On October 5, 2023, the Federal Acquisition Regulatory Council (FAR Council) issued an interim Federal Acquisition Regulation rule (FAR rule) that implements the Federal Acquisition Supply Chain Security Act (FASCSA). This FAR rule implements the requirements of the Federal Acquisition Supply Chain Security Act of 2018 and the Federal Acquisition Security Council (FASC) final rule for complying with exclusion or removal orders. The FAR rule represents yet another step by the Government to mitigate the security risks that the Government perceives with the use of information technology that may be produced or provided by countries considered to be foreign adversaries. Like similar supply chain prohibitions, the rule requires contractors to conduct diligence to ensure that articles and sources covered by a FASCA exclusion or removal order are not provided to the Government, to make an affirmative representation to the Government that such articles and sources will not be provided, and to promptly report if any are identified. The FAR rule will become effective on December 4, 2023, and will apply to new contracts and contracts subject to extension or renewal. The rule instructs that existing IDIQ contracts should be modified by the Government within six months of December 4, 2023 to apply the requirements to future orders.
Additional information about the rule and its relationship to existing FASCSA regulations is outlined below.
FASCSA Regulations
At its core, the FAR rule outlines a standard approach for contracting agencies and contractors to follow to comply with FASCSA statutory requirements and implementing FASCSA regulations that the Federal Acquisition Security Council (FASC) finalized in 2021. In broad stokes, the FASC regulations outline the procedural approach that civilian, defense, and intelligence agencies need to follow in order to make determinations relating to “Covered Articles” (i.e., products and services) and “Covered Sources” (i.e., federal contractors and suppliers). Further detail on these procedures is described in our client alert of the interim rule available here.[1]
The FASC regulations address the treatment of both mandatory and voluntary submissions of information to the FASC. Federal agencies are required to “expeditiously” submit information to the FASC when they determine that “there is a reasonable basis to conclude a substantial supply chain risk exists in connection with a source or covered article.” Voluntary submissions can come from either federal agencies or from non-federal entities (including from companies or individuals).
That rule specifies that upon a referral of the FASC or any member of the FASC, the written request of the head of an executive agency or a designee, or based on information submitted to the FASC by any individual or non-federal entity that the FASC determines to be credible, the FASC will undertake a process to determine whether to recommend an exclusion or removal order. The ultimate determination depends on a variety of non-exclusive factors relating to that source or article, including the functionality and features of the covered articles; the security, authenticity, and integrity of covered articles; ownership of, control of, or influence over the source or covered article(s) by a foreign government or parties owned or controlled by a foreign government; implications to national, homeland security, or critical functions associated with the use of the source(s) or covered article(s); and capacity of the source or the U.S. Government to mitigate risks.
Recommendations by the FASC are then provided to the Secretary of Homeland Security (DHS), the Secretary of Defense (DoD), and the Director of National Intelligence (DNI). These agencies are responsible for civilian, defense, and intelligence agency exclusions, respectively, and each agency may make its own determination as to whether to issue an order. As part of this process, any impacted source(s) are notified that the FASC has recommended exclusion, and are allowed 30 days to respond. Should one or more agencies determine that an exclusion is warranted, then the impacted source(s) may only appeal the determination through a federal court of appeals.
FAR Rule
The FAR rule effectively outlines procedures that should be followed by agencies and contractors once an exclusion order has been issued by one or more of DHS, DoD, or DNI. The rule features three notable requirements: (1) a mandatory representation to the Government prior to entering into a contract that no covered articles will be provided and no covered sources will be used during contract performance, (2) a contract clause that similarly prohibits the provision of covered articles or the use of covered sources, and (3) a mandatory reporting requirement should covered articles or sources be identified during contract performance.
