Securing America’s Federal Equipment Supply Chains Act

Bill: 118-s-4651
Sponsor: full_name: Sen. Cornyn, John [R-TX]
Introduced: 2024-07-10
Policy area: Government Operations and Politics
Subjects: Computers and information technology

Congressional oversight

Public contracts and procurement
Latest action: action_date: 2024-12-19
text: Placed on Senate Legislative Calendar under General Orders. Calendar No. 737.

Summaries:

tv_txt: II Calendar No. 737 118th CONGRESS 2d Session S. 4651 [Report No. 118–317] IN THE SENATE OF THE UNITED STATES July 10, 2024 Mr. Cornyn (for himself, Mr. Peters , and Mr. Ossoff ) introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs December 19 (legislative day, December 16), 2024 Reported by Mr. Peters , with an amendment Strike out all after the enacting clause and insert the part printed in italic A BILL To require agencies to use information and communications technology products obtained from original equipment manufacturers or authorized resellers, and for other purposes.

1. Short title This Act may be cited as the Securing America’s Federal Equipment in Supply Chains Act or the SAFE Supply Chains Act . 2. Agency use of IT products (a) Definitions In this section: (1) Agency The term agency has the meaning given the term in section 3502 of title 44, United States Code. (2) Appropriate congressional committees The term appropriate congressional committees means the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Accountability of the House of Representatives. (3) Authorized reseller The term authorized reseller means a reseller, after market manufacturer, supplier, or distributor of a covered product with a direct or prime contractual arrangement with, or the express written authority of, the original equipment manufacturer of the covered product to manufacture, buy, stock, repackage, sell, resell, repair, service, otherwise support, or distribute the covered product. (4) Covered product The term covered product — (A) means an information and communications technology end-use hardware product or component, including software and firmware that comprise the end-use hardware product or component; and (B) does not include— (i) other software; or (ii) an end-use hardware product— (I) in which there is embedded information and communications technology; and (II) the principal function of which is not the creation, manipulation, storage, display, receipt, or transmission of electronic data and information. (5) End-use product The term end-use product means a product ready for use by the maintainer, integrator, or end user of the product. (6) Information and communications technology The term information and communications technology — (A) has the meaning given the term in section 4713 of title 41, United States Code; and (B) includes information and communications technologies covered by definitions contained in the Federal Acquisition Regulation, including definitions added after the date of the enactment of this Act by the Federal Acquisition Regulatory Council pursuant to notice and comment. (7) Original equipment manufacturer The term original equipment manufacturer means a company that manufactures a covered product that the company— (A) designed from self-sourced or purchased components; and (B) sells under the name of the company. (b) Prohibition on procurement and use Subject to subsection (c) and notwithstanding sections 1905 through 1907 of title 41, United States Code, the head of an agency may not procure or obtain, renew a contract to procure or obtain, or use a covered product that is procured from an entity other than— (1) an original equipment manufacturer; or (2) an authorized reseller. (c) Waiver (1) In general Upon written notice to the Director of the Office of Management and Budget, the head of an agency may waive the prohibition under subsection (b) with respect to a covered product if the head of the agency determines that— (A) the waiver is necessary in the interest of national security; or (B) procuring, obtaining, or using the covered product is necessary— (i) for the purpose of scientifically valid research (as defined in section 102 the Education Sciences Reform Act of 2002 ( 20 U.S.C. 9501 )); or (ii) to avoid jeopardizing the performance of mission critical functions. (2) Notice The notice described in paragraph (1)— (A) shall— (i) specify, with respect to the waiver under paragraph (1)— (I) the justification for the waiver; (II) any security mitigations that have been implemented; and (III) with respect to a waiver that necessitates a security mitigation, the plan of action and milestones to avoid future waivers for subsequent similar purchases; and (ii) be submitted in an unclassified form; and (B) may include a classified annex. (3) Duration With respect to a waiver for the purpose of research, as described in paragraph (1)(B)(i), the waiver shall be effective for the duration of the research identified in the waiver. (d) Reports to congress (1) In general Not later than 1 year after the date of enactment of this Act, and annually thereafter until the date that is 6 years after the date of enactment of this Act, the Director of the Office of Management and Budget shall submit to the appropriate congressional committees a report that lists— (A) the number and types of covered products for which a waiver under subsection (c)(1) was granted during the 1-year period preceding the date of the submission of the report; and (B) the legal authority under which each waiver described in subparagraph (A) was granted, such as whether the waiver was granted pursuant to subparagraph (A) or (B) of subsection (c)(1). (2) Classification of report Each report submitted under this subsection— (A) shall be submitted in unclassified form; and (B) may include a classified annex that contains the information described in paragraph (1)(B). (e) Effective date This section shall take effect on the date that is 1 year after the date of enactment of this Act.

