1. (a) Digitization and Modernization.— The Secretary of Defense shall streamline and digitize the existing Department of Defense approach for identifying and mitigating risks to the defense industrial base across the acquisition process, creating a continuous model that uses digital tools, technologies, and approaches designed to ensure the accessibility of data to key decision-makers in the Department.

2. (b) Analytical Framework.—

   1. (1) The Under Secretary of Defense for Acquisition and Sustainment, in coordination with the Director of the Defense Counterintelligence and Security Agency and the heads of other elements of the Department of Defense as appropriate, shall develop an analytical framework for risk mitigation across the acquisition process.

   2. (2) The analytical framework required under paragraph (1) shall include the following elements:

      1. (A) Characterization and monitoring of supply chain risks, such as those identified through the supply chain risk management process of the Department and by the Federal Acquisition Security Council, and including—

         1. (i) material sources and fragility, including the extent to which sources, items, materials, and articles are mined, produced, or manufactured within or outside the United States;
         2. (ii) telecommunications services or equipment;
         3. (iii) counterfeit parts;
         4. (iv) cybersecurity of contractors;
         5. (v) video surveillance services or equipment;
         6. (vi) vendor vetting in contingency or operational environments;
         7. (vii) other electronic or information technology products and services; and
         8. (viii) other risk areas as determined appropriate.

      2. (B) Characterization and monitoring of risks posed by contractor behavior that constitute violations of laws or regulations, including those relating to—

         1. (i) fraud;
         2. (ii) ownership structures;
         3. (iii) trafficking in persons;
         4. (iv) workers’ health and safety;
         5. (v) affiliation with the enemy;
         6. (vi) foreign influence; and
         7. (vii) other risk areas as deemed appropriate.

      3. (C) Characterization and assessment of the acquisition processes and procedures of the Department of Defense, including—

         1. (i) market research;
         2. (ii) responsibility determinations, including consideration of the need for special standards of responsibility to address the risks described in subparagraphs (A) and (B);
         3. (iii) facilities clearances;
         4. (iv) the development of contract requirements;
         5. (v) the technical evaluation of offers and contract awards;
         6. (vi) contractor mobilization, including hiring, training, and establishing facilities;
         7. (vii) contract administration, contract management, and oversight;
         8. (viii) contract audit for closeout;
         9. (ix) suspension and debarment activities and administrative appeals activities;
         10. (x) contractor business system reviews;
         11. (xi) processes and procedures related to supply chain risk management and processes and procedures implemented pursuant to section 2339a of this title; and
         12. (xii) other relevant processes and procedures.

      4. (D) Characterization and monitoring of the health and activities of the defense industrial base, including those relating to—

         1. (i) balance sheets, revenues, profitability, and debt;
         2. (ii) investment, innovation, and technological and manufacturing sophistication;
         3. (iii) finances, access to capital markets, and cost of raising capital within those markets;
         4. (iv) corporate governance, leadership, and culture of performance; and
         5. (v) history of performance on past Department of Defense and government contracts.

      5. (E) Characterization and assessment of industrial base support policies, programs, and procedures, including—

         1. (i) limitations and acquisition guidance relevant to the national technology and industrial base (as defined in section 2500(1) of this title);
         2. (ii) limitations and acquisition guidance relevant to section 2533a of this title;
         3. (iii) the Industrial Base Analysis and Sustainment program of the Department, including direct support and common design activities;
         4. (iv) the Small Business Innovation Research Program (as defined in section 9(e) of the Small Business Act (15 U.S.C. 638(e));
         5. (v) the Manufacturing Technology Program established under section 2521 of this title;
         6. (vi) programs relating to the Defense Production Act of 1950 (50 U.S.C. 4511 et seq.); ¹ and
         7. (vii) programs operating in each military department.

