[Federal Register Volume 84, Number 32 (Friday, February 15, 2019)]
[Rules and Regulations]
[Pages 4368-4370]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-02529]


-----------------------------------------------------------------------

DEPARTMENT OF DEFENSE

Defense Acquisition Regulations System

48 CFR Parts 212, 215, 239, and 252

[Docket DARS-2019-0002]
RIN 0750-AK26


Defense Federal Acquisition Regulation Supplement: Extension of 
Supply Chain Risk Management Authority (DFARS Case 2018-D072)

AGENCY: Defense Acquisition Regulations System, Department of Defense 
(DoD).

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: DoD is issuing a final rule amending the Defense Federal 
Acquisition Regulation Supplement (DFARS) to implement a section of the 
National Defense Authorization Act for Fiscal Year 2019.

DATES: Effective February 15, 2019.

FOR FURTHER INFORMATION CONTACT: Ms. Kimberly R. Ziegler, telephone 
571-372-6095.

SUPPLEMENTARY INFORMATION: 

I. Background

    DoD is amending the DFARS to implement section 881 of the National 
Defense Authorization Act (NDAA) for Fiscal Year (FY) 2019 (Pub. L. 
115-232). Section 881 codifies the authority for information relating 
to supply chain risk at 10 U.S.C. 2339a and repeals the sunset date at 
sections 806(g) of the NDAA for FY 2011 (Pub. L. 111-383), as modified 
by section 806(a) of the NDAA for FY 2013 (Pub. L. 112-239), making the 
authority permanent.
    DoD published a final rule (DFARS Case 2012-D050) in the Federal 
Register at 80 FR 67243 on October 30, 2015, to implement section 806 
of the NDAA for FY 2011, as amended by section 806 of the NDAA for FY 
2013 (Pub. L. 112-239). The objective of the rule was to minimize the 
potential risk for supplies and services purchased by DoD to 
maliciously degrade the integrity and operation of sensitive 
information technology systems. The rule implemented the use of supply 
chain risk as an evaluation factor in information technology 
procurements for services or supplies as a covered system, as a part of 
a covered system, or in support of a covered system. DFARS provision 
252.239-7017, Notice of Supply Chain Risk, and DFARS clause 252.239-
7018, Supply Chain Risk, were added to inform contractors of the 
requirement to mitigate supply chain risk in the provision of supplies 
and

[[Page 4369]]

services to the Government and other statutory authorities afforded to 
the Government under section 806.
    Section 881 of the NDAA for FY 2019 codified this authority at 10 
U.S.C. 2339a and removed the September 30, 2018, sunset date. This 
final rule removes the sunset date at DFARS 239.7300(b) and changes 
numerous statutory citations from section 806 of Public Law 111-383 to 
10 U.S.C. 2339a. This rule makes no change to the authority for 
information relating to supply chain risk currently implemented in the 
DFARS, other than removing the sunset date, updating the statutory 
citations, and the following minor editorial changes:
     Corrects the reference to 44 U.S.C. 3552(b) in the 
definition of ``covered system.''
     Replaces the description of a national security system 
with the defined term ``covered system'' in the definition of ``supply 
chain risk.''
     Changes ``Under Secretary of Defense for Acquisition, 
Technology, and Logistics'' to ``Under Secretary of Defense for 
Acquisition and Sustainment.''

II. Publication of This Final Rule for Public Comment Is Not Required 
by Statute

    The statute that applies to the publication of the Federal 
Acquisition Regulation (FAR) is 41 U.S.C. 1707 entitled ``Publication 
of Proposed Regulations.'' Paragraph (a)(1) of the statute requires 
that a procurement policy, regulation, procedure or form (including an 
amendment or modification thereof) must be published for public comment 
if it relates to the expenditure of appropriated funds, and has either 
a significant effect beyond the internal operating procedures of the 
agency issuing the policy, regulation, procedure, or form, or has a 
significant cost or administrative impact on contractors or offerors. 
This final rule is not required to be published for public comment, 
because this rule merely removes the sunset date of the existing 
regulation, making it permanent, and replaces the obsolete statutory 
citations with the new 10 U.S.C. 2339a reference.

III. Applicability to Contracts at or Below the Simplified Acquisition 
Threshold and for Commercial Items, Including Commercially Available 
Off-the-Shelf Items

    This rule only removes the sunset date from DFARS 239.7300(b) and 
updates the statutory citations to 10 U.S.C. 2339a, wherever necessary. 
The rule continues to prescribe the associated clauses to contracts at 
or below the simplified acquisition threshold and for commercial items, 
including commercially available off-the-shelf items.

IV. Executive Orders 12866 and 13563

    Executive Orders (E.O.) 12866 and E.O. 13563 direct agencies to 
assess all costs and benefits of available regulatory alternatives and, 
if regulation is necessary, to select regulatory approaches that 
maximize net benefits (including potential economic, environmental, 
public health and safety effects, distributive impacts, and equity). 
E.O. 13563 emphasizes the importance of quantifying both costs and 
benefits, of reducing costs, of harmonizing rules, and of promoting 
flexibility. This is not a significant regulatory action and, 
therefore, was not subject to review under section 6(b) of E.O. 12866, 
Regulatory Planning and Review, dated September 30, 1993. This rule is 
not a major rule under 5 U.S.C. 804.

V. Executive Order 13771

    This final rule is not an E.O. 13771 regulatory action, because 
this rule is not a significant under E.O. 12866.

