2019-02529. Defense Federal Acquisition Regulation Supplement: Extension of Supply Chain Risk Management Authority (DFARS Case 2018-D072)

AGENCY:

Defense Acquisition Regulations System, Department of Defense (DoD).

ACTION:

Final rule.

SUMMARY:

DoD is issuing a final rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) to implement a section of the National Defense Authorization Act for Fiscal Year 2019.

DATES:

Effective February 15, 2019.

FOR FURTHER INFORMATION CONTACT:

Ms. Kimberly R. Ziegler, telephone [phone].

SUPPLEMENTARY INFORMATION:

I. Background

DoD is amending the DFARS to implement section 881 of the National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2019 (Pub. L. 115-232). Section 881 codifies the authority for information relating to supply chain risk at 10 U.S.C. 2339a and repeals the sunset date at sections 806(g) of the NDAA for FY 2011 (Pub. L. 111-383), as modified by section 806(a) of the NDAA for FY 2013 (Pub. L. 112-239), making the authority permanent.

DoD published a final rule (DFARS Case 2012-D050) in the Federal Register at 80 FR 67243 on October 30, 2015, to implement section 806 of the NDAA for FY 2011, as amended by section 806 of the NDAA for FY 2013 (Pub. L. 112-239). The objective of the rule was to minimize the potential risk for supplies and services purchased by DoD to maliciously degrade the integrity and operation of sensitive information technology systems. The rule implemented the use of supply chain risk as an evaluation factor in information technology procurements for services or supplies as a covered system, as a part of a covered system, or in support of a covered system. DFARS provision 252.239-7017, Notice of Supply Chain Risk, and DFARS clause 252.239-7018, Supply Chain Risk, were added to inform contractors of the requirement to mitigate supply chain risk in the provision of supplies and services to the Government and other statutory authorities afforded to the Government under section 806.

Section 881 of the NDAA for FY 2019 codified this authority at 10 U.S.C. 2339a and removed the September 30, 2018, sunset date. This final rule removes the sunset date at DFARS 239.7300(b) and changes numerous statutory citations from section 806 of Public Law 111-383 to 10 U.S.C. 2339a. This rule makes no change to the authority for information relating to supply chain risk currently implemented in the DFARS, other than removing the sunset date, updating the statutory citations, and the following minor editorial changes:

• Corrects the reference to 44 U.S.C. 3552(b) in the definition of “covered system.”
• Replaces the description of a national security system with the defined term “covered system” in the definition of “supply chain risk.”
• Changes “Under Secretary of Defense for Acquisition, Technology, and Logistics” to “Under Secretary of Defense for Acquisition and Sustainment.”

II. Publication of This Final Rule for Public Comment Is Not Required by Statute

The statute that applies to the publication of the Federal Acquisition Regulation (FAR) is 41 U.S.C. 1707 entitled “Publication of Proposed Regulations.” Paragraph (a)(1) of the statute requires that a procurement policy, regulation, procedure or form (including an amendment or modification thereof) must be published for public comment if it relates to the expenditure of appropriated funds, and has either a significant effect beyond the internal operating procedures of the agency issuing the policy, regulation, procedure, or form, or has a significant cost or administrative impact on contractors or offerors. This final rule is not required to be published for public comment, because this rule merely removes the sunset date of the existing regulation, making it permanent, and replaces the obsolete statutory citations with the new 10 U.S.C. 2339a reference.

III. Applicability to Contracts at or Below the Simplified Acquisition Threshold and for Commercial Items, Including Commercially Available Off-the-Shelf Items

This rule only removes the sunset date from DFARS 239.7300(b) and updates the statutory citations to 10 U.S.C. 2339a, wherever necessary. The rule continues to prescribe the associated clauses to contracts at or below the simplified acquisition threshold and for commercial items, including commercially available off-the-shelf items.

IV. Executive Orders 12866 and 13563

Executive Orders (E.O.) 12866 and E.O. 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). E.O. 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. This is not a significant regulatory action and, therefore, was not subject to review under section 6(b) of E.O. 12866, Regulatory Planning and Review, dated September 30, 1993. This rule is not a major rule under 5 U.S.C. 804.

V. Executive Order 13771

This final rule is not an E.O. 13771 regulatory action, because this rule is not a significant under E.O. 12866.

VI. Regulatory Flexibility Act

Because a notice of proposed rulemaking and an opportunity for public comment are not required to be given for this rule under 41 U.S.C. 1707(a)(1) (see section II. of this preamble), the analytical requirement of the Regulatory Flexibility Act (5 U.S.C. 601 et seq.) are not applicable. Accordingly, no regulatory flexibility analysis is required, and none has been prepared.