Representation Requirement
Prior to entering into a new contract, contractors will be required to represent that they will not provide or use any covered article, or any products or services produced or provided by a covered source, during contract performance, if the covered article or the source is prohibited by an applicable FASCSA order in effect on the date the solicitation was issued. This representation is made based on a “reasonable inquiry” standard. The standard will be familiar to those contractors that have taken steps to comply with Part B of Section 889 of the Fiscal Year 2019 National Defense Authorization Act (FY19 NDAA), which we have covered previously here. Indeed, the term is defined in virtually the same way as it is in the Section 889 rule:
[A]n inquiry designed to uncover any information in the entity’s possession about the identity of any covered articles, or any products or services produced or provided by a source. This applies when the covered article or the source is subject to an applicable FASCSA order. A reasonable inquiry excludes the need to include an internal or third-party audit.
As with Section 889, the bounds of what information may be considered to be “in the entity’s possession” are not defined, which may cause difficulties for contractors that must determine how and when to limit these inquiries.
To make the representation, contractors must both review the solicitation for any applicable FASCSA orders that are identified in the solicitation and review the System for Award Management for any identified covered articles or sources that may be applicable to the procurement. If covered articles or sources are identified and will be used in performance, then contractors must disclose the nature of those articles or sources to the contracting officer, in order to allow the agency to make a determination as to whether the agency will pursue a waiver.
Waivers are contemplated by the rule, and generally require agencies to submit a request to the agency that issued the FASC order that the order not apply to either the agency, specific actions or acquisitions (including for a limited period of time before compliance with the order is practicable), or other activities as appropriate. In doing so, agencies must submit a “compelling justification for why an exception should be granted,” such as on impacts to “mission-critical functions” or considerations relating to the “national interest.”
Contracting Clause
Future contract awards, including those below the Simplified Acquisition Threshold (SAT) and those for the acquisition of Commercial-Off-The-Shelf (COTS) items, will contain a new clause that similarly requires the contractor to adhere to the prohibition on the provision or use of covered articles or sources during contract performance. The clause, which must be flowed down to subcontractors, only prohibits those articles or sources that were identified as being restricted at the time of the solicitation; prohibitions on new sources or articles are only effective through contract modification.
With this said, contracting agencies are required to modify the contract within six months should applicable FASC orders be identified after issuance of a solicitation or contract. Further, contractors are required to continually check SAM for new covered articles or sources at least every three months, to conduct a reasonable inquiry on any new article or source identified, and – following the procedures described in more detail below – to submit a report to the contracting officer if such an article or source is identified. It is not clear what, if any, action agencies should take if a contractor identifies and reports on a new covered article or source that was not in effect at the time of the solicitation.
Reporting Requirement
If a covered article or source is identified, then contractors are required to report certain information either to the DoD DIBNet (for DoD contracts) or to the contracting officer (civilian and other contracts) within three business days from the date of identification. The report should include, among other things, the name of the product or service provided; the name of the covered article or source subject to a FASC order; brand, model number, and description of the article; and any readily available information about mitigation actions undertaken or recommended. Contractors must follow this report with a second report to be issued ten days after the initial report that contains, among other things, further information about mitigation actions undertaken or recommended and efforts the contractor undertook to prevent submission or use of the covered article or the product or service produced or provided by a source subject to an applicable FASCSA order and efforts to be taken in the future to present such occurrences.
Conclusion
Despite the continued emphasis on supply chain security, the rule differs from existing requirements in some ways, such as by specifying how ongoing diligence must occur, and how often checks need to be made. The requirements will necessitate contractors to assess and likely modify their purchasing approaches. Indeed, the FAR Council itself has recognized the overall complexity of the rule, noting that “[d]ue to the complexity of this novel requirement, it has taken several years to draft and develop the framework of this FAR rule and involved many Government agencies in the process.” Contractors should therefore consider taking steps to develop processes to comply with the rule as soon as possible.
[1] The September 9, 2020 interim rule covered in this alert was finalized by the FASC on August 26, 2021. In describing the changes between the interim rule and the final rule, the FASC stated:
In general, numerous minor changes were made to the interim rule’s text to clarify or simplify it. Although the substance of the final rule largely matches that of the interim rule, several changes have been made in response to public comments and input from Federal stakeholders.
86 Fed. Reg. 47,581, 47,582 (Aug. 26, 2021).