IB 
Union Calendar No. 146 
116TH CONGRESS 
1ST SESSION H. R. 3320 
[Report No. 116–188] 
To amend the Homeland Security Act of 2002 to authorize the Secretary 
of Homeland Security to implement certain requirements for information 
relating to supply chain risk, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JUNE 18, 2019 
Mr. KING of New York (for himself, Mr. THOMPSON of Mississippi, Miss RICE 
of New York, Mr. CORREA, Mr. ROGERS of Alabama, Mr. ROSE of New 
York, and Mr. PAYNE) introduced the following bill; which was referred 
to the Committee on Homeland Security 
AUGUST 27, 2019 
Additional sponsors: Mr. MCCAUL and Mr. HAGEDORN 
AUGUST 27, 2019 
Reported with an amendment, committed to the Committee of the Whole 
House on the State of the Union, and ordered to be printed 
[Strike out all after the enacting clause and insert the part printed in italic] 
[For text of introduced bill, see copy of bill as introduced on June 18, 2019] 
VerDate Sep 11 2014 
20:08 Aug 27, 2019
Jkt 089200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H3320.RH
H3320
pamtmann on DSKBC07HB2PROD with BILLS
A BILL 
To amend the Homeland Security Act of 2002 to authorize 
the Secretary of Homeland Security to implement certain 
requirements for information relating to supply chain 
risk, and for other purposes. 
VerDate Sep 11 2014 
20:08 Aug 27, 2019
Jkt 089200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H3320.RH
H3320
pamtmann on DSKBC07HB2PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Securing the Homeland 
Security Supply Chain Act of 2019’’. 
SEC. 2. DEPARTMENT OF HOMELAND SECURITY REQUIRE-
MENTS FOR INFORMATION RELATING TO 
SUPPLY CHAIN RISK. 
(a) IN GENERAL.—Subtitle D of title VIII of the 
Homeland Security Act of 2002 (6 U.S.C. 391 et seq.) is 
amended by adding at the end the following new section: 
‘‘SEC. 836. REQUIREMENTS FOR INFORMATION RELATING 
TO SUPPLY CHAIN RISK. 
‘‘(a) AUTHORITY.—Subject to subsection (b), the Sec-
retary may— 
‘‘(1) carry out a covered procurement action; 
‘‘(2) limit, notwithstanding any other provision 
of law, in whole or in part, the disclosure of informa-
tion, including classified information, relating to the 
basis for carrying out such an action; and 
‘‘(3) exclude, in whole or in part, a source car-
ried out in the course of such an action applicable to 
a covered procurement of the Department. 
‘‘(b) DETERMINATION AND NOTIFICATION.—Except as 
authorized by subsection (c) to address an urgent national 
VerDate Sep 11 2014 
20:08 Aug 27, 2019
Jkt 089200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H3320.RH
H3320
pamtmann on DSKBC07HB2PROD with BILLS
security interest, the Secretary may exercise the authority 
provided in subsection (a) only after— 
‘‘(1) obtaining a joint recommendation, in un-
classified or classified form, from the Chief Acquisi-
tion Officer and the Chief Information Officer of the 
Department, including a review of any risk assess-
ment made available by an appropriate person or en-
tity, including the national risk management center 
at the Cybersecurity and Infrastructure Security 
Agency, that there is a significant supply chain risk 
in a covered procurement; 
‘‘(2) notifying any source named in the joint rec-
ommendation described in paragraph (1) advising— 
‘‘(A) that a recommendation has been ob-
tained; 
‘‘(B) to the extent consistent with the na-
tional security and law enforcement interests, the 
basis for such recommendation; 
‘‘(C) that, within 30 days after receipt of 
notice, such source may submit information and 
argument in opposition to such recommendation; 
and 
‘‘(D) of the procedures governing the consid-
eration of such submission and the possible exer-
cise of the authority provided in subsection (a); 
VerDate Sep 11 2014 
20:08 Aug 27, 2019
Jkt 089200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H3320.RH
H3320
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(3) notifying the relevant components of the De-
partment that such risk assessment has demonstrated 
significant supply chain risk to a covered procure-
ment; 
