Skip to Content

Rule

Defense Federal Acquisition Regulation Supplement: Extension of Supply Chain Risk Management Authority (DFARS Case 2018-D072)

Document Details

Information about this document as published in the Federal Register.

Document Statistics
Document page views are updated periodically throughout the day and are cumulative counts for this document including its time on Public Inspection. Counts are subject to sampling, reprocessing and revision (up or down) throughout the day.
Published Document

This document has been published in the Federal Register. Use the PDF linked in the document sidebar for the official electronic format.

Start Preamble

AGENCY:

Defense Acquisition Regulations System, Department of Defense (DoD).

ACTION:

Final rule.

SUMMARY:

DoD is issuing a final rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) to implement a section of the National Defense Authorization Act for Fiscal Year 2019.

DATES:

Effective February 15, 2019.

Start Further Info

FOR FURTHER INFORMATION CONTACT:

Ms. Kimberly R. Ziegler, telephone 571-372-6095.

End Further Info End Preamble Start Supplemental Information

SUPPLEMENTARY INFORMATION:

I. Background

DoD is amending the DFARS to implement section 881 of the National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2019 (Pub. L. 115-232). Section 881 codifies the authority for information relating to supply chain risk at 10 U.S.C. 2339a and repeals the sunset date at sections 806(g) of the NDAA for FY 2011 (Pub. L. 111-383), as modified by section 806(a) of the NDAA for FY 2013 (Pub. L. 112-239), making the authority permanent.

DoD published a final rule (DFARS Case 2012-D050) in the Federal Register at 80 FR 67243 on October 30, 2015, to implement section 806 of the NDAA for FY 2011, as amended by section 806 of the NDAA for FY 2013 (Pub. L. 112-239). The objective of the rule was to minimize the potential risk for supplies and services purchased by DoD to maliciously degrade the integrity and operation of sensitive information technology systems. The rule implemented the use of supply chain risk as an evaluation factor in information technology procurements for services or supplies as a covered system, as a part of a covered system, or in support of a covered system. DFARS provision 252.239-7017, Notice of Supply Chain Risk, and DFARS clause 252.239-7018, Supply Chain Risk, were added to inform contractors of the requirement to mitigate supply chain risk in the provision of supplies and Start Printed Page 4369services to the Government and other statutory authorities afforded to the Government under section 806.

Section 881 of the NDAA for FY 2019 codified this authority at 10 U.S.C. 2339a and removed the September 30, 2018, sunset date. This final rule removes the sunset date at DFARS 239.7300(b) and changes numerous statutory citations from section 806 of Public Law 111-383 to 10 U.S.C. 2339a. This rule makes no change to the authority for information relating to supply chain risk currently implemented in the DFARS, other than removing the sunset date, updating the statutory citations, and the following minor editorial changes:

  • Corrects the reference to 44 U.S.C. 3552(b) in the definition of “covered system.”
  • Replaces the description of a national security system with the defined term “covered system” in the definition of “supply chain risk.”
  • Changes “Under Secretary of Defense for Acquisition, Technology, and Logistics” to “Under Secretary of Defense for Acquisition and Sustainment.”

II. Publication of This Final Rule for Public Comment Is Not Required by Statute

The statute that applies to the publication of the Federal Acquisition Regulation (FAR) is 41 U.S.C. 1707 entitled “Publication of Proposed Regulations.” Paragraph (a)(1) of the statute requires that a procurement policy, regulation, procedure or form (including an amendment or modification thereof) must be published for public comment if it relates to the expenditure of appropriated funds, and has either a significant effect beyond the internal operating procedures of the agency issuing the policy, regulation, procedure, or form, or has a significant cost or administrative impact on contractors or offerors. This final rule is not required to be published for public comment, because this rule merely removes the sunset date of the existing regulation, making it permanent, and replaces the obsolete statutory citations with the new 10 U.S.C. 2339a reference.

III. Applicability to Contracts at or Below the Simplified Acquisition Threshold and for Commercial Items, Including Commercially Available Off-the-Shelf Items

This rule only removes the sunset date from DFARS 239.7300(b) and updates the statutory citations to 10 U.S.C. 2339a, wherever necessary. The rule continues to prescribe the associated clauses to contracts at or below the simplified acquisition threshold and for commercial items, including commercially available off-the-shelf items.

IV. Executive Orders 12866 and 13563

Executive Orders (E.O.) 12866 and E.O. 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). E.O. 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. This is not a significant regulatory action and, therefore, was not subject to review under section 6(b) of E.O. 12866, Regulatory Planning and Review, dated September 30, 1993. This rule is not a major rule under 5 U.S.C. 804.

V. Executive Order 13771

This final rule is not an E.O. 13771 regulatory action, because this rule is not a significant under E.O. 12866.

VI. Regulatory Flexibility Act

Because a notice of proposed rulemaking and an opportunity for public comment are not required to be given for this rule under 41 U.S.C. 1707(a)(1) (see section II. of this preamble), the analytical requirement of the Regulatory Flexibility Act (5 U.S.C. 601 et seq.) are not applicable. Accordingly, no regulatory flexibility analysis is required, and none has been prepared.

VII. Paperwork Reduction Act

The rule does not contain any information collection requirements that require the approval of the Office of Management and Budget under the Paperwork Reduction Act (44 U.S.C. chapter 35).

Start List of Subjects

List of Subjects in 48 CFR Parts 212, 215, 239, and 252

  • Government procurement
End List of Subjects Start Signature

Jennifer Lee Hawes,

Regulatory Control Officer, Defense Acquisition Regulations System.

