1. (a) Digitization and Modernization.— The Secretary of Defense shall streamline and digitize the Department of Defense approach for identifying and mitigating risks to the defense industrial base.
2. (b) Objective.— The objective of subsection (a) shall be to employ digital tools, technologies, and approaches to ensure the accessibility of relevant defense industrial base data to key decision-makers in the Department.

3. (c) Analytical Framework.—

   1. (1) The Under Secretary of Defense for Acquisition and Sustainment, in coordination with the Director of the Defense Counterintelligence and Security Agency and the heads of other elements of the Department of Defense as appropriate, shall develop an analytical framework for risk mitigation across the acquisition process in implementing subsections (a) and (b).

   2. (2) The analytical framework required under paragraph (1) shall include the following elements:

      1. (A) Characterization and monitoring of supply chain risks, such as those identified through the supply chain risk management process of the Department and by the Federal Acquisition Security Council, and including—

         1. (i) material sources and fragility, including the extent to which sources, items, materials, and articles are mined, produced, or manufactured within or outside the United States;
         2. (ii) telecommunications services or equipment;
         3. (iii) counterfeit parts;
         4. (iv) cybersecurity of contractors;
         5. (v) video surveillance services or equipment;
         6. (vi) vendor vetting in contingency or operational environments;
         7. (vii) other electronic or information technology products and services; and
         8. (viii) other risk areas as determined appropriate by the Secretary of Defense.

      2. (B) Characterization and monitoring of risks posed by contractor behavior that constitutes or may constitute violations of laws or regulations, including those relating to—

         1. (i) fraud;
         2. (ii) ownership structures;
         3. (iii) trafficking in persons;
         4. (iv) workers’ health and safety;
         5. (v) affiliation with the enemy;
         6. (vi) foreign influence; and
         7. (vii) other risk areas as deemed appropriate by the Secretary of Defense.

      3. (C) Characterization and assessment of the acquisition processes and procedures of the Department of Defense, including—

         1. (i) market research;
         2. (ii) responsibility determinations, including consideration of the need for special standards of responsibility to address the risks described in subparagraphs (A) and (B);
         3. (iii) facilities clearances;
         4. (iv) the development of contract requirements;
         5. (v) the technical evaluation of offers and contract awards;
         6. (vi) contractor mobilization, including hiring, training, and establishing facilities;
         7. (vii) contract administration, contract management, and oversight;
         8. (viii) contract audit for closeout;
         9. (ix) suspension and debarment activities and administrative appeals activities;
         10. (x) contractor business system reviews;
         11. (xi) processes and procedures related to supply chain risk management and processes and procedures implemented pursuant to section 3252 of this title; and
         12. (xii) other relevant processes and procedures.

      4. (D) Characterization and monitoring of the health and activities of the defense industrial base, including those relating to—

         1. (i) balance sheets, revenues, profitability, and debt;
         2. (ii) investment, innovation, and technological and manufacturing sophistication;
         3. (iii) finances, access to capital markets, and cost of raising capital within those markets;
         4. (iv) corporate governance, leadership, and culture of performance; and
         5. (v) history of performance on past Department of Defense and government contracts.

      5. (E) Characterization and assessment of industrial base support policies, programs, and procedures, including—

         1. (i) limitations and acquisition guidance relevant to the national technology and industrial base;
         2. (ii) limitations and acquisition guidance relevant to section 4862 of this title;
         3. (iii) the Industrial Base Analysis and Sustainment program of the Department, including direct support and common design activities;
         4. (iv) the Small Business Innovation Research Program (as defined in section 9(e) of the Small Business Act (15 U.S.C. 638(e));
         5. (v) the Manufacturing Technology Program established under section 4841 of this title;
         6. (vi) programs relating to the Defense Production Act of 1950 (50 U.S.C. 4511 et seq.); ¹ and
         7. (vii) programs operating in each military department.