‘‘(4) making a determination in writing, in un-
classified or classified form, that after considering 
any information submitted by a source under para-
graph (2), and in consultation with the Chief Infor-
mation Officer of the Department, that— 
‘‘(A) use of authority under subsection 
(a)(1) is necessary to protect national security 
by reducing supply chain risk; 
‘‘(B) less intrusive measures are not reason-
ably available to reduce such risk; 
‘‘(C) a decision to limit disclosure of infor-
mation under subsection (a)(2) is necessary to 
protect national security interest; and 
‘‘(D) the use of such authorities will apply 
to a single covered procurement or a class of cov-
ered procurements, and otherwise specifies the 
scope of such determination; 
‘‘(5) providing to the Committee on Homeland 
Security of the House of Representatives and the 
Committee on Homeland Security and Governmental 
Affairs of the Senate a classified or unclassified notice 
VerDate Sep 11 2014 
20:08 Aug 27, 2019
Jkt 089200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H3320.RH
H3320
pamtmann on DSKBC07HB2PROD with BILLS
of the determination made under paragraph (4) that 
includes— 
‘‘(A) the joint recommendation described in 
paragraph (1); 
‘‘(B) a summary of any risk assessment re-
viewed in support of such joint recommendation; 
and 
‘‘(C) a summary of the basis for such deter-
mination, including a discussion of less intrusive 
measures that were considered and why such 
measures were not reasonably available to reduce 
supply chain risk; 
‘‘(6) notifying the Director of the Office of Man-
agement and Budget, and the heads of other Federal 
agencies as appropriate, in a manner and to the ex-
tent consistent with the requirements of national secu-
rity; and 
‘‘(7) taking steps to maintain the confidentiality 
of any notifications under this subsection. 
‘‘(c) PROCEDURES TO ADDRESS URGENT NATIONAL 
SECURITY INTERESTS.—In any case in which the Secretary 
determines that national security interests require the im-
mediate exercise of the authorities under subsection (a), the 
Secretary— 
VerDate Sep 11 2014 
20:08 Aug 27, 2019
Jkt 089200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H3320.RH
H3320
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(1) may, to the extent necessary to address any 
such national security interest, and subject to the con-
ditions specified in paragraph (2)— 
‘‘(A) temporarily delay the notice required 
by subsection (b)(2); 
‘‘(B) make the determination required by 
subsection (b)(4), regardless of whether the notice 
required by subsection (b)(2) has been provided 
or whether the notified source at issue has sub-
mitted any information in response to such no-
tice; 
‘‘(C) temporarily delay the notice required 
by subsections (b)(4) and (b)(5); and 
‘‘(D) exercise the authority provided in sub-
section (a) in accordance with such determina-
tion; and 
‘‘(2) shall take actions necessary to comply with 
all requirements of subsection (b) as soon as prac-
ticable after addressing the urgent national security 
interest that is the subject of paragraph (1), includ-
ing— 
‘‘(A) providing the notice required by sub-
section (b)(2); 
‘‘(B) promptly considering any information 
submitted by the source at issue in response to 
VerDate Sep 11 2014 
20:08 Aug 27, 2019
Jkt 089200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H3320.RH
H3320
pamtmann on DSKBC07HB2PROD with BILLS
such notice, and making any appropriate modi-
fications to the determination required by sub-
section (b)(4) based on such information; and 
‘‘(C) providing the notice required by sub-
sections (b)(5) and (b)(6), including a descrip-
tion of such urgent national security, and any 
modifications to such determination made in ac-
cordance with subparagraph (B). 
‘‘(d) ANNUAL REVIEW
OF DETERMINATIONS.—The 
Secretary shall annually review all determinations made 
under subsection (b). 
‘‘(e) DELEGATION.—The Secretary may not delegate 
the authority provided in subsection (a) or the responsi-
bility identified in subsection (d) to an official below the 
Deputy Secretary. 
