[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 4651 Introduced in Senate (IS)]
<DOC>
118th CONGRESS
2d Session
S. 4651
To require agencies to use information and communications technology
products obtained from original equipment manufacturers or authorized
resellers, and for other purposes.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
July 10, 2024
Mr. Cornyn (for himself and Mr. Peters) introduced the following bill;
which was read twice and referred to the Committee on Homeland Security
and Governmental Affairs
_______________________________________________________________________
A BILL
To require agencies to use information and communications technology
products obtained from original equipment manufacturers or authorized
resellers, and for other purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Securing America's Federal Equipment
in Supply Chains Act'' or the ``SAFE Supply Chains Act''.
SEC. 2. AGENCY USE OF IT PRODUCTS.
(a) Definitions.--In this section:
(1) Agency.--The term ``agency'' has the meaning given the
term in section 3502 of title 44, United States Code.
(2) Appropriate congressional committees.--The term
``appropriate congressional committees'' means the Committee on
Homeland Security and Governmental Affairs of the Senate and
the Committee on Oversight and Accountability of the House of
Representatives.
(3) Authorized reseller.--The term ``authorized reseller''
means a reseller, after market manufacturer, supplier, or
distributor of a covered product with a direct or prime
contractual arrangement with, or the express written authority
of, the original equipment manufacturer of the covered product
to manufacture, buy, stock, repackage, sell, resell, repair,
service, otherwise support, or distribute the covered product.
(4) Covered product.--The term ``covered product''--
(A) means an information and communications
technology end-use hardware product or component,
including software and firmware that comprise the end-
use hardware product or component; and
(B) does not include--
(i) other software; or
(ii) an end-use hardware product--
(I) in which there is embedded
information and communications
technology; and
(II) the principal function of
which is not the creation,
manipulation, storage, display,
receipt, or transmission of electronic
data and information.
(5) End-use product.--The term ``end-use product'' means a
product ready for use by the maintainer, integrator, or end
user of the product.
(6) Information and communications technology.--The term
``information and communications technology''--
(A) has the meaning given the term in section 4713
of title 41, United States Code; and
(B) includes information and communications
technologies covered by definitions contained in the
Federal Acquisition Regulation, including definitions
added after the date of the enactment of this Act by
the Federal Acquisition Regulatory Council pursuant to
notice and comment.
(7) Original equipment manufacturer.--The term ``original
equipment manufacturer'' means a company that manufactures a
covered product that the company--
(A) designed from self-sourced or purchased
components; and
(B) sells under the name of the company.
(b) Prohibition on Procurement and Use.--Subject to subsection (c)
and notwithstanding sections 1905 through 1907 of title 41, United
States Code, the head of an agency may not procure or obtain, renew a
contract to procure or obtain, or use a covered product that is
procured from an entity other than--
(1) an original equipment manufacturer; or
(2) an authorized reseller.
(c) Waiver.--
(1) In general.--Upon written notice to the Director of the
Office of Management and Budget, the head of an agency may
waive the prohibition under subsection (b) with respect to a
covered product if the head of the agency determines that--
(A) the waiver is necessary in the interest of
national security; or
(B) procuring, obtaining, or using the covered
product is necessary--
(i) for the purpose of scientifically valid
research (as defined in section 102 the
Education Sciences Reform Act of 2002 (20
U.S.C. 9501)); or
(ii) to avoid jeopardizing the performance
of mission critical functions.
(2) Notice.--The notice described in paragraph (1)--
(A) shall--
(i) specify, with respect to the waiver
under paragraph (1)--
(I) the justification for the
waiver;
(II) any security mitigations that
have been implemented; and
(III) with respect to a waiver that
necessitates a security mitigation, the
plan of action and milestones to avoid
future waivers for subsequent similar
purchases; and
(ii) be submitted in an unclassified form;
and
(B) may include a classified annex.
(3) Duration.--With respect to a waiver for the purpose of
research, as described in paragraph (1)(B)(i), the waiver shall
be effective for the duration of the research identified in the
waiver.
(d) Reports to Congress.--
(1) In general.--Not later than 1 year after the date of
enactment of this Act, and annually thereafter until the date
that is 6 years after the date of enactment of this Act, the
Director of the Office of Management and Budget shall submit to
the appropriate congressional committees a report that lists--
(A) the number and types of covered products for
which a waiver under subsection (c)(1) was granted
during the 1-year period preceding the date of the
submission of the report; and
(B) the legal authority under which each waiver
described in subparagraph (A) was granted, such as
whether the waiver was granted pursuant to subparagraph
(A) or (B) of subsection (c)(1).
(2) Classification of report.--Each report submitted under
this subsection--
(A) shall be submitted in unclassified form; and
(B) may include a classified annex that contains
the information described in paragraph (1)(B).
(e) Effective Date.--This section shall take effect on the date
that is 1 year after the date of enactment of this Act.
<all>