[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 4651 Reported in Senate (RS)]
<DOC>
Calendar No. 737
118th CONGRESS
2d Session
S. 4651
[Report No. 118-317]
To require agencies to use information and communications technology
products obtained from original equipment manufacturers or authorized
resellers, and for other purposes.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
July 10, 2024
Mr. Cornyn (for himself, Mr. Peters, and Mr. Ossoff) introduced the
following bill; which was read twice and referred to the Committee on
Homeland Security and Governmental Affairs
December 19 (legislative day, December 16), 2024
Reported by Mr. Peters, with an amendment
[Strike out all after the enacting clause and insert the part printed
in italic]
_______________________________________________________________________
A BILL
To require agencies to use information and communications technology
products obtained from original equipment manufacturers or authorized
resellers, and for other purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
<DELETED>SECTION 1. SHORT TITLE.</DELETED>
<DELETED> This Act may be cited as the ``Securing America's Federal
Equipment in Supply Chains Act'' or the ``SAFE Supply Chains
Act''.</DELETED>
<DELETED>SEC. 2. AGENCY USE OF IT PRODUCTS.</DELETED>
<DELETED> (a) Definitions.--In this section:</DELETED>
<DELETED> (1) Agency.--The term ``agency'' has the meaning
given the term in section 3502 of title 44, United States
Code.</DELETED>
<DELETED> (2) Appropriate congressional committees.--The
term ``appropriate congressional committees'' means the
Committee on Homeland Security and Governmental Affairs of the
Senate and the Committee on Oversight and Accountability of the
House of Representatives.</DELETED>
<DELETED> (3) Authorized reseller.--The term ``authorized
reseller'' means a reseller, after market manufacturer,
supplier, or distributor of a covered product with a direct or
prime contractual arrangement with, or the express written
authority of, the original equipment manufacturer of the
covered product to manufacture, buy, stock, repackage, sell,
resell, repair, service, otherwise support, or distribute the
covered product.</DELETED>
<DELETED> (4) Covered product.--The term ``covered
product''--</DELETED>
<DELETED> (A) means an information and
communications technology end-use hardware product or
component, including software and firmware that
comprise the end-use hardware product or component;
and</DELETED>
<DELETED> (B) does not include--</DELETED>
<DELETED> (i) other software; or</DELETED>
<DELETED> (ii) an end-use hardware product--
</DELETED>
<DELETED> (I) in which there is
embedded information and communications
technology; and</DELETED>
<DELETED> (II) the principal
function of which is not the creation,
manipulation, storage, display,
receipt, or transmission of electronic
data and information.</DELETED>
<DELETED> (5) End-use product.--The term ``end-use product''
means a product ready for use by the maintainer, integrator, or
end user of the product.</DELETED>
<DELETED> (6) Information and communications technology.--
The term ``information and communications technology''--
</DELETED>
<DELETED> (A) has the meaning given the term in
section 4713 of title 41, United States Code;
and</DELETED>
<DELETED> (B) includes information and
communications technologies covered by definitions
contained in the Federal Acquisition Regulation,
including definitions added after the date of the
enactment of this Act by the Federal Acquisition
Regulatory Council pursuant to notice and
comment.</DELETED>
<DELETED> (7) Original equipment manufacturer.--The term
``original equipment manufacturer'' means a company that
manufactures a covered product that the company--</DELETED>
<DELETED> (A) designed from self-sourced or
purchased components; and</DELETED>
<DELETED> (B) sells under the name of the
company.</DELETED>
<DELETED> (b) Prohibition on Procurement and Use.--Subject to
subsection (c) and notwithstanding sections 1905 through 1907 of title
41, United States Code, the head of an agency may not procure or
obtain, renew a contract to procure or obtain, or use a covered product
that is procured from an entity other than--</DELETED>
<DELETED> (1) an original equipment manufacturer;
or</DELETED>
<DELETED> (2) an authorized reseller.</DELETED>