VI. Regulatory Flexibility Act

    Because a notice of proposed rulemaking and an opportunity for 
public comment are not required to be given for this rule under 41 
U.S.C. 1707(a)(1) (see section II. of this preamble), the analytical 
requirement of the Regulatory Flexibility Act (5 U.S.C. 601 et seq.) 
are not applicable. Accordingly, no regulatory flexibility analysis is 
required, and none has been prepared.

VII. Paperwork Reduction Act

    The rule does not contain any information collection requirements 
that require the approval of the Office of Management and Budget under 
the Paperwork Reduction Act (44 U.S.C. chapter 35).

List of Subjects in 48 CFR Parts 212, 215, 239, and 252

    Government procurement.

Jennifer Lee Hawes,
Regulatory Control Officer, Defense Acquisition Regulations System.

    Therefore, 48 CFR 212, 215, 239, and 252 are amended as follows:

0
1. The authority citation for parts 212, 215, 239, and 252 continues to 
read as follows:

    Authority:  41 U.S.C. 1303 and 48 CFR chapter 1.

PART 212--ACQUISITION OF COMMERCIAL ITEMS


212.301  [Amended]

0
2. Amend section 212.301, in paragraphs 212.301(f)(xv)(C) and (D), by 
removing ``section 806 of Public Law 111-383'' and adding ``10 U.S.C. 
2339a'' in its place in both places.

PART 215--CONTRACTING BY NEGOTIATION


215.503  [Amended]

0
3. Amend section 215.503 by removing ``section 806 of the National 
Defense Authorization Act for Fiscal Year 2011, as amended by section 
806 of the National Defense Authorization Act for Fiscal Year 2013'' 
and adding ``10 U.S.C. 2339a'' in its place.


215.506  [Amended]

0
4. Amend 215.506, in paragraph (e) by removing ``section 806 of the 
National Defense Authorization Act for Fiscal Year 2011, as amended by 
section 806 of the National Defense Authorization Act for Fiscal Year 
2013'' and adding ``10 U.S.C. 2339a'' in its place.

PART 239--ACQUISITION OF INFORMATION TECHNOLOGY

0
5. Revise section 239.7300 to read as follows:


239.7300  Scope of subpart.

    This subpart implements 10 U.S.C. 2339a and elements of DoD 
Instruction 5200.44, Protection of Mission Critical Functions to 
Achieve Trusted Systems and Networks (TSN), at https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520044p.pdf?ver=2018-11-08-075800-903.


239.7301  [Amended]

0
6. Amend section 239.7301 by--
0
a. In the definition of ``Covered item of supply'' removing ``(see 
section 806(e)(6) of Pub. L. 111-383)'' and adding ``(see 10 U.S.C. 
2339a)'' in its place;
0
b. In the introductory text of the definition of ``Covered system'' 
removing ``44 U.S.C. 3542(b)(see section 806(e)(5) of Pub. L. 111-
383)'' and adding ``44 U.S.C. 3552(b) (see 10 U.S.C. 2339a)'' in its 
place; and
0
c. In the definition of ``Supply chain risk'' removing ``national 
security system (as that term is defined at 44 U.S.C. 3542(b))'' and 
``such system'' and adding ``covered system'' and ``such system (see 10 
U.S.C. 2339a)'' in its place, respectively.

[[Page 4370]]

239.7302  [Amended]

0
7. Amend section 239.7302, introductory text, by removing ``national 
security systems, as that term is defined at 44 U.S.C. 3542(b),'' and 
adding ``covered systems (see 10 U.S.C. 2339a)'' in its place.


239.7303  [Amended]

0
8. Amend section 239.7303 by--
0
a. In paragraph (b)(1), removing ``Acquisition, Technology, and 
Logistics'' and adding ``Acquisition and Sustainment'' in its place; 
and
0
b. In paragraph (b)(2), removing ``senior'' and adding ``service'' in 
its place.


239.7304  [Amended]

0
9. Amend section 239.7304, in paragraphs (a), (b) introductory text, 
and (c)(2)(ii) by removing ``Acquisition, Technology, and Logistics'' 
and adding ``Acquisition and Sustainment'' in their place.

PART 252--SOLICITATION PROVISIONS AND CONTRACT CLAUSES


252.239-7017  [Amended]

0
10. Amend section 252.239-7017 by--
0
a. In the clause heading, removing the date ``(NOV 2013)'' and adding 
``(FEB 2019)'' in its place;
0
b. In paragraph (a), removing ``national security system (as that term 
is defined at 44 U.S.C. 3542(b))'' and ``such system'' and adding 
``covered system'' and ``such system (see 10 U.S.C. 2339a)'' in its 
place, respectively;
0
c. In paragraph (b) removing ``section 806 of Public Law 383'' and 
adding ``10 U.S.C. 2339a'' in its place; and
0
d. In paragraph (c) removing ``section 806 of Public Law 383'' and 
adding ``10 U.S.C. 2339a'' in its place.


252.239-7018  [Amended]

0
11. Amend section 252.239-7018 by--
0
a. In the clause heading, removing the date ``(OCT 2015)'' and adding 
``(FEB 2019)'' in its place;
0
b. In paragraph (a), in the definition of ``Supply chain risk'' 
removing ``national security system (as that term is defined at 44 
U.S.C. 3542(b))'' and ``such system'' and adding ``covered system'' and 
``such system (see 10 U.S.C. 2339a)'' in its place, respectively; and
0
c. In paragraphs (c) and (d), removing ``section 806 of Public Law 111-
383'' and adding ``10 U.S.C. 2339a'' in its place in both places.

[FR Doc. 2019-02529 Filed 2-14-19; 8:45 am]
 BILLING CODE 5001-06-P