3. (c) Roles and Responsibilities.— The Secretary of Defense shall designate the roles and responsibilities of organizations and individuals to execute activities under this section, including—

   1. (1) the Under Secretary of Defense for Acquisition and Sustainment, including the Office of Defense Pricing and Contracting and the Office of Industrial Policy;
   2. (2) service acquisition executives;
   3. (3) program offices and procuring contracting officers;
   4. (4) administrative contracting officers within the Defense Contract Management Agency and the Supervisor of Shipbuilding;
   5. (5) the Defense Counterintelligence and Security Agency;
   6. (6) the Defense Contract Audit Agency;
   7. (7) each element of the Department of Defense which own or operate systems containing data relevant to contractors of the Department;
   8. (8) the Under Secretary of Defense for Research and Engineering;
   9. (9) the suspension and debarment official of the Department;
   10. (10) the Chief Information Officer; and
   11. (11) other relevant organizations and individuals.

4. (d) Enabling Data, Tools, and Systems.—

   1. (1)

      1. (A) The Under Secretary of Defense for Acquisition and Sustainment, in consultation with the Chief Data Officer of the Department of Defense and the Director of the Defense Counterintelligence and Security Agency, shall assess the extent to which existing systems of record relevant to risk assessments and contracting are producing, exposing, and timely maintaining valid and reliable data for the purposes of the Department’s continuous assessment and mitigation of risks in the defense industrial base.

      2. (B) The assessment required under subparagraph (A) shall include the following elements:

         1. (i) Identification of the necessary source data, to include data from contractors, intelligence and security activities, program offices, and commercial research entities.
         2. (ii) A description of the modern data infrastructure, tools, and applications and what changes would improve the effectiveness and efficiency of mitigating the risks described in subsection (b)(2).

         3. (iii) An assessment of the following systems owned or operated outside of the Department of Defense that the Department depends upon or to which it provides data:

            1. (I) The Federal Awardee Performance and Integrity Information System (FAPIIS).
            2. (II) The System for Award Management (SAM).
            3. (III) The Federal Procurement Data System–Next Generation (FPDS–NG).
            4. (IV) The Electronic Data Management Information System.
            5. (V) Other systems the Secretary of Defense determines appropriate.
         4. (iv) An assessment of systems owned or operated by the Department of Defense, including the Defense Counterintelligence and Security Agency and other defense agencies and field activities used to capture and analyze the status and performance (including past performance) of vendors and contractors.

   2. (2) Based on the findings pursuant to paragraph (1), the Secretary of Defense shall develop a unified set of activities to modernize the systems of record, data sources and collection methods, and data exposure mechanisms. The unified set of activities should feature—

      1. (A) the ability to continuously collect data on, assess, and mitigate risks;
      2. (B) data analytics and business intelligence tools and methods; and
      3. (C) continuous development and continuous delivery of secure software to implement the activities.
5. (e) Rule of Construction.— Nothing in this section shall be construed to limit or modify any other procurement policy, procedure, requirement, or restriction provided by law.

6. (f) Implementation and Reporting Requirements.— The Secretary of Defense shall carry out the implementation phases set forth in, and submit to the congressional defense committees the items of information required by, the following paragraphs:

   1. (1) Phase 1: implementation plan.— Not later than 90 days after the date of the enactment of this section, an implementation plan and schedule for carrying out the framework established pursuant to subsection (b), including—

      1. (A) a discussion and recommendations for any changes to, or exemptions from, laws necessary for effective implementation, including updating the definitions in section 2339a(e) of this title relating to covered procurement, covered system, and covered item of supply, and any similar terms defined in other law or regulation; and
      2. (B) a process for an entity to contact the Department after the entity has taken steps to remediate, mitigate, or otherwise address the risks identified by the Department in conducting activities under subsection (b).
   2. (2) Phase 2: implementation of framework.— Not later than one year after the date of the submission of the implementation plan and schedule required under paragraph (1), a report on the actions taken to implement the framework established pursuant to subsection (b), and supporting policies, procedures, and guidance relating to such actions.

7. (g) Comptroller General Reviews.—

   1. (1) Briefing.— Not later than February 15, 2020, the Comptroller General of the United States shall brief the congressional defense committees on Department of Defense efforts over the previous 5 years to continuously assess and mitigate risks to the defense industrial base across the acquisition process, and a summary of current and planned efforts.
   2. (2) Periodic assessments.— The Comptroller General shall submit to the congressional defense committees three periodic assessments of Department of Defense progress in implementing the framework required under subsection (b), to be provided not later than October 15, 2020, March 15, 2022, and March 15, 2024.

