Effective December 4, 2023, a new interim rule will prohibit contractors from delivering or using covered articles and sources subject to exclusion or removal orders issued under the Federal Acquisition Supply Chain Security Act of 2018 (“FASCSA”). The rule is intended to eliminate certain technology from the federal supply chain that foreign adversaries might exploit to commit malicious cyber acts. The interim rule allows the executive branch through the Federal Acquisition Security Council (“FASC”) to exclude certain technologies and manufacturers from federal procurements and even to require removal of covered articles from federal or contractor information systems during performance.

The rule imposes a host of new obligations, including certification, monitoring, and reporting requirements. This post provides practical guidance on the rule and several compliance tips to help contractors prepare for the December deadline.

Background

Congress passed Section 202 of the FASCSA to protect the information and communications technology (“ICT”) supply chain against threats and vulnerabilities that may lead to data and intellectual property theft, damage to critical infrastructure, or national security harm. The Act established the FASC as an interagency council authorized to make recommendations for orders that would require the removal of covered articles from agency information systems (removal orders) or the exclusion of sources or covered articles from agency procurement actions (exclusion orders) (collectively referred to as “FASCSA orders”).

In August 2021, the FASC issued a final rule establishing procedures for recommending removal and exclusion orders. The FASC evaluates supply chain risk based on several non-exclusive factors and sends its recommendations to the Secretaries of Homeland Security and Defense and the Director of National Intelligence to consider when deciding whether to issue a FASCSA order. If a FASCSA order is issued, agencies are required to implement the exclusion or removal order.

Overview of Interim Rule

• Prohibition against Providing or Using Covered Articles or Sources Subject to a FASCSA Order

The interim rule implements the FASCSA through a new FAR provision at FAR 52.204-30 (Federal Acquisition Supply Chain Security Act Orders-Representation and Disclosures). Contractors are “prohibited from providing or using as part of the performance of the contract” any covered article, or any product or services from a named source subject to an applicable FASCSA order. It is unclear whether “in the performance of the contract” is intended to cover only products or services directly supporting the contract, or also those with a back-office, indirect function.

Contractors must comply with both exclusion and removal orders. Exclusion orders apply during the procurement process to prohibit contractors from offering covered articles or services. Removal orders, however, require contractors to physically remove any prohibited equipment/products—even during contract performance. The rule does not specifically address the associated costs and timing of removal, although FAR 52.204-28 requires contractors to act “promptly” in making any necessary changes or modifications to remove a product or service subject to a FASCSA order.

Per FAR 52.204-28, FASCSA orders will be identified in the request for quote or in the notice of intent to place an order. Contractors will be able to identify applicable FASCSA orders in FAR 52.204-30(b)(1). FASCSA orders issued after the solicitation are not effective unless the solicitation is amended.

• Certification Requirement—“Reasonable Inquiry” Standard

FAR 52.204-29 (Federal Acquisition Supply Chain Security Act Orders-Representation and Disclosures) requires an offeror to certify that it conducted a “reasonable inquiry” (the same standard as Section 889) and is not providing any covered article, product, or source subject to an applicable FASCSA order. If an offeror cannot represent compliance with this prohibition, it must disclose the required information at FAR 52.204-29(e) to assist the government in deciding whether to pursue a waiver. Waivers are discretionary, and we expect they will be rare (as they are under Section 889).

• Contractors Must Monitor SAM.gov at Least Every Three Months for New FASCSA Orders

The rule imposes a continuous monitoring requirement on contractors to review SAM.gov at least once every three months (or more frequently if the contracting officer requires) for new FASCSA orders not already identified in FAR 52.204-30(b)(1). Contractors are instructed to search SAM.gov by entering the phrase, “FASCSA order.” If a contractor identifies a new FASCSA order that could impact its supply chain, it must conduct a reasonable inquiry to determine whether it delivered or used any covered articles subject to the FASCSA order during contract performance.

• Contractors Must Promptly Report Any Covered Articles or Sources Discovered during Performance

If a contractor discovers that its supply chain includes covered articles subject to either a pre-existing or new FASCSA order, it must provide notice to the government within three business days, followed by a report on the contractor’s additional mitigation efforts within 10 business days. See FAR 52.204-30(c)(3).

• Scope and Flowdown

The interim rule applies to all federal contracts, including contracts below the simplified acquisition threshold and commercial acquisitions (including commercial-of-the-shelf items). The prohibition must be flowed down to all subcontractors, although the SAM.gov monitoring requirement does not apply to subcontractors.

• Existing Contracts

For existing indefinite delivery contracts, contracting officers are instructed to modify them to include FAR 52.204-30 within six months of December 4, 2023, to apply to future orders. For Federal Supply Schedules, Governmentwide Acquisition Contracts, and Multi-Agency Contracts, if the FASCSA orders are going to be applied at the order level, then FAR 52.204-28 will be added instead, within six months of December 4, 2023.

If exercising an option or modifying an existing contract or task or delivery order to extend the period of performance, contracting officers must incorporate FAR 52.204-30. When exercising an option, agencies are instructed to consider modifying the existing contract to add the clause in a sufficient amount of time to provide notice for exercising the option and to provide contractors with adequate time to comply with the clause.

What Should Contractors Do to Prepare?

The new rule will require contractors to engage in ongoing supply chain review and management to avoid delivering or using products covered by an applicable FASCSA order—and also to identify and implement new FASCSA orders during contract performance. Some tips for firms to consider when preparing for the new rule:

1. Supply chain visibility: Contractors should ensure they have sufficient systems and procedures in place to readily identify products or manufacturers subject to FASCSA orders.
   __
2. Designate a point person for overseeing FASCSA orders: Consider designating a point person with responsibility for identifying applicable FASCSA orders in solicitations and conducting the regular monitoring through SAM.gov for new FASCSA orders. This person should closely coordinate with company IT personnel in implementing any FASCSA orders.
   __
3. Training and policy updates: The interim rule states that contractors will be required to update their policies and procedures to ensure compliance with FASCSA orders and train their contracts, program, and supply chain personnel on the requirements. Contractors should appropriately revise their technology and procurement policies to incorporate the new rule and ensure contract and IT personnel are aware of the requirements.
   __
4. Communicate with your subcontractors: Make sure your key subcontractors are aware of the new rule and are preparing for compliance. Ensure that all required flowdowns are incorporated in subcontracts, and notify your subcontractors of any FASCSA orders in the solicitation that are not listed in SAM.gov but that apply to the contract and all subcontracts.
   __

Comments on the interim rule are due by December 4, 2023. Rulemakers are specifically interested in (1) additional information or guidance needed to comply with the rule and (2) anticipated challenges in effectively complying with the rule.

[View source.]