4. (d) Roles and Responsibilities.— The Secretary of Defense shall designate the roles and responsibilities of organizations and individuals to execute activities under this section, including—

   1. (1) the Under Secretary of Defense for Acquisition and Sustainment, including the Office of Defense Pricing and Contracting and the Office of Industrial Policy;
   2. (2) service acquisition executives;
   3. (3) program offices and procuring contracting officers;
   4. (4) administrative contracting officers within the Defense Contract Management Agency and the Supervisor of Shipbuilding;
   5. (5) the Defense Counterintelligence and Security Agency;
   6. (6) the Defense Contract Audit Agency;
   7. (7) each element of the Department of Defense which own or operate systems containing data relevant to contractors of the Department;
   8. (8) the Under Secretary of Defense for Research and Engineering;
   9. (9) the suspension and debarment official of the Department;
   10. (10) the Chief Information Officer; and
   11. (11) other relevant organizations and individuals as deemed appropriate by the Secretary.

5. (e) Enabling Data, Tools, and Systems.—

   1. (1)

      1. (A) The Under Secretary of Defense for Acquisition and Sustainment, in consultation with the Chief Data Officer of the Department of Defense and the Director of the Defense Counterintelligence and Security Agency, shall assess the extent to which existing systems of record relevant to risk assessments and contracting are producing, exposing, and maintaining valid and reliable data for the purposes of the Department’s continuous assessment and mitigation of risks in the defense industrial base.

      2. (B) The assessment required under subparagraph (A) shall include the following elements:

         1. (i) Identification of the necessary source data, to include data from contractors, intelligence and security activities, program offices, and commercial research entities.
         2. (ii) A description of modern data infrastructure, tools, and applications and an assessment of the extent to which new capabilities would improve the effectiveness and efficiency of mitigating the risks described in subsection (c)(2).

         3. (iii) An assessment of the following systems owned or operated outside of the Department of Defense that the Department depends upon or to which it provides data, including the following:

            1. (I) The Federal Awardee Performance and Integrity Information System (FAPIIS).
            2. (II) The System for Award Management (SAM).
            3. (III) The Federal Procurement Data System–Next Generation (FPDS–NG).
            4. (IV) The Electronic Data Management Information System.
            5. (V) Other systems the Secretary of Defense determines appropriate.
         4. (iv) An assessment of systems owned or operated by the Department of Defense, including the Defense Counterintelligence and Security Agency and other defense agencies and field activities used to capture and analyze the status and performance (including past performance) of vendors and contractors.

   2. (2)

      1. (A) Based on the findings pursuant to paragraph (1), the Secretary of Defense shall develop a unified set of activities to modernize the systems of record, data sources and collection methods, and data exposure mechanisms. The unified set of activities should include—

         1. (i) the ability to continuously collect data on, assess, and mitigate risks;
         2. (ii) data analytics and business intelligence tools and methods; and
         3. (iii) continuous development and continuous delivery of secure software to implement the activities.
      2. (B) In connection with the assessments described in this section, the Secretary shall develop capabilities to map supply chains and to assess risks to the supply chain for major end items by business sector, vendor, program, part, and other metrics as determined by the Secretary.
6. (f) Rule of Construction.— Nothing in this section shall be construed to limit or modify any other procurement policy, procedure, requirement, or restriction provided by law.

(Added Pub. L. 116–92, div. A, title VIII, § 845(a), Dec. 20, 2019, 133 Stat. 1500, § 2509; renumbered § 4819 and amended Pub. L. 116–283, div. A, title VIII, § 843(a), title XVIII, §§ 1867(b), (d)(6), 1883(b)(2), Jan. 1, 2021, 134 Stat. 3765, 4281, 4282, 4294; Pub. L. 117–81, div. A, title VIII, § 841, title XVII, § 1701(d)(16), Dec. 27, 2021, 135 Stat. 1839, 2137.)