(Added Pub. L. 116–92, div. A, title VIII, § 845(a), Dec. 20, 2019, 133 Stat. 1500; amended Pub. L. 116–283, div. A, title VIII, § 843(a), Jan. 1, 2021, 134 Stat. 3765.)

Renumbering of Section

Pub. L. 116–283, div. A, title XVIII, §§ 1801(d), 1867(b), Jan. 1, 2021, 134 Stat. 4151, 4281, provided that, effective Jan. 1, 2022, with additional provisions for delayed implementation and applicability of existing law, this section is renumbered section 4819 of this title. See Effective Date of 2021 Amendment note below.

References in Text

The Defense Production Act of 1950 (50 U.S.C. 4511 et seq.), referred to in subsec. (b)(2)(E)(vi), probably means act Sept. 8, 1950, ch. 932, 64 Stat. 798, which is classified principally to chapter 55 (§ 4501 et seq.) of Title 50, War and National Defense. For complete classification of this Act to the Code, see section 4501 of Title 50 and Tables.

The date of the enactment of this section, referred to in subsec. (f)(1), is the date of enactment of Pub. L. 116–92, which was approved Dec. 20, 2019.

Prior Provisions

A prior section 2509, added Pub. L. 101–510, div. A, title VIII, § 825(a), Nov. 5, 1990, 104 Stat. 1604; amended Pub. L. 102–484, div. A, title X, § 1052(34), Oct. 23, 1992, 106 Stat. 2501, required submission of defense industrial base annual reports, prior to repeal by Pub. L. 102–484, § 4202(a).

A prior section 2510, added Pub. L. 101–510, div. A, title VIII, § 826(a)(1), Nov. 5, 1990, 104 Stat. 1605, related to defense industrial base for textile and apparel products, prior to repeal by Pub. L. 102–484, § 4202(a).

Amendments

2021—Subsec. (b)(2)(A). Pub. L. 116–283, § 843(a)(1)(A)(i), inserted “such as those identified through the supply chain risk management process of the Department and by the Federal Acquisition Security Council, and” after “supply chain risks,” in introductory provisions.

Subsec. (b)(2)(A)(ii). Pub. L. 116–283, § 843(a)(1)(A)(ii), struck out “(other than optical transmission components)” after “equipment”.

Subsec. (b)(2)(C)(xi), (xii). Pub. L. 116–283, § 843(a)(1)(B), added cl. (xi) and redesignated former cl. (xi) as (xii).

Subsec. (b)(2)(E). Pub. L. 116–283, § 843(a)(1)(C), added subpar. (E).

Subsec. (f)(2). Pub. L. 116–283, § 843(a)(2), inserted “, and supporting policies, procedures, and guidance relating to such actions” after “subsection (b)”.

Effective Date of 2021 Amendment

Amendment by section 1867(b) of Pub. L. 116–283 effective Jan. 1, 2022, with additional provisions for delayed implementation and applicability of existing law, see section 1801(d) of Pub. L. 116–283, set out as a note preceding section 3001 of this title.

Mitigating Risks Related to Foreign Ownership, Control, or Influence of Department of Defense Contractors or Subcontractors

Pub. L. 116–283, div. A, title VIII, § 819(c), Jan. 1, 2021, 134 Stat. 3752, provided that:

1. “(1) Implementation plan.— Not later than March 1, 2021, the Secretary of Defense shall provide to the congressional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives] a plan and schedule for implementation of the requirements of section 847 of the National Defense Authorization Act for Fiscal Year 2020 (Public Law 116–92; 133 Stat. 1505; 10 U.S.C. 2509 note) [set out below], as amended by this section, including—

