§1326 Requirements for executive agencies

Summary

Heads of executive agencies must check for supply-chain risks when their agency buys or uses covered items and then avoid, reduce, accept, or shift those risks following the standards the Council sets. They must give higher priority to checking things that are most important to the agency’s mission, systems, parts, services, or assets. That duty means each agency must make a broad risk-management plan, set policies and processes, use risk management through the whole life of the item, take steps to limit or fix risks, share relevant information with other agencies as the Council allows, and report progress as the Office of Management and Budget and the Council require. Agencies must include all relevant information, including classified material, in their acquisition and program-management processes. For interagency purchases, the agency providing the funds normally does the risk work unless the agencies agree otherwise. Interagency acquisition and assisted acquisition are types of agency-to-agency buying defined in the federal acquisition rules. The Secretary of Homeland Security may help agencies with assessments and offer guidance or tools, especially for information and communications technology.