADDRESS URGENT NATIONAL 
SECURITY INTERESTS.—In any case in which the Sec-
retary determines that national security interests require 
the immediate exercise of the authorities under subsection 
(a), the Secretary— 
‘‘(1) may, to the extent necessary to address 
any such national security interest, and subject to 
the conditions specified in paragraph (2)—
‘‘(A) temporarily delay the notice required 
by subsection (b)(2); 
‘‘(B) make the determination required by 
subsection (b)(4), regardless of whether the no-
tice required by subsection (b)(2) has been pro-
vided or whether the notified source at issue 
has submitted any information in response to 
such notice; 
‘‘(C) temporarily delay the notice required 
by subsections (b)(4) and (b)(5); and 
‘‘(D) exercise the authority provided in 
subsection (a) in accordance with such deter-
mination; and 
‘‘(2) shall take actions necessary to comply with 
all requirements of subsection (b) as soon as prac-
ticable after addressing the urgent national security 
interest that is the subject of paragraph (1), includ-
ing— 
‘‘(A) providing the notice required by sub-
section (b)(2); 
‘‘(B) promptly considering any information 
submitted by the source at issue in response to 
such notice, and making any appropriate modi-
fications to the determination required by sub-
section (b)(4) based on such information; and
‘‘(C) providing the notice required by sub-
sections (b)(5) and (b)(6), including a descrip-
tion of such urgent national security, and any 
modifications to such determination made in ac-
cordance with subparagraph (B). 
‘‘(d) ANNUAL REVIEW OF DETERMINATIONS.—The 
Secretary shall annually review all determinations made 
under subsection (b). 
‘‘(e) DELEGATION.—The Secretary may not delegate 
the authority provided in subsection (a) or the responsi-
bility identified in subsection (d) to an official below the 
Deputy Secretary. 
‘‘(f) LIMITATION OF REVIEW.—Notwithstanding any 
other provision of law, no action taken by the Secretary 
under subsection (a) may be subject to review in a bid 
protest before the Government Accountability Office or in 
any Federal court. 
‘‘(g) CONSULTATION.—In developing procedures and 
guidelines for the implementation of the authorities de-
scribed in this section, the Secretary shall review the pro-
cedures and guidelines utilized by the Department of De-
fense to carry out similar authorities. 
‘‘(h) DEFINITIONS.—In this section: 
‘‘(1) COVERED
ARTICLE.—The term ‘covered 
article’ means:
‘‘(A) Information technology, including 
cloud computing services of all types. 
‘‘(B) Telecommunications equipment. 
‘‘(C) Telecommunications services. 
‘‘(D) The processing of information on a 
Federal or non-Federal information system, 
subject to the requirements of the Controlled 
Unclassified Information program of the De-
partment. 
‘‘(E) Hardware, systems, devices, software, 
or services that include embedded or incidental 
information technology. 
‘‘(2) COVERED PROCUREMENT.—The term ‘cov-
ered procurement’ means— 
‘‘(A) a source selection for a covered arti-
cle involving either a performance specification, 
as provided in subsection (a)(3)(B) of section 
3306 of title 41, United States Code, or an 
evaluation factor, as provided in subsection 
(c)(1)(A) of such section, relating to supply 
chain risk, or with respect to which supply 
chain risk considerations are included in the 
Department’s determination of whether a 
source is a responsible source as defined in sec-
tion 113 of such title;
‘‘(B) the consideration of proposals for and 
issuance of a task or delivery order for a cov-
ered article, as provided in section 4106(d)(3) 
of title 41, United States Code, with respect to 
which the task or delivery order contract in-
cludes a contract clause establishing a require-
ment relating to supply chain risk; 
‘‘(C) any contract action involving a con-
tract for a covered article with respect to which 
such contract includes a clause establishing re-
quirements relating to supply chain risk; or 
‘‘(D) any procurement made via Govern-
ment Purchase Care for a covered article when 
supply chain risk has been identified as a con-
cern. 
‘‘(3) COVERED
PROCUREMENT
ACTION.—The 
term ‘covered procurement action’ means any of the 
following actions, if such action takes place in the 
course of conducting a covered procurement: 
‘‘(A) The exclusion of a source that fails to 
meet qualification requirements established pur-
suant to section 3311 of title 41, United States 
Code, for the purpose of reducing supply chain 
risk in the acquisition or use of a covered arti-
cle.
‘‘(B) The exclusion of a source that fails to 
achieve an acceptable rating with regard to an 
evaluation factor providing for the consideration 
of supply chain risk in the evaluation of pro-
posals for the award of a contract or the 
issuance of a task or delivery order. 
‘‘(C) The determination that a source is 
not a responsible source based on consider-
ations of supply chain risk. 
‘‘(D) The decision to withhold consent for 
a contractor to subcontract with a particular 
source or to direct a contractor to exclude a 
particular source from consideration for a sub-
contract. 
‘‘(4) INFORMATION SYSTEM.—The term ‘infor-
mation system’ has the meaning given such term in 
section 3502 of title 44, United States Code. 
‘‘(5) INFORMATION
TECHNOLOGY.—The term 
‘information technology’ has the meaning given such 
term in section 11101 of title 40, United States 
Code. 
‘‘(6) RESPONSIBLE
SOURCE.—The term ‘re-
sponsible source’ has the meaning given such term 
in section 113 of title 41, United States Code.
‘‘(7) SUPPLY CHAIN RISK.—The term ‘supply 
chain risk’ means the risk that a malicious actor 
may sabotage, maliciously introduce an unwanted 
function, extract or modify data, or otherwise ma-
nipulate the design, integrity, manufacturing, pro-
duction, distribution, installation, operation, or 
maintenance of a covered article so as to surveil, 
deny, disrupt, or otherwise manipulate the function, 
use, or operation of the information technology or 
information stored or transmitted on the covered ar-
ticles. 
‘‘(8) TELECOMMUNICATIONS EQUIPMENT.—The 
term ‘telecommunications equipment’ has the mean-
ing given such term in section 153(52) of title 47, 
United States Code. 
‘‘(9) 
TELECOMMUNICATIONS
SERVICE.—The 
term ‘telecommunications service’ has the meaning 
given such term in section 153(53) of title 47, 
United States Code. 
‘‘(i) EFFECTIVE DATE.—The requirements of this 
section shall take effect on the date that is 90 days after 
the date of the enactment of this Act and shall apply to— 
‘‘(1) contracts awarded on or after such date; 
and
‘‘(2) task and delivery orders issued on or after 
such date pursuant to contracts awarded before, on, 
or after such date.’’. 
(b) RULEMAKING.—Section 553 of title 5, United 
States Code, and section 1707 of title 41, United States 
Code, shall not apply to the Secretary of Homeland Secu-
rity when carrying out the authorities and responsibilities 
under section 836 of the Homeland Security Act of 2002, 
as added by subsection (a). 
(c) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of the Homeland Security Act of 2002 is 
amended by inserting after the item relating to section 
835 the following new item: 
‘‘Sec. 836. Requirements for information relating to supply chain risk.’’. 
Passed the House of Representatives September 4, 
2018. 
Attest: 
Clerk.
115TH CONGRESS 
2D SESSION 
H. R. 6430 
AN ACT 
To amend the Homeland Security Act of 2002 to 
authorize the Secretary of Homeland Security to 
implement certain requirements for information 
relating to supply chain risk, and for other pur-
poses.