[Federal Register Volume 84, Number 32 (Friday, February 15, 2019)]
[Rules and Regulations]
[Pages 4368-4370]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-02529]
-----------------------------------------------------------------------
DEPARTMENT OF DEFENSE
Defense Acquisition Regulations System
48 CFR Parts 212, 215, 239, and 252
[Docket DARS-2019-0002]
RIN 0750-AK26
Defense Federal Acquisition Regulation Supplement: Extension of
Supply Chain Risk Management Authority (DFARS Case 2018-D072)
AGENCY: Defense Acquisition Regulations System, Department of Defense
(DoD).
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: DoD is issuing a final rule amending the Defense Federal
Acquisition Regulation Supplement (DFARS) to implement a section of the
National Defense Authorization Act for Fiscal Year 2019.
DATES: Effective February 15, 2019.
FOR FURTHER INFORMATION CONTACT: Ms. Kimberly R. Ziegler, telephone
571-372-6095.
SUPPLEMENTARY INFORMATION:
I. Background
DoD is amending the DFARS to implement section 881 of the National
Defense Authorization Act (NDAA) for Fiscal Year (FY) 2019 (Pub. L.
115-232). Section 881 codifies the authority for information relating
to supply chain risk at 10 U.S.C. 2339a and repeals the sunset date at
sections 806(g) of the NDAA for FY 2011 (Pub. L. 111-383), as modified
by section 806(a) of the NDAA for FY 2013 (Pub. L. 112-239), making the
authority permanent.
DoD published a final rule (DFARS Case 2012-D050) in the Federal
Register at 80 FR 67243 on October 30, 2015, to implement section 806
of the NDAA for FY 2011, as amended by section 806 of the NDAA for FY
2013 (Pub. L. 112-239). The objective of the rule was to minimize the
potential risk for supplies and services purchased by DoD to
maliciously degrade the integrity and operation of sensitive
information technology systems. The rule implemented the use of supply
chain risk as an evaluation factor in information technology
procurements for services or supplies as a covered system, as a part of
a covered system, or in support of a covered system. DFARS provision
252.239-7017, Notice of Supply Chain Risk, and DFARS clause 252.239-
7018, Supply Chain Risk, were added to inform contractors of the
requirement to mitigate supply chain risk in the provision of supplies
and
[[Page 4369]]
services to the Government and other statutory authorities afforded to
the Government under section 806.
Section 881 of the NDAA for FY 2019 codified this authority at 10
U.S.C. 2339a and removed the September 30, 2018, sunset date. This
final rule removes the sunset date at DFARS 239.7300(b) and changes
numerous statutory citations from section 806 of Public Law 111-383 to
10 U.S.C. 2339a. This rule makes no change to the authority for
information relating to supply chain risk currently implemented in the
DFARS, other than removing the sunset date, updating the statutory
citations, and the following minor editorial changes:
Corrects the reference to 44 U.S.C. 3552(b) in the
definition of ``covered system.''
Replaces the description of a national security system
with the defined term ``covered system'' in the definition of ``supply
chain risk.''
Changes ``Under Secretary of Defense for Acquisition,
Technology, and Logistics'' to ``Under Secretary of Defense for
Acquisition and Sustainment.''
II. Publication of This Final Rule for Public Comment Is Not Required
by Statute
The statute that applies to the publication of the Federal
Acquisition Regulation (FAR) is 41 U.S.C. 1707 entitled ``Publication
of Proposed Regulations.'' Paragraph (a)(1) of the statute requires
that a procurement policy, regulation, procedure or form (including an
amendment or modification thereof) must be published for public comment
if it relates to the expenditure of appropriated funds, and has either
a significant effect beyond the internal operating procedures of the
agency issuing the policy, regulation, procedure, or form, or has a
significant cost or administrative impact on contractors or offerors.
This final rule is not required to be published for public comment,
because this rule merely removes the sunset date of the existing
regulation, making it permanent, and replaces the obsolete statutory
citations with the new 10 U.S.C. 2339a reference.
III. Applicability to Contracts at or Below the Simplified Acquisition
Threshold and for Commercial Items, Including Commercially Available
Off-the-Shelf Items
This rule only removes the sunset date from DFARS 239.7300(b) and
updates the statutory citations to 10 U.S.C. 2339a, wherever necessary.
The rule continues to prescribe the associated clauses to contracts at
or below the simplified acquisition threshold and for commercial items,
including commercially available off-the-shelf items.
IV. Executive Orders 12866 and 13563
Executive Orders (E.O.) 12866 and E.O. 13563 direct agencies to
assess all costs and benefits of available regulatory alternatives and,
if regulation is necessary, to select regulatory approaches that
maximize net benefits (including potential economic, environmental,
public health and safety effects, distributive impacts, and equity).
E.O. 13563 emphasizes the importance of quantifying both costs and
benefits, of reducing costs, of harmonizing rules, and of promoting
flexibility. This is not a significant regulatory action and,
therefore, was not subject to review under section 6(b) of E.O. 12866,
Regulatory Planning and Review, dated September 30, 1993. This rule is
not a major rule under 5 U.S.C. 804.
V. Executive Order 13771
This final rule is not an E.O. 13771 regulatory action, because
this rule is not a significant under E.O. 12866.