Editorial Notes

References in Text

The Defense Production Act of 1950 (50 U.S.C. 4511 et seq.), referred to in subsec. (c)(2)(E)(vi), probably means act Sept. 8, 1950, ch. 932, 64 Stat. 798, which is classified principally to chapter 55 (§ 4501 et seq.) of Title 50, War and National Defense. For complete classification of this Act to the Code, see section 4501 of Title 50 and Tables.

Amendments

2021—Pub. L. 116–283, § 1867(b), renumbered section 2509 of this title as this section.

Subsec. (a). Pub. L. 117–81, § 841(1), struck out “existing” before “Department of Defense approach” and “across the acquisition process, creating a continuous model that uses digital tools, technologies, and approaches designed to ensure the accessibility of data to key decision-makers in the Department” before period at end.

Subsec. (b). Pub. L. 117–81, § 841(4), added subsec. (b). Former subsec. (b) redesignated (c).

Subsec. (b)(2)(A). Pub. L. 116–283, § 843(a)(1)(A)(i), inserted “such as those identified through the supply chain risk management process of the Department and by the Federal Acquisition Security Council, and” after “supply chain risks,” in introductory provisions.

Subsec. (b)(2)(A)(ii). Pub. L. 116–283, § 843(a)(1)(A)(ii), struck out “(other than optical transmission components)” after “equipment”.

Subsec. (b)(2)(C)(xi). Pub. L. 117–81, § 1701(d)(16)(A), which directed the substitution of “section 3252” for “section 2339a”, could not be executed as directed because “section 2339a” did not appear in subsec. (b)(2)(C)(xi) after the intervening redesignation of subsec. (b) of this section as subsec. (c) by Pub. L. 117–81, § 841(3), and was not executed in subsec. (c)(2)(C)(xi) as redesignated to reflect the probable intent of Congress, because of the intervening amendment by Pub. L. 116–283, § 1883(b)(2). See notes below.

Pub. L. 116–283, § 843(a)(1)(B), added cl. (xi). Former cl. (xi) redesignated (xii).

Subsec. (b)(2)(C)(xii). Pub. L. 116–283, § 843(a)(1)(B)(ii), redesignated cl. (xi) as (xii).

Subsec. (b)(2)(E). Pub. L. 116–283, § 843(a)(1)(C), added subpar. (E).

Subsec. (b)(2)(E)(ii). Pub. L. 117–81, § 1701(d)(16)(B)(ii), which directed the substitution of “section 4862” for “section 2533a”, could not be executed as directed because “section 2533a” did not appear in subsec. (b)(2)(E)(ii) after the intervening redesignation of subsec. (b) of this section as subsec. (c) by Pub. L. 117–81, § 841(3), and was not executed in subsec. (c)(2)(E)(ii) as redesignated to reflect the probable intent of Congress, because of the intervening amendment by Pub. L. 116–283, § 1883(b)(2). See notes below.

Subsec. (b)(2)(E)(v). Pub. L. 117–81, § 1701(d)(16)(B)(iii), which directed the substitution of “sections 4841 and 4842” for “section 2521”, could not be executed as directed because “section 2521” did not appear in subsec. (b)(2)(E)(v) after the intervening redesignation of subsec. (b) of this section as subsec. (c) by Pub. L. 117–81, § 841(3), and was not executed in subsec. (c)(2)(E)(v) as redesignated to reflect the probable intent of Congress, because of the intervening amendment by Pub. L. 116–283, § 1883(b)(2). See notes below.

Subsec. (c). Pub. L. 117–81, § 841(3), redesignated subsec. (b) as (c). Former subsec. (c) redesignated (d).

Subsec. (c)(1). Pub. L. 117–81, § 841(5)(A), inserted “in implementing subsections (a) and (b)” before period at end.

Subsec. (c)(2)(A)(viii). Pub. L. 117–81, § 841(5)(B)(i), inserted “by the Secretary of Defense” before period at end.

Subsec. (c)(2)(B). Pub. L. 117–81, § 841(5)(B)(ii)(I), substituted “constitutes or may constitute” for “constitute” in introductory provisions.