   1. “(A) a timeline for issuance of regulations, development of training for appropriate officials, and development of systems for reporting of beneficial ownership and FOCI by covered contractors or subcontractors;
   2. “(B) the designation of officials and organizations responsible for such implementation; and
   3. “(C) interim milestones to be met in implementing the plan and schedule.
2. “(2) Revision of regulations, directives, guidance, training, and policies.— Not later than July 1, 2021, the Secretary of Defense shall revise relevant directives, guidance, training, and policies, including revising the Department of Defense Supplement to the Federal Acquisition Regulation, to fully implement the requirements of such section 847.
3. “(3) Definitions.— In this subsection, the term ‘beneficial ownership’, ‘FOCI’, and ‘covered contractors or subcontractors’ have the meanings given, respectively, in section 847 of the National Defense Authorization Act for Fiscal Year 2020 (Public Law 116–92; 133 Stat. 1505; 10 U.S.C. 2509 note).”

Pub. L. 116–92, div. A, title VIII, § 847, Dec. 20, 2019, 133 Stat. 1505, as amended by Pub. L. 116–283, div. A, title VIII, § 819(a), (b), (d), Jan. 1, 2021, 134 Stat. 3751, 3752, provided that:

1. “(a) Definitions.— In this section:

   1. “(1) Beneficial owner; beneficial ownership.— The terms ‘beneficial owner’ and ‘beneficial ownership’ shall be determined in a manner that is not less stringent than the manner set forth in section 240.13d–3 of title 17, Code of Federal Regulations (as in effect on the date of the enactment of this Act [Dec. 20, 2019]).
   2. “(2) Company.— The term ‘company’ means any corporation, company, limited liability company, limited partnership, business trust, business association, or other similar entity.
   3. “(3) Covered contractor or subcontractor.— The term ‘covered contractor or subcontractor’ means a company that is an existing or prospective contractor or subcontractor of the Department of Defense on a contract or subcontract with a value in excess of $5,000,000, except as provided in subsection (c).
   4. “(4) Foreign ownership, control, or influence; foci.— The terms ‘foreign ownership, control, or influence’ and ‘FOCI’ have the meanings given those terms in the National Industrial Security Program Operating Manual (DOD 5220.22–M), or a successor document.

2. “(b) Improved Assessment and Mitigation of Risks Related to Foreign Ownership, Control, or Influence.—

   1. “(1) In general.— In developing and implementing the analytical framework for mitigating risk relating to ownership structures, as required by section 2509 of title 10, United States Code, as added by section 845 of this Act, the Secretary of Defense shall improve the process and procedures for the assessment and mitigation of risks related to foreign ownership, control, or influence (FOCI) of covered contractors or subcontractors doing business with the Department of Defense.

   2. “(2) Elements.— The process and procedures for the assessment and mitigation of risk relating to ownership structures referred to in paragraph (1) shall include the following elements:

      1. “(A) Assessment of foci.—

         1. (i) A requirement for covered contractors or subcontractors to disclose to the Defense Counterintelligence and Security Agency, or its successor organization, their beneficial ownership and whether they are under FOCI.
         2. “(ii) A requirement to update such disclosures when changes occur to information previously provided, consistent with or similar to the procedures for updating FOCI information under the National Industrial Security Program Operating Manual (DOD 5220.22–M), or a successor document.
         3. “(iii) A requirement for covered contractors or subcontractors determined to be under FOCI to disclose contact information for each of its foreign owners that is a beneficial owner.
         4. “(iv) A requirement that, at a minimum, the disclosures required by this paragraph be provided at the time the contract or subcontract is awarded, amended, or renewed, but in no case later than one year after the Secretary prescribes regulations to carry out this subsection.
         5. “(v) A requirement for the Secretary to require reports and conduct examinations on a periodic basis of covered contractors or subcontractors in order to assess compliance with the requirements of this section.