1. Short title This Act may be cited as the Securing America’s Federal Equipment Supply Chains Act or the SAFE Supply Chains Act . 2. Agency use of IT products (a) Definitions In this section: (1) Agency The term agency has the meaning given the term in section 3502 of title 44, United States Code. (2) Appropriate congressional committees The term appropriate congressional committees means the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Accountability of the House of Representatives. (3) Authorized reseller The term authorized reseller means a reseller, after market manufacturer, supplier, or distributor of a covered product with a direct or prime contractual arrangement with, or the express written authority of, the original equipment manufacturer of the covered product to manufacture, buy, stock, repackage, sell, resell, repair, service, otherwise support, or distribute the covered product. (4) Covered product The term covered product — (A) means an information and communications technology end-use hardware product or component, including software and firmware that comprise the end-use hardware product or component; and (B) does not include— (i) other software; or (ii) an end-use hardware product— (I) in which there is embedded information and communications technology; and (II) the principal function of which is not the creation, manipulation, storage, display, receipt, or transmission of electronic data and information. (5) End-use product The term end-use product means a product ready for use by the maintainer, integrator, or end user of the product. (6) Information and communications technology The term information and communications technology — (A) has the meaning given the term in section 4713 of title 41, United States Code; and (B) includes information and communications technologies covered by definitions contained in the Federal Acquisition Regulation, including definitions added after the date of the enactment of this Act by the Federal Acquisition Regulatory Council pursuant to notice and comment. (7) Original equipment manufacturer The term original equipment manufacturer means a company that manufactures a covered product that the company— (A) designed from self-sourced or purchased components; and (B) sells under the name of the company. (b) Prohibition on procurement and use Subject to subsection (c) and notwithstanding sections 1905 through 1907 of title 41, United States Code, the head of an agency may not procure or obtain, renew a contract to procure or obtain, or use a covered product that is procured from an entity other than— (1) an original equipment manufacturer; or (2) an authorized reseller. (c) Waiver (1) In general Upon written notice to the Director of the Office of Management and Budget, the head of an agency may waive the prohibition under subsection (b) with respect to a covered product if the head of the agency determines that procuring, obtaining, or using the covered product is necessary— (A) for the purpose of scientifically valid research (as defined in section 102 the Education Sciences Reform Act of 2002 ( 20 U.S.C. 9501 )); or (B) to avoid jeopardizing the performance of mission critical functions. (2) Notice The notice described in paragraph (1)— (A) shall— (i) specify, with respect to the waiver under paragraph (1)— (I) the justification for the waiver; (II) any security mitigations that have been implemented; and (III) with respect to a waiver that necessitates a security mitigation, the plan of action and milestones to avoid future waivers for subsequent similar purchases; and (ii) be submitted in an unclassified form; and (B) may include a classified annex. (3) Duration With respect to a waiver for the purpose of research, as described in paragraph (1)(A), the waiver shall be effective for the duration of the research identified in the waiver. (d) Vendor technical assistance The head of each agency shall establish procurement guidance to provide assistance to entities that are not eligible for procurements of covered products due to the prohibition under subsection (b) on the process of becoming an authorized reseller for covered products. (e) Reports to congress (1) In general Not later than 1 year after the date of enactment of this Act, and annually thereafter until the date that is 6 years after the date of enactment of this Act, the Director of the Office of Management and Budget shall submit to the appropriate congressional committees a report that provides— (A) the number and types of covered products for which a waiver under subsection (c)(1) was granted during the 1-year period preceding the date of the submission of the report; (B) the legal authority under which each waiver described in subparagraph (A) was granted, such as whether the waiver was granted pursuant to subparagraph (A) or (B) of subsection (c)(1); and (C) any actions taken by the head of an agency to reduce the number of waivers issued by the agency under subsection (c)(1) with the goal of achieving full compliance with the prohibition under subsection (b). (2) Classification of report Each report submitted under this subsection— (A) shall be submitted in unclassified form; and (B) may include a classified annex that contains the information described in paragraph (1)(B). (f) No new funds No additional amounts are authorized to be appropriated for the purpose of carrying out this Act. (g) Effective date This section shall take effect on the date that is 1 year after the date of enactment of this Act.

