(a)
(b)
(2) The analytical framework required under paragraph (1) shall include the following elements:
(A) Characterization and monitoring of supply chain risks, including—
(i) material sources and fragility, including the extent to which sources, items, materials, and articles are mined, produced, or manufactured within or outside the United States;
(ii) telecommunications services or equipment (other than optical transmission components);
(iii) counterfeit parts;
(iv) cybersecurity of contractors;
(v) video surveillance services or equipment;
(vi) vendor vetting in contingency or operational environments;
(vii) other electronic or information technology products and services; and
(viii) other risk areas as determined appropriate.
(B) Characterization and monitoring of risks posed by contractor behavior that constitute violations of laws or regulations, including those relating to—
(i) fraud;
(ii) ownership structures;
(iii) trafficking in persons;
(iv) workers' health and safety;
(v) affiliation with the enemy;
(vi) foreign influence; and
(vii) other risk areas as deemed appropriate.
(C) Characterization and assessment of the acquisition processes and procedures of the Department of Defense, including—
(i) market research;
(ii) responsibility determinations, including consideration of the need for special standards of responsibility to address the risks described in subparagraphs (A) and (B);
(iii) facilities clearances;
(iv) the development of contract requirements;
(v) the technical evaluation of offers and contract awards;
(vi) contractor mobilization, including hiring, training, and establishing facilities;
(vii) contract administration, contract management, and oversight;
(viii) contract audit for closeout;
(ix) suspension and debarment activities and administrative appeals activities;
(x) contractor business system reviews; and
(xi) other relevant processes and procedures.
(D) Characterization and monitoring of the health and activities of the defense industrial base, including those relating to—
(i) balance sheets, revenues, profitability, and debt;
(ii) investment, innovation, and technological and manufacturing sophistication;
(iii) finances, access to capital markets, and cost of raising capital within those markets;
(iv) corporate governance, leadership, and culture of performance; and
(v) history of performance on past Department of Defense and government contracts.
(c)
(1) the Under Secretary of Defense for Acquisition and Sustainment, including the Office of Defense Pricing and Contracting and the Office of Industrial Policy;
(2) service acquisition executives;
(3) program offices and procuring contracting officers;
(4) administrative contracting officers within the Defense Contract Management Agency and the Supervisor of Shipbuilding;
(5) the Defense Counterintelligence and Security Agency;
(6) the Defense Contract Audit Agency;
(7) each element of the Department of Defense which own or operate systems containing data relevant to contractors of the Department;
(8) the Under Secretary of Defense for Research and Engineering;
(9) the suspension and debarment official of the Department;
(10) the Chief Information Officer; and
(11) other relevant organizations and individuals.
(d)
(B) The assessment required under subparagraph (A) shall include the following elements:
(i) Identification of the necessary source data, to include data from contractors, intelligence and security activities, program offices, and commercial research entities.
(ii) A description of the modern data infrastructure, tools, and applications and what changes would improve the effectiveness and efficiency of mitigating the risks described in subsection (b)(2).
(iii) An assessment of the following systems owned or operated outside of the Department of Defense that the Department depends upon or to which it provides data:
(I) The Federal Awardee Performance and Integrity Information System (FAPIIS).
(II) The System for Award Management (SAM).
(III) The Federal Procurement Data System–Next Generation (FPDS–NG).
(IV) The Electronic Data Management Information System.
(V) Other systems the Secretary of Defense determines appropriate.
(iv) An assessment of systems owned or operated by the Department of Defense, including the Defense Counterintelligence and Security Agency and other defense agencies and field activities used to capture and analyze the status and performance (including past performance) of vendors and contractors.
(2) Based on the findings pursuant to paragraph (1), the Secretary of Defense shall develop a unified set of activities to modernize the systems of record, data sources and collection methods, and data exposure mechanisms. The unified set of activities should feature—
(A) the ability to continuously collect data on, assess, and mitigate risks;
(B) data analytics and business intelligence tools and methods; and
(C) continuous development and continuous delivery of secure software to implement the activities.
