[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 4651 Introduced in Senate (IS)]

<DOC>






118th CONGRESS
  2d Session
                                S. 4651

 To require agencies to use information and communications technology 
 products obtained from original equipment manufacturers or authorized 
                   resellers, and for other purposes.


_______________________________________________________________________


                   IN THE SENATE OF THE UNITED STATES

                             July 10, 2024

Mr. Cornyn (for himself and Mr. Peters) introduced the following bill; 
which was read twice and referred to the Committee on Homeland Security 
                        and Governmental Affairs

_______________________________________________________________________

                                 A BILL


 
 To require agencies to use information and communications technology 
 products obtained from original equipment manufacturers or authorized 
                   resellers, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Securing America's Federal Equipment 
in Supply Chains Act'' or the ``SAFE Supply Chains Act''.

SEC. 2. AGENCY USE OF IT PRODUCTS.

    (a) Definitions.--In this section:
            (1) Agency.--The term ``agency'' has the meaning given the 
        term in section 3502 of title 44, United States Code.
            (2) Appropriate congressional committees.--The term 
        ``appropriate congressional committees'' means the Committee on 
        Homeland Security and Governmental Affairs of the Senate and 
        the Committee on Oversight and Accountability of the House of 
        Representatives.
            (3) Authorized reseller.--The term ``authorized reseller'' 
        means a reseller, after market manufacturer, supplier, or 
        distributor of a covered product with a direct or prime 
        contractual arrangement with, or the express written authority 
        of, the original equipment manufacturer of the covered product 
        to manufacture, buy, stock, repackage, sell, resell, repair, 
        service, otherwise support, or distribute the covered product.
            (4) Covered product.--The term ``covered product''--
                    (A) means an information and communications 
                technology end-use hardware product or component, 
                including software and firmware that comprise the end-
                use hardware product or component; and
                    (B) does not include--
                            (i) other software; or
                            (ii) an end-use hardware product--
                                    (I) in which there is embedded 
                                information and communications 
                                technology; and
                                    (II) the principal function of 
                                which is not the creation, 
                                manipulation, storage, display, 
                                receipt, or transmission of electronic 
                                data and information.
            (5) End-use product.--The term ``end-use product'' means a 
        product ready for use by the maintainer, integrator, or end 
        user of the product.
            (6) Information and communications technology.--The term 
        ``information and communications technology''--
                    (A) has the meaning given the term in section 4713 
                of title 41, United States Code; and
                    (B) includes information and communications 
                technologies covered by definitions contained in the 
                Federal Acquisition Regulation, including definitions 
                added after the date of the enactment of this Act by 
                the Federal Acquisition Regulatory Council pursuant to 
                notice and comment.
            (7) Original equipment manufacturer.--The term ``original 
        equipment manufacturer'' means a company that manufactures a 
        covered product that the company--
                    (A) designed from self-sourced or purchased 
                components; and
                    (B) sells under the name of the company.
    (b) Prohibition on Procurement and Use.--Subject to subsection (c) 
and notwithstanding sections 1905 through 1907 of title 41, United 
States Code, the head of an agency may not procure or obtain, renew a 
contract to procure or obtain, or use a covered product that is 
procured from an entity other than--
            (1) an original equipment manufacturer; or
            (2) an authorized reseller.
    (c) Waiver.--
            (1) In general.--Upon written notice to the Director of the 
        Office of Management and Budget, the head of an agency may 
        waive the prohibition under subsection (b) with respect to a 
        covered product if the head of the agency determines that--
                    (A) the waiver is necessary in the interest of 
                national security; or
                    (B) procuring, obtaining, or using the covered 
                product is necessary--
                            (i) for the purpose of scientifically valid 
                        research (as defined in section 102 the 
                        Education Sciences Reform Act of 2002 (20 
                        U.S.C. 9501)); or
                            (ii) to avoid jeopardizing the performance 
                        of mission critical functions.
            (2) Notice.--The notice described in paragraph (1)--
                    (A) shall--
                            (i) specify, with respect to the waiver 
                        under paragraph (1)--
                                    (I) the justification for the 
                                waiver;
                                    (II) any security mitigations that 
                                have been implemented; and
                                    (III) with respect to a waiver that 
                                necessitates a security mitigation, the 
                                plan of action and milestones to avoid 
                                future waivers for subsequent similar 
                                purchases; and
                            (ii) be submitted in an unclassified form; 
                        and
                    (B) may include a classified annex.
            (3) Duration.--With respect to a waiver for the purpose of 
        research, as described in paragraph (1)(B)(i), the waiver shall 
        be effective for the duration of the research identified in the 
        waiver.
    (d) Reports to Congress.--
            (1) In general.--Not later than 1 year after the date of 
        enactment of this Act, and annually thereafter until the date 
        that is 6 years after the date of enactment of this Act, the 
        Director of the Office of Management and Budget shall submit to 
        the appropriate congressional committees a report that lists--
                    (A) the number and types of covered products for 
                which a waiver under subsection (c)(1) was granted 
                during the 1-year period preceding the date of the 
                submission of the report; and
                    (B) the legal authority under which each waiver 
                described in subparagraph (A) was granted, such as 
                whether the waiver was granted pursuant to subparagraph 
                (A) or (B) of subsection (c)(1).
            (2) Classification of report.--Each report submitted under 
        this subsection--
                    (A) shall be submitted in unclassified form; and
                    (B) may include a classified annex that contains 
                the information described in paragraph (1)(B).
    (e) Effective Date.--This section shall take effect on the date 
that is 1 year after the date of enactment of this Act.
                                 <all>