      2. “(B) Responsibility determination.— Consistent with section 2509 of title 10, United States Code, as added by section 845 of this Act, consideration of FOCI risks as part of responsibility determinations, including—

         1. “(i) whether to establish a special standard of responsibility relating to FOCI risks for covered contractors or subcontractors, and the extent to which the policies and procedures consistent with or similar to those relating to FOCI under the National Industrial Security Program shall be applied to covered contractors or subcontractors;
         2. “(ii) procedures for contracting officers making responsibility determinations regarding whether covered contractors or subcontractors may be under foreign ownership, control, or influence and for determining whether there is reason to believe that such foreign ownership, control, or influence would pose a risk or potential risk to national security or potential compromise because of sensitive data, systems, or processes, such as personally identifiable information, cybersecurity, or national security systems involved with the contract or subcontract; and
         3. “(iii) modification of policies, directives, and practices to provide that an assessment that a covered contractor or subcontractor is under FOCI may be a sufficient basis for a contracting officer to determine that such a covered contractor or subcontractor is not responsible.

      3. “(C) Contract requirements, administration, and oversight relating to foci.—

         1. “(i) Requirements for contract clauses providing for and enforcing disclosures related to changes in FOCI or beneficial ownership during performance of the contract or subcontract, consistent with subparagraph (A), and necessitating the effective mitigation of risks related to FOCI throughout the duration of the contract or subcontract.
         2. “(ii) Pursuant to section 2509(c) of title 10, United States Code, designation of the appropriate Department of Defense official responsible to approve and to take actions relating to award, modification, termination of a contract, or direction to modify or terminate a subcontract due to an assessment by the Defense Counterintelligence and Security Agency, or its successor organization, that a covered contractor or subcontractor under FOCI poses a risk to national security or potential risk of compromise.
         3. “(iii) A requirement for the provision of additional information regarding beneficial ownership and control of any covered contractor or subcontractor on the contract or subcontract.
         4. “(iv) Procedures for appropriately responding to changes in covered contractor or subcontractor beneficial ownership status based on changes in disclosures of their beneficial ownership and whether they are under FOCI and the reports and examinations required by subparagraph (A)(v).
         5. “(v) Other measures as necessary to be consistent with other relevant practices, policies, regulations, and actions, including those under the National Industrial Security Program.

3. “(c) Applicability to Contracts and Subcontracts for Commercial Products and Services and Other Forms of Acquisition Agreements.—

   1. “(1) Commercial products and services.— The requirements under subsections (b)(2)(A) and (b)(2)(C) shall not apply to a contract or subcontract for commercial products or services, unless a designated senior Department of Defense official specifically requires the applicability of subsections (b)(2)(A) and (b)(2)(C) based on a determination by the designated senior official that the contract or subcontract involves a risk or potential risk to national security or potential compromise because of sensitive data, systems, or processes, such as personally identifiable information, cybersecurity, or national security systems.
   2. “(2) Research and development and procurement activities.— The Secretary of Defense shall ensure that the requirements of this section are applied to research and development and procurement activities, including for the delivery of services, established through any means including those under section 2358(b) of title 10, United States Code.
4. “(d) Availability of Resources.— The Secretary shall ensure that sufficient resources, including subject matter expertise, are allocated to execute the functions necessary to carry out this section, including the assessment, mitigation, contract administration, and oversight functions.
5. “(e) Rule of Construction.— Nothing in this section shall be construed to limit or modify any other procurement policy, procedure, requirement, or restriction provided by law, including section 721 of the Defense Production Act of 1950 (50 U.S.C. 4565), as amended by the Foreign Interference Risk Review Modernization Act of 2018 (subtitle A of title XVII of Public Law 115–232).

6. “(f) Availability of Beneficial Ownership Data.—

   1. “(1) In general.— Not later than 180 days after the date of the enactment of this Act, the Secretary of Defense shall establish a process to update systems of record to improve the assessment and mitigation of risks associated with FOCI through the inclusion and updating of all appropriate associated uniquely identifying information about the contracts and contractors and subcontracts and subcontractors in the Federal Awardee Performance and Integrity Information System (FAPIIS), administered by the General Services Administration, and the Commercial and Government Entity (CAGE) database, administered by the Defense Logistics Agency.

   2. “(2) Limited availability of information.— The Secretary of Defense shall ensure that the information required to be disclosed pursuant to this section is—

      1. “(A) not made public;
      2. “(B) made available via the FAPIIS and CAGE databases; and
      3. “(C) made available to appropriate government departments or agencies.”

¹ See References in Text note below.