(e)
(f)
(1)
(A) a discussion and recommendations for any changes to, or exemptions from, laws necessary for effective implementation, including updating the definitions in section 2339a(e) of this title relating to covered procurement, covered system, and covered item of supply, and any similar terms defined in other law or regulation; and
(B) a process for an entity to contact the Department after the entity has taken steps to remediate, mitigate, or otherwise address the risks identified by the Department in conducting activities under subsection (b).
(2)
(g)
(1)
(2)
References in Text
The date of the enactment of this section, referred to in subsec. (f)(1), is the date of enactment of Pub. L. 116–92, which was approved Dec. 20, 2019.
Mitigating Risks Related to Foreign Ownership, Control, or Influence of Department of Defense Contractors or Subcontractors
Pub. L. 116–92, div. A, title VIII, §847, Dec. 20, 2019, 133 Stat. 1505, provided that:
"(a)
"(1)
"(2)
"(3)
"(4)
"(b)
"(1)
"(2)
"(A)
"(ii) A requirement to update such disclosures when changes occur to information previously provided, consistent with or similar to the procedures for updating FOCI information under the National Industrial Security Program Operating Manual (DOD 5220.22–M), or a successor document.
"(iii) A requirement for covered contractors and subcontractors determined to be under FOCI to disclose contact information for each of its foreign owners that is a beneficial owner.
"(iv) A requirement that, at a minimum, the disclosures required by this paragraph be provided at the time the contract or subcontract is awarded, amended, or renewed, but in no case later than one year after the Secretary prescribes regulations to carry out this subsection.
"(B)
"(i) whether to establish a special standard of responsibility relating to FOCI risks for covered contractors or subcontractors, and the extent to which the policies and procedures consistent with or similar to those relating to FOCI under the National Industrial Security Program shall be applied to covered contractors or subcontractors;
"(ii) procedures for contracting officers making responsibility determinations regarding whether covered contractors and subcontractors may be under foreign ownership, control, or influence and for determining whether there is reason to believe that such foreign ownership, control, or influence would pose a risk or potential risk to national security or potential compromise because of sensitive data, systems, or processes, such as personally identifiable information, cybersecurity, or national security systems involved with the contract or subcontract; and
"(iii) modification of policies, directives, and practices to provide that an assessment that a covered contractor or subcontractor is under FOCI may be a sufficient basis for a contracting officer to determine that a contractor or subcontractor is not responsible.
"(C)
"(i) Requirements for contract clauses providing for and enforcing disclosures related to changes in FOCI or beneficial ownership during performance of the contract or subcontract, consistent with subparagraph (A), and necessitating the effective mitigation of risks related to FOCI throughout the duration of the contract or subcontract.
"(ii) Pursuant to section 831(c) [sic, no section 831(c) of Pub. L. 116–92 was enacted. Prior to enactment as Pub. L. 116–92, S. 1790 of the 116th Cong., 1st Sess., as introduced in the Senate, contained a section 831 very similar to 10 U.S.C. 2509.], designation of the appropriate Department of Defense official responsible to approve and to take actions relating to award, modification, termination of a contract, or direction to modify or terminate a subcontract due to an assessment by the Defense Counterintelligence and Security Agency, or its successor organization, that a covered contractor or subcontractor under FOCI poses a risk to national security or potential risk of compromise.
"(iii) A requirement for the provision of additional information regarding beneficial ownership and control of any covered contractor or subcontractor on the contract or subcontract.
"(iv) Other measures as necessary to be consistent with other relevant practices, policies, regulations, and actions, including those under the National Industrial Security Program.
"(c)
"(1)
"(2)
"(d)
"(e)
"(f)
"(1)
"(2)
"(A) not made public;
"(B) made available via the FAPIIS and CAGE databases; and
"(C) made available to appropriate government departments or agencies."
Tried the LawStack mobile app?
Join thousands and try LawStack mobile for FREE today.
- Carry the law offline, wherever you go.
- Download CFR, USC, rules, and state law to your mobile device.
