Agency use of IT products

(a)

Definitions

In this section:(1)

Agency

The term agency has the meaning given the term in section 3502 of title 44, United States Code.(2)

Appropriate congressional committees

The term appropriate congressional committees means the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Accountability of the House of Representatives.(3)

Authorized reseller

The term authorized reseller means a reseller, after market manufacturer, supplier, or distributor of a covered product with a direct or prime contractual arrangement with, or the express written authority of, the original equipment manufacturer of the covered product to manufacture, buy, stock, repackage, sell, resell, repair, service, otherwise support, or distribute the covered product.(4)

Covered product

The term covered product—(A)means an information and communications technology end-use hardware product or component, including software and firmware that comprise the end-use hardware product or component; and(B)does not include—(i)other software; or(ii)an end-use hardware product—(I)in which there is embedded information and communications technology; and(II)the principal function of which is not the creation, manipulation, storage, display, receipt, or transmission of electronic data and information.(5)

End-use product

The term end-use product means a product ready for use by the maintainer, integrator, or end user of the product.(6)

Information and communications technology

The term information and communications technology—(A)has the meaning given the term in section 4713 of title 41, United States Code; and(B)includes information and communications technologies covered by definitions contained in the Federal Acquisition Regulation, including definitions added after the date of the enactment of this Act by the Federal Acquisition Regulatory Council pursuant to notice and comment.(7)

Original equipment manufacturer

The term original equipment manufacturer means a company that manufactures a covered product that the company—(A)designed from self-sourced or purchased components; and(B)sells under the name of the company.(b)

Prohibition on procurement and use

Subject to subsection (c) and notwithstanding sections 1905 through 1907 of title 41, United States Code, the head of an agency may not procure or obtain, renew a contract to procure or obtain, or use a covered product that is procured from an entity other than—(1)an original equipment manufacturer; or(2)an authorized reseller.(c)

Waiver

(1)

In general

Upon written notice to the Director of the Office of Management and Budget, the head of an agency may waive the prohibition under subsection (b) with respect to a covered product if the head of the agency determines that—(A)the waiver is necessary in the interest of national security; or(B)procuring, obtaining, or using the covered product is necessary—(i)for the purpose of scientifically valid research (as defined in section 102 the Education Sciences Reform Act of 2002 (20 U.S.C. 9501)); or(ii)to avoid jeopardizing the performance of mission critical functions.(2)

Notice

The notice described in paragraph (1)—(A)shall—(i)specify, with respect to the waiver under paragraph (1)—(I)the justification for the waiver;(II)any security mitigations that have been implemented; and(III)with respect to a waiver that necessitates a security mitigation, the plan of action and milestones to avoid future waivers for subsequent similar purchases; and(ii)be submitted in an unclassified form; and(B)may include a classified annex.(3)

Duration

With respect to a waiver for the purpose of research, as described in paragraph (1)(B)(i), the waiver shall be effective for the duration of the research identified in the waiver.(d)

Reports to congress

(1)

In general

Not later than 1 year after the date of enactment of this Act, and annually thereafter until the date that is 6 years after the date of enactment of this Act, the Director of the Office of Management and Budget shall submit to the appropriate congressional committees a report that lists—(A)the number and types of covered products for which a waiver under subsection (c)(1) was granted during the 1-year period preceding the date of the submission of the report; and(B)the legal authority under which each waiver described in subparagraph (A) was granted, such as whether the waiver was granted pursuant to subparagraph (A) or (B) of subsection (c)(1).(2)

Classification of report

Each report submitted under this subsection—(A)shall be submitted in unclassified form; and(B)may include a classified annex that contains the information described in paragraph (1)(B).(e)

Effective date

This section shall take effect on the date that is 1 year after the date of enactment of this Act.