‘‘(f) LIMITATION OF REVIEW.—Notwithstanding any 
other provision of law, no action taken by the Secretary 
under subsection (a) may be subject to review in a bid pro-
test before the Government Accountability Office or in any 
Federal court. 
‘‘(g) CONSULTATION.—In developing procedures and 
guidelines for the implementation of the authorities de-
scribed in this section, the Secretary shall review the proce-
dures and guidelines utilized by the Department of Defense 
to carry out similar authorities. 
VerDate Sep 11 2014 
20:08 Aug 27, 2019
Jkt 089200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H3320.RH
H3320
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(h) DEFINITIONS.—In this section: 
‘‘(1) COVERED ARTICLE.—The term ‘covered ar-
ticle’ means: 
‘‘(A) Information technology, including 
cloud computing services of all types. 
‘‘(B) Telecommunications equipment. 
‘‘(C) Telecommunications services. 
‘‘(D) The processing of information on a 
Federal or non-Federal information system, sub-
ject to the requirements of the Controlled Unclas-
sified Information program of the Department. 
‘‘(E) Hardware, systems, devices, software, 
or services that include embedded or incidental 
information technology. 
‘‘(2) COVERED PROCUREMENT.—The term ‘cov-
ered procurement’ means— 
‘‘(A) a source selection for a covered article 
involving either a performance specification, as 
provided in subsection (a)(3)(B) of section 3306 
of title 41, United States Code, or an evaluation 
factor, as provided in subsection (c)(1)(A) of 
such section, relating to supply chain risk, or 
with respect to which supply chain risk consider-
ations are included in the Department’s deter-
VerDate Sep 11 2014 
20:08 Aug 27, 2019
Jkt 089200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H3320.RH
H3320
pamtmann on DSKBC07HB2PROD with BILLS
mination of whether a source is a responsible 
source as defined in section 113 of such title; 
‘‘(B) the consideration of proposals for and 
issuance of a task or delivery order for a covered 
article, as provided in section 4106(d)(3) of title 
41, United States Code, with respect to which the 
task or delivery order contract includes a con-
tract clause establishing a requirement relating 
to supply chain risk; 
‘‘(C) any contract action involving a con-
tract for a covered article with respect to which 
such contract includes a clause establishing re-
quirements relating to supply chain risk; or 
‘‘(D) any procurement made via Govern-
ment Purchase Care for a covered article when 
supply chain risk has been identified as a con-
cern. 
‘‘(3) COVERED
PROCUREMENT
ACTION.—The 
term ‘covered procurement action’ means any of the 
following actions, if such action takes place in the 
course of conducting a covered procurement: 
‘‘(A) The exclusion of a source that fails to 
meet qualification requirements established pur-
suant to section 3311 of title 41, United States 
VerDate Sep 11 2014 
20:08 Aug 27, 2019
Jkt 089200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6203
E:\BILLS\H3320.RH
H3320
pamtmann on DSKBC07HB2PROD with BILLS
Code, for the purpose of reducing supply chain 
risk in the acquisition or use of a covered article. 
‘‘(B) The exclusion of a source that fails to 
achieve an acceptable rating with regard to an 
evaluation factor providing for the consideration 
of supply chain risk in the evaluation of pro-
posals for the award of a contract or the issuance 
of a task or delivery order. 
‘‘(C) The determination that a source is not 
a responsible source based on considerations of 
supply chain risk. 
‘‘(D) The decision to withhold consent for a 
contractor to subcontract with a particular 
source or to direct a contractor to exclude a par-
ticular source from consideration for a sub-
contract. 
‘‘(4) INFORMATION SYSTEM.—The term ‘informa-
tion system’ has the meaning given such term in sec-
tion 3502 of title 44, United States Code. 
‘‘(5) INFORMATION TECHNOLOGY.—The term ‘in-
formation technology’ has the meaning given such 
term in section 11101 of title 40, United States Code. 