End Signature

Therefore, 48 CFR 212, 215, 239, and 252 are amended as follows:

Start Amendment Part

1. The authority citation for parts 212, 215, 239, and 252 continues to read as follows:

End Amendment Part Start Authority

Authority: 41 U.S.C. 1303 and 48 CFR chapter 1.

End Authority Start Part

PART 212—ACQUISITION OF COMMERCIAL ITEMS

[Amended]
End Part Start Amendment Part

2. Amend section 212.301, in paragraphs 212.301(f)(xv)(C) and (D), by removing “section 806 of Public Law 111-383” and adding “10 U.S.C. 2339a” in its place in both places.

End Amendment Part Start Part

PART 215—CONTRACTING BY NEGOTIATION

[Amended]
End Part Start Amendment Part

3. Amend section 215.503 by removing “section 806 of the National Defense Authorization Act for Fiscal Year 2011, as amended by section 806 of the National Defense Authorization Act for Fiscal Year 2013” and adding “ 10 U.S.C. 2339a” in its place.

End Amendment Part
[Amended]
Start Amendment Part

4. Amend 215.506, in paragraph (e) by removing “section 806 of the National Defense Authorization Act for Fiscal Year 2011, as amended by section 806 of the National Defense Authorization Act for Fiscal Year 2013” and adding “ 10 U.S.C. 2339a” in its place.

End Amendment Part Start Part

PART 239—ACQUISITION OF INFORMATION TECHNOLOGY

End Part Start Amendment Part

5. Revise section 239.7300 to read as follows:

End Amendment Part
Scope of subpart.

This subpart implements 10 U.S.C. 2339a and elements of DoD Instruction 5200.44, Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN), at https://www.esd.whs.mil/​Portals/​54/​Documents/​DD/​issuances/​dodi/​520044p.pdf?​ver=​2018-11-08-075800-903.

[Amended]
Start Amendment Part

6. Amend section 239.7301 by—

End Amendment Part Start Amendment Part

a. In the definition of “Covered item of supply” removing “(see section 806(e)(6) of Pub. L. 111-383)” and adding “(see 10 U.S.C. 2339a)” in its place;

End Amendment Part Start Amendment Part

b. In the introductory text of the definition of “Covered system” removing “ 44 U.S.C. 3542(b)(see section 806(e)(5) of Pub. L. 111-383)” and adding “44 U.S.C. 3552(b) (see 10 U.S.C. 2339a)” in its place; and

End Amendment Part Start Amendment Part

c. In the definition of “Supply chain risk” removing “national security system (as that term is defined at 44 U.S.C. 3542(b))” and “such system” and adding “covered system” and “such system (see 10 U.S.C. 2339a)” in its place, respectively.

End Amendment Part
Start Printed Page 4370
[Amended]
Start Amendment Part

7. Amend section 239.7302, introductory text, by removing “national security systems, as that term is defined at 44 U.S.C. 3542(b),” and adding “covered systems (see 10 U.S.C. 2339a)” in its place.

End Amendment Part
[Amended]
Start Amendment Part

8. Amend section 239.7303 by—

End Amendment Part Start Amendment Part

a. In paragraph (b)(1), removing “Acquisition, Technology, and Logistics” and adding “Acquisition and Sustainment” in its place; and

End Amendment Part Start Amendment Part

b. In paragraph (b)(2), removing “senior” and adding “service” in its place.

End Amendment Part
[Amended]
Start Amendment Part

9. Amend section 239.7304, in paragraphs (a), (b) introductory text, and (c)(2)(ii) by removing “Acquisition, Technology, and Logistics” and adding “Acquisition and Sustainment” in their place.

End Amendment Part Start Part

PART 252—SOLICITATION PROVISIONS AND CONTRACT CLAUSES

[Amended]
End Part Start Amendment Part

10. Amend section 252.239-7017 by—

End Amendment Part Start Amendment Part

a. In the clause heading, removing the date “(NOV 2013)” and adding “(FEB 2019)” in its place;

End Amendment Part Start Amendment Part

b. In paragraph (a), removing “national security system (as that term is defined at 44 U.S.C. 3542(b))” and “such system” and adding “covered system” and “such system (see 10 U.S.C. 2339a)” in its place, respectively;

End Amendment Part Start Amendment Part

c. In paragraph (b) removing “section 806 of Public Law 383” and adding “ 10 U.S.C. 2339a” in its place; and

End Amendment Part Start Amendment Part

d. In paragraph (c) removing “section 806 of Public Law 383” and adding “ 10 U.S.C. 2339a” in its place.

End Amendment Part
[Amended]
Start Amendment Part

11. Amend section 252.239-7018 by—

End Amendment Part Start Amendment Part

a. In the clause heading, removing the date “(OCT 2015)” and adding “(FEB 2019)” in its place;

End Amendment Part Start Amendment Part

b. In paragraph (a), in the definition of “Supply chain risk” removing “national security system (as that term is defined at 44 U.S.C. 3542(b))” and “such system” and adding “covered system” and “such system (see 10 U.S.C. 2339a)” in its place, respectively; and

End Amendment Part Start Amendment Part

c. In paragraphs (c) and (d), removing “section 806 of Public Law 111-383” and adding “10 U.S.C. 2339a” in its place in both places.

End Amendment Part End Supplemental Information

[FR Doc. 2019-02529 Filed 2-14-19; 8:45 am]

BILLING CODE 5001-06-P