VI. Regulatory Flexibility Act
Because a notice of proposed rulemaking and an opportunity for
public comment are not required to be given for this rule under 41
U.S.C. 1707(a)(1) (see section II. of this preamble), the analytical
requirement of the Regulatory Flexibility Act (5 U.S.C. 601 et seq.)
are not applicable. Accordingly, no regulatory flexibility analysis is
required, and none has been prepared.
VII. Paperwork Reduction Act
The rule does not contain any information collection requirements
that require the approval of the Office of Management and Budget under
the Paperwork Reduction Act (44 U.S.C. chapter 35).
List of Subjects in 48 CFR Parts 212, 215, 239, and 252
Government procurement.
Jennifer Lee Hawes,
Regulatory Control Officer, Defense Acquisition Regulations System.
Therefore, 48 CFR 212, 215, 239, and 252 are amended as follows:
0
1. The authority citation for parts 212, 215, 239, and 252 continues to
read as follows:
Authority: 41 U.S.C. 1303 and 48 CFR chapter 1.
PART 212--ACQUISITION OF COMMERCIAL ITEMS
212.301 [Amended]
0
2. Amend section 212.301, in paragraphs 212.301(f)(xv)(C) and (D), by
removing ``section 806 of Public Law 111-383'' and adding ``10 U.S.C.
2339a'' in its place in both places.
PART 215--CONTRACTING BY NEGOTIATION
215.503 [Amended]
0
3. Amend section 215.503 by removing ``section 806 of the National
Defense Authorization Act for Fiscal Year 2011, as amended by section
806 of the National Defense Authorization Act for Fiscal Year 2013''
and adding ``10 U.S.C. 2339a'' in its place.
215.506 [Amended]
0
4. Amend 215.506, in paragraph (e) by removing ``section 806 of the
National Defense Authorization Act for Fiscal Year 2011, as amended by
section 806 of the National Defense Authorization Act for Fiscal Year
2013'' and adding ``10 U.S.C. 2339a'' in its place.
PART 239--ACQUISITION OF INFORMATION TECHNOLOGY
0
5. Revise section 239.7300 to read as follows:
239.7300 Scope of subpart.
This subpart implements 10 U.S.C. 2339a and elements of DoD
Instruction 5200.44, Protection of Mission Critical Functions to
Achieve Trusted Systems and Networks (TSN), at https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520044p.pdf?ver=2018-11-08-075800-903.
239.7301 [Amended]
0
6. Amend section 239.7301 by--
0
a. In the definition of ``Covered item of supply'' removing ``(see
section 806(e)(6) of Pub. L. 111-383)'' and adding ``(see 10 U.S.C.
2339a)'' in its place;
0
b. In the introductory text of the definition of ``Covered system''
removing ``44 U.S.C. 3542(b)(see section 806(e)(5) of Pub. L. 111-
383)'' and adding ``44 U.S.C. 3552(b) (see 10 U.S.C. 2339a)'' in its
place; and
0
c. In the definition of ``Supply chain risk'' removing ``national
security system (as that term is defined at 44 U.S.C. 3542(b))'' and
``such system'' and adding ``covered system'' and ``such system (see 10
U.S.C. 2339a)'' in its place, respectively.
[[Page 4370]]
239.7302 [Amended]
0
7. Amend section 239.7302, introductory text, by removing ``national
security systems, as that term is defined at 44 U.S.C. 3542(b),'' and
adding ``covered systems (see 10 U.S.C. 2339a)'' in its place.
239.7303 [Amended]
0
8. Amend section 239.7303 by--
0
a. In paragraph (b)(1), removing ``Acquisition, Technology, and
Logistics'' and adding ``Acquisition and Sustainment'' in its place;
and
0
b. In paragraph (b)(2), removing ``senior'' and adding ``service'' in
its place.
239.7304 [Amended]
0
9. Amend section 239.7304, in paragraphs (a), (b) introductory text,
and (c)(2)(ii) by removing ``Acquisition, Technology, and Logistics''
and adding ``Acquisition and Sustainment'' in their place.
PART 252--SOLICITATION PROVISIONS AND CONTRACT CLAUSES
252.239-7017 [Amended]
0
10. Amend section 252.239-7017 by--
0
a. In the clause heading, removing the date ``(NOV 2013)'' and adding
``(FEB 2019)'' in its place;
0
b. In paragraph (a), removing ``national security system (as that term
is defined at 44 U.S.C. 3542(b))'' and ``such system'' and adding
``covered system'' and ``such system (see 10 U.S.C. 2339a)'' in its
place, respectively;
0
c. In paragraph (b) removing ``section 806 of Public Law 383'' and
adding ``10 U.S.C. 2339a'' in its place; and
0
d. In paragraph (c) removing ``section 806 of Public Law 383'' and
adding ``10 U.S.C. 2339a'' in its place.
252.239-7018 [Amended]
0
11. Amend section 252.239-7018 by--
0
a. In the clause heading, removing the date ``(OCT 2015)'' and adding
``(FEB 2019)'' in its place;
0
b. In paragraph (a), in the definition of ``Supply chain risk''
removing ``national security system (as that term is defined at 44
U.S.C. 3542(b))'' and ``such system'' and adding ``covered system'' and
``such system (see 10 U.S.C. 2339a)'' in its place, respectively; and
0
c. In paragraphs (c) and (d), removing ``section 806 of Public Law 111-
383'' and adding ``10 U.S.C. 2339a'' in its place in both places.
[FR Doc. 2019-02529 Filed 2-14-19; 8:45 am]
BILLING CODE 5001-06-P