‘‘(6) RESPONSIBLE SOURCE.—The term ‘respon-
sible source’ has the meaning given such term in sec-
tion 113 of title 41, United States Code. 
VerDate Sep 11 2014 
20:08 Aug 27, 2019
Jkt 089200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6203
E:\BILLS\H3320.RH
H3320
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(7) SUPPLY
CHAIN
RISK.—The term ‘supply 
chain risk’ means the risk that a malicious actor may 
sabotage, maliciously introduce an unwanted func-
tion, extract or modify data, or otherwise manipulate 
the design, integrity, manufacturing, production, dis-
tribution, installation, operation, or maintenance of a 
covered article so as to surveil, deny, disrupt, or oth-
erwise manipulate the function, use, or operation of 
the information technology or information stored or 
transmitted on the covered articles. 
‘‘(8) TELECOMMUNICATIONS
EQUIPMENT.—The 
term ‘telecommunications equipment’ has the mean-
ing given such term in section 3(52) of the Commu-
nications Act of 1934 (47 U.S.C. 153(52)). 
‘‘(9) TELECOMMUNICATIONS SERVICE.—The term 
‘telecommunications service’ has the meaning given 
such term in section 3(53) of the Communications Act 
of 1934 (47 U.S.C. 153(53)). 
‘‘(i) EFFECTIVE DATE.—The requirements of this sec-
tion shall take effect on the date that is 90 days after the 
date of the enactment of this Act and shall apply to— 
‘‘(1) contracts awarded on or after such date; 
and 
VerDate Sep 11 2014 
20:08 Aug 27, 2019
Jkt 089200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6203
E:\BILLS\H3320.RH
H3320
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(2) task and delivery orders issued on or after 
such date pursuant to contracts awarded before, on, 
or after such date.’’. 
(b) RULEMAKING.—Section 553 of title 5, United 
States Code, and section 1707 of title 41, United States 
Code, shall not apply to the Secretary of Homeland Secu-
rity when carrying out the authorities and responsibilities 
under section 836 of the Homeland Security Act of 2002, 
as added by subsection (a). 
(c) CLERICAL AMENDMENT.—The table of contents in 
section 1(b) of the Homeland Security Act of 2002 is 
amended by inserting after the item relating to section 835 
the following new item: 
‘‘Sec. 836. Requirements for information relating to supply chain risk.’’. 
SEC. 3. REPORT ON THREATS POSED BY FOREIGN STATE- 
OWNED ENTITIES TO DHS INFORMATION 
TECHNOLOGY AND COMMUNICATIONS SYS-
TEMS. 
Not later than 180 days after the date of the enactment 
of this Act, the Under Secretary for Management of the De-
partment of Homeland Security, in coordination with the 
national risk management center of the Cybersecurity and 
Infrastructure Security Agency of the Department, shall 
submit to the Committee on Homeland Security of the 
House of Representatives and the Committee on Homeland 
Security and Governmental Affairs of the Senate a report 
VerDate Sep 11 2014 
20:08 Aug 27, 2019
Jkt 089200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6203
E:\BILLS\H3320.RH
H3320
pamtmann on DSKBC07HB2PROD with BILLS
on cybersecurity threats posed by terrorist actors and for-
eign state-owned entities to the information technology and 
communications systems of Department of Homeland Secu-
rity, including information relating to the following: 
(1) The use of foreign state-owned entities’ infor-
mation and communications technology by the De-
partment of Homeland Security, listed by component. 
(2) The threats, in consultation with the Depart-
ment’s Office of Intelligence and Analysis, of foreign 
state-owned entities’ information and communica-
tions technology equipment that could impact the De-
partment. 
VerDate Sep 11 2014 
20:08 Aug 27, 2019
Jkt 089200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6203
E:\BILLS\H3320.RH
H3320
pamtmann on DSKBC07HB2PROD with BILLS
VerDate Sep 11 2014 
20:08 Aug 27, 2019
Jkt 089200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6203
E:\BILLS\H3320.RH
H3320
pamtmann on DSKBC07HB2PROD with BILLS