<DELETED> (c) Waiver.--</DELETED>
<DELETED> (1) In general.--Upon written notice to the
Director of the Office of Management and Budget, the head of an
agency may waive the prohibition under subsection (b) with
respect to a covered product if the head of the agency
determines that--</DELETED>
<DELETED> (A) the waiver is necessary in the
interest of national security; or</DELETED>
<DELETED> (B) procuring, obtaining, or using the
covered product is necessary--</DELETED>
<DELETED> (i) for the purpose of
scientifically valid research (as defined in
section 102 the Education Sciences Reform Act
of 2002 (20 U.S.C. 9501)); or</DELETED>
<DELETED> (ii) to avoid jeopardizing the
performance of mission critical
functions.</DELETED>
<DELETED> (2) Notice.--The notice described in paragraph
(1)--</DELETED>
<DELETED> (A) shall--</DELETED>
<DELETED> (i) specify, with respect to the
waiver under paragraph (1)--</DELETED>
<DELETED> (I) the justification for
the waiver;</DELETED>
<DELETED> (II) any security
mitigations that have been implemented;
and</DELETED>
<DELETED> (III) with respect to a
waiver that necessitates a security
mitigation, the plan of action and
milestones to avoid future waivers for
subsequent similar purchases;
and</DELETED>
<DELETED> (ii) be submitted in an
unclassified form; and</DELETED>
<DELETED> (B) may include a classified
annex.</DELETED>
<DELETED> (3) Duration.--With respect to a waiver for the
purpose of research, as described in paragraph (1)(B)(i), the
waiver shall be effective for the duration of the research
identified in the waiver.</DELETED>
<DELETED> (d) Reports to Congress.--</DELETED>
<DELETED> (1) In general.--Not later than 1 year after the
date of enactment of this Act, and annually thereafter until
the date that is 6 years after the date of enactment of this
Act, the Director of the Office of Management and Budget shall
submit to the appropriate congressional committees a report
that lists--</DELETED>
<DELETED> (A) the number and types of covered
products for which a waiver under subsection (c)(1) was
granted during the 1-year period preceding the date of
the submission of the report; and</DELETED>
<DELETED> (B) the legal authority under which each
waiver described in subparagraph (A) was granted, such
as whether the waiver was granted pursuant to
subparagraph (A) or (B) of subsection (c)(1).</DELETED>
<DELETED> (2) Classification of report.--Each report
submitted under this subsection--</DELETED>
<DELETED> (A) shall be submitted in unclassified
form; and</DELETED>
<DELETED> (B) may include a classified annex that
contains the information described in paragraph
(1)(B).</DELETED>
<DELETED> (e) Effective Date.--This section shall take effect on the
date that is 1 year after the date of enactment of this Act.</DELETED>
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Securing America's Federal Equipment
Supply Chains Act'' or the ``SAFE Supply Chains Act''.
SEC. 2. AGENCY USE OF IT PRODUCTS.
(a) Definitions.--In this section:
(1) Agency.--The term ``agency'' has the meaning given the
term in section 3502 of title 44, United States Code.
(2) Appropriate congressional committees.--The term
``appropriate congressional committees'' means the Committee on
Homeland Security and Governmental Affairs of the Senate and
the Committee on Oversight and Accountability of the House of
Representatives.
(3) Authorized reseller.--The term ``authorized reseller''
means a reseller, after market manufacturer, supplier, or
distributor of a covered product with a direct or prime
contractual arrangement with, or the express written authority
of, the original equipment manufacturer of the covered product
to manufacture, buy, stock, repackage, sell, resell, repair,
service, otherwise support, or distribute the covered product.
(4) Covered product.--The term ``covered product''--
(A) means an information and communications
technology end-use hardware product or component,
including software and firmware that comprise the end-
use hardware product or component; and
(B) does not include--
(i) other software; or
(ii) an end-use hardware product--
(I) in which there is embedded
information and communications
technology; and
(II) the principal function of
which is not the creation,
manipulation, storage, display,
receipt, or transmission of electronic
data and information.