VII. Paperwork Reduction Act

The rule does not contain any information collection requirements that require the approval of the Office of Management and Budget under the Paperwork Reduction Act (44 U.S.C. chapter 35).

List of Subjects in 48 CFR Parts 212, 215, 239, and 252

• Government procurement

Jennifer Lee Hawes,

Regulatory Control Officer, Defense Acquisition Regulations System.

Therefore, 48 CFR 212, 215, 239, and 252 are amended as follows:

1. The authority citation for parts 212, 215, 239, and 252 continues to read as follows:

Authority: 41 U.S.C. 1303 and 48 CFR chapter 1.

PART 212—ACQUISITION OF COMMERCIAL ITEMS

212.301

[Amended]

2. Amend section 212.301, in paragraphs 212.301(f)(xv)(C) and (D), by removing “section 806 of Public Law 111-383” and adding “10 U.S.C. 2339a” in its place in both places.

PART 215—CONTRACTING BY NEGOTIATION

215.503

[Amended]

3. Amend section 215.503 by removing “section 806 of the National Defense Authorization Act for Fiscal Year 2011, as amended by section 806 of the National Defense Authorization Act for Fiscal Year 2013” and adding “ 10 U.S.C. 2339a” in its place.

215.506

[Amended]

4. Amend 215.506, in paragraph (e) by removing “section 806 of the National Defense Authorization Act for Fiscal Year 2011, as amended by section 806 of the National Defense Authorization Act for Fiscal Year 2013” and adding “ 10 U.S.C. 2339a” in its place.

PART 239—ACQUISITION OF INFORMATION TECHNOLOGY

5. Revise section 239.7300 to read as follows:

239.7300

Scope of subpart.

This subpart implements 10 U.S.C. 2339a and elements of DoD Instruction 5200.44, Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN), at https://www.esd.whs.mil/​Portals/​54/​Documents/​DD/​issuances/​dodi/​520044p.pdf?​ver=​2018-11-08-075800-903.

239.7301

[Amended]

6. Amend section 239.7301 by—

a. In the definition of “Covered item of supply” removing “(see section 806(e)(6) of Pub. L. 111-383)” and adding “(see 10 U.S.C. 2339a)” in its place;

b. In the introductory text of the definition of “Covered system” removing “ 44 U.S.C. 3542(b)(see section 806(e)(5) of Pub. L. 111-383)” and adding “44 U.S.C. 3552(b) (see 10 U.S.C. 2339a)” in its place; and

c. In the definition of “Supply chain risk” removing “national security system (as that term is defined at 44 U.S.C. 3542(b))” and “such system” and adding “covered system” and “such system (see 10 U.S.C. 2339a)” in its place, respectively.

239.7302

[Amended]

7. Amend section 239.7302, introductory text, by removing “national security systems, as that term is defined at 44 U.S.C. 3542(b),” and adding “covered systems (see 10 U.S.C. 2339a)” in its place.

239.7303

[Amended]

8. Amend section 239.7303 by—

a. In paragraph (b)(1), removing “Acquisition, Technology, and Logistics” and adding “Acquisition and Sustainment” in its place; and

b. In paragraph (b)(2), removing “senior” and adding “service” in its place.

239.7304

[Amended]

9. Amend section 239.7304, in paragraphs (a), (b) introductory text, and (c)(2)(ii) by removing “Acquisition, Technology, and Logistics” and adding “Acquisition and Sustainment” in their place.

PART 252—SOLICITATION PROVISIONS AND CONTRACT CLAUSES

252.239-7017

[Amended]

10. Amend section 252.239-7017 by—

a. In the clause heading, removing the date “(NOV 2013)” and adding “(FEB 2019)” in its place;

b. In paragraph (a), removing “national security system (as that term is defined at 44 U.S.C. 3542(b))” and “such system” and adding “covered system” and “such system (see 10 U.S.C. 2339a)” in its place, respectively;

c. In paragraph (b) removing “section 806 of Public Law 383” and adding “ 10 U.S.C. 2339a” in its place; and

d. In paragraph (c) removing “section 806 of Public Law 383” and adding “ 10 U.S.C. 2339a” in its place.

252.239-7018

[Amended]

11. Amend section 252.239-7018 by—

a. In the clause heading, removing the date “(OCT 2015)” and adding “(FEB 2019)” in its place;

b. In paragraph (a), in the definition of “Supply chain risk” removing “national security system (as that term is defined at 44 U.S.C. 3542(b))” and “such system” and adding “covered system” and “such system (see 10 U.S.C. 2339a)” in its place, respectively; and

c. In paragraphs (c) and (d), removing “section 806 of Public Law 111-383” and adding “10 U.S.C. 2339a” in its place in both places.