§1326 Requirements for Executive Agencies

Summary