(5) End-use product.--The term ``end-use product'' means a
product ready for use by the maintainer, integrator, or end
user of the product.
(6) Information and communications technology.--The term
``information and communications technology''--
(A) has the meaning given the term in section 4713
of title 41, United States Code; and
(B) includes information and communications
technologies covered by definitions contained in the
Federal Acquisition Regulation, including definitions
added after the date of the enactment of this Act by
the Federal Acquisition Regulatory Council pursuant to
notice and comment.
(7) Original equipment manufacturer.--The term ``original
equipment manufacturer'' means a company that manufactures a
covered product that the company--
(A) designed from self-sourced or purchased
components; and
(B) sells under the name of the company.
(b) Prohibition on Procurement and Use.--Subject to subsection (c)
and notwithstanding sections 1905 through 1907 of title 41, United
States Code, the head of an agency may not procure or obtain, renew a
contract to procure or obtain, or use a covered product that is
procured from an entity other than--
(1) an original equipment manufacturer; or
(2) an authorized reseller.
(c) Waiver.--
(1) In general.--Upon written notice to the Director of the
Office of Management and Budget, the head of an agency may
waive the prohibition under subsection (b) with respect to a
covered product if the head of the agency determines that
procuring, obtaining, or using the covered product is
necessary--
(A) for the purpose of scientifically valid
research (as defined in section 102 the Education
Sciences Reform Act of 2002 (20 U.S.C. 9501)); or
(B) to avoid jeopardizing the performance of
mission critical functions.
(2) Notice.--The notice described in paragraph (1)--
(A) shall--
(i) specify, with respect to the waiver
under paragraph (1)--
(I) the justification for the
waiver;
(II) any security mitigations that
have been implemented; and
(III) with respect to a waiver that
necessitates a security mitigation, the
plan of action and milestones to avoid
future waivers for subsequent similar
purchases; and
(ii) be submitted in an unclassified form;
and
(B) may include a classified annex.
(3) Duration.--With respect to a waiver for the purpose of
research, as described in paragraph (1)(A), the waiver shall be
effective for the duration of the research identified in the
waiver.
(d) Vendor Technical Assistance.--The head of each agency shall
establish procurement guidance to provide assistance to entities that
are not eligible for procurements of covered products due to the
prohibition under subsection (b) on the process of becoming an
authorized reseller for covered products.
(e) Reports to Congress.--
(1) In general.--Not later than 1 year after the date of
enactment of this Act, and annually thereafter until the date
that is 6 years after the date of enactment of this Act, the
Director of the Office of Management and Budget shall submit to
the appropriate congressional committees a report that
provides--
(A) the number and types of covered products for
which a waiver under subsection (c)(1) was granted
during the 1-year period preceding the date of the
submission of the report;
(B) the legal authority under which each waiver
described in subparagraph (A) was granted, such as
whether the waiver was granted pursuant to subparagraph
(A) or (B) of subsection (c)(1); and
(C) any actions taken by the head of an agency to
reduce the number of waivers issued by the agency under
subsection (c)(1) with the goal of achieving full
compliance with the prohibition under subsection (b).
(2) Classification of report.--Each report submitted under
this subsection--
(A) shall be submitted in unclassified form; and
(B) may include a classified annex that contains
the information described in paragraph (1)(B).
(f) No New Funds.--No additional amounts are authorized to be
appropriated for the purpose of carrying out this Act.
(g) Effective Date.--This section shall take effect on the date
that is 1 year after the date of enactment of this Act.
Calendar No. 737
118th CONGRESS
2d Session
S. 4651
[Report No. 118-317]
_______________________________________________________________________
A BILL
To require agencies to use information and communications technology
products obtained from original equipment manufacturers or authorized
resellers, and for other purposes.
_______________________________________________________________________
December 19 (legislative day, December 16), 2024
Reported with an amendment