Subsec. (c)(2)(B)(vii). Pub. L. 117–81, § 841(5)(B)(ii)(II), inserted “by the Secretary of Defense” before period at end.

Subsec. (c)(2)(C)(xi). Pub. L. 116–283, § 1883(b)(2), substituted “section 3252” for “section 2339a”.

Subsec. (c)(2)(E)(i). Pub. L. 117–81, § 1701(d)(16)(B)(i), which directed amendment of subsec. (b)(2)(E)(i) by striking out “(as defined in section 2500(1) of this title)”, was executed by striking out “(as defined in section 4801(1) of this title)” before semicolon at end of subsec. (c)(2)(E)(i) to reflect the probable intent of Congress and the intervening amendments by Pub. L. 116–283, § 1883(b)(2), and Pub. L. 117–81, § 841(3). See notes above and below.

Pub. L. 116–283, § 1883(b)(2), substituted “section 4801(1)” for “section 2500(1)”.

Subsec. (c)(2)(E)(ii). Pub. L. 116–283, § 1883(b)(2), substituted “section 4862” for “section 2533a”.

Subsec. (c)(2)(E)(v). Pub. L. 116–283, § 1883(b)(2), substituted “section 4841” for “section 2521”.

Subsec. (d). Pub. L. 117–81, § 841(3), redesignated subsec. (c) as (d). Former subsec. (d) redesignated (e).

Subsec. (d)(11). Pub. L. 117–81, § 841(6), inserted “as deemed appropriate by the Secretary” before period at end.

Subsec. (e). Pub. L. 117–81, § 841(3), redesignated subsec. (d) as (e). Former subsec. (e) redesignated (f).

Subsec. (e)(1)(A). Pub. L. 117–81, § 841(7)(A)(i), struck out “timely” before “maintaining valid and reliable data”.

Subsec. (e)(1)(B)(ii). Pub. L. 117–81, § 841(7)(A)(ii)(I), added cl. (ii) and struck out former cl. (ii) which read as follows: “A description of the modern data infrastructure, tools, and applications and what changes would improve the effectiveness and efficiency of mitigating the risks described in subsection (b)(2).”

Subsec. (e)(2). Pub. L. 117–81, § 841(7)(B), added par. (2) and struck out former par. (2) which related to Secretary of Defense’s development of unified set of activities to modernize systems of record, data sources and collection methods, and data exposure mechanisms.

Subsec. (f). Pub. L. 117–81, § 841(2), (3), redesignated subsec. (e) as (f) and struck out former subsec. (f) which related to implementation and reporting requirements.

Subsec. (f)(1)(A). Pub. L. 116–283, § 1867(d)(6), which directed the substitution of “section 3252(c)” for “section 2339a(e)”, could not be executed because of the prior repeal of subsec. (f) by Pub. L. 117–81, § 841(2). See note above.

Subsec. (f)(2). Pub. L. 116–283, § 843(a)(2), inserted “, and supporting policies, procedures, and guidance relating to such actions” after “subsection (b)”.

Subsec. (g). Pub. L. 117–81, § 841(2), struck out subsec. (g) which related to briefing and periodic assessments of reviews by Comptroller General.

Statutory Notes and Related Subsidiaries

Effective Date of 2021 Amendment

Amendment by section 1701(d)(16) of Pub. L. 117–81 to take effect immediately after the amendments made by title XVIII of Pub. L. 116–283 have taken effect, see section 1701(a)(3) of Pub. L. 117–81, set out in a Technical, Conforming, and Clerical Amendments Related to Title XVIII of the Fiscal Year 2021 NDAA note preceding section 3001 of this title and note below.

Amendment by sections 1867(b), (d)(6) and 1883(b)(2) of Pub. L. 116–283 effective Jan. 1, 2022, with additional provisions for delayed implementation and applicability of existing law, see section 1801(d) of Pub. L. 116–283, set out as a note preceding section 3001 of this title.

¹ See References in Text note below.