December 19 (legislative day, December 16), 2024 Reported with an amendment

tv_txt: II 118th CONGRESS 2d Session S. 4651 IN THE SENATE OF THE UNITED STATES July 10, 2024 Mr. Cornyn (for himself and Mr. Peters ) introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs A BILL To require agencies to use information and communications technology products obtained from original equipment manufacturers or authorized resellers, and for other purposes.

1. Short title This Act may be cited as the Securing America’s Federal Equipment in Supply Chains Act or the SAFE Supply Chains Act . 2. Agency use of IT products (a) Definitions In this section: (1) Agency The term agency has the meaning given the term in section 3502 of title 44, United States Code. (2) Appropriate congressional committees The term appropriate congressional committees means the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Accountability of the House of Representatives. (3) Authorized reseller The term authorized reseller means a reseller, after market manufacturer, supplier, or distributor of a covered product with a direct or prime contractual arrangement with, or the express written authority of, the original equipment manufacturer of the covered product to manufacture, buy, stock, repackage, sell, resell, repair, service, otherwise support, or distribute the covered product. (4) Covered product The term covered product — (A) means an information and communications technology end-use hardware product or component, including software and firmware that comprise the end-use hardware product or component; and (B) does not include— (i) other software; or (ii) an end-use hardware product— (I) in which there is embedded information and communications technology; and (II) the principal function of which is not the creation, manipulation, storage, display, receipt, or transmission of electronic data and information. (5) End-use product The term end-use product means a product ready for use by the maintainer, integrator, or end user of the product. (6) Information and communications technology The term information and communications technology — (A) has the meaning given the term in section 4713 of title 41, United States Code; and (B) includes information and communications technologies covered by definitions contained in the Federal Acquisition Regulation, including definitions added after the date of the enactment of this Act by the Federal Acquisition Regulatory Council pursuant to notice and comment. (7) Original equipment manufacturer The term original equipment manufacturer means a company that manufactures a covered product that the company— (A) designed from self-sourced or purchased components; and (B) sells under the name of the company. (b) Prohibition on procurement and use Subject to subsection (c) and notwithstanding sections 1905 through 1907 of title 41, United States Code, the head of an agency may not procure or obtain, renew a contract to procure or obtain, or use a covered product that is procured from an entity other than— (1) an original equipment manufacturer; or (2) an authorized reseller. (c) Waiver (1) In general Upon written notice to the Director of the Office of Management and Budget, the head of an agency may waive the prohibition under subsection (b) with respect to a covered product if the head of the agency determines that— (A) the waiver is necessary in the interest of national security; or (B) procuring, obtaining, or using the covered product is necessary— (i) for the purpose of scientifically valid research (as defined in section 102 the Education Sciences Reform Act of 2002 ( 20 U.S.C. 9501 )); or (ii) to avoid jeopardizing the performance of mission critical functions. (2) Notice The notice described in paragraph (1)— (A) shall— (i) specify, with respect to the waiver under paragraph (1)— (I) the justification for the waiver; (II) any security mitigations that have been implemented; and (III) with respect to a waiver that necessitates a security mitigation, the plan of action and milestones to avoid future waivers for subsequent similar purchases; and (ii) be submitted in an unclassified form; and (B) may include a classified annex. (3) Duration With respect to a waiver for the purpose of research, as described in paragraph (1)(B)(i), the waiver shall be effective for the duration of the research identified in the waiver. (d) Reports to congress (1) In general Not later than 1 year after the date of enactment of this Act, and annually thereafter until the date that is 6 years after the date of enactment of this Act, the Director of the Office of Management and Budget shall submit to the appropriate congressional committees a report that lists— (A) the number and types of covered products for which a waiver under subsection (c)(1) was granted during the 1-year period preceding the date of the submission of the report; and (B) the legal authority under which each waiver described in subparagraph (A) was granted, such as whether the waiver was granted pursuant to subparagraph (A) or (B) of subsection (c)(1). (2) Classification of report Each report submitted under this subsection— (A) shall be submitted in unclassified form; and (B) may include a classified annex that contains the information described in paragraph (1)(B). (e) Effective date This section shall take effect on the date that is 1 year after the date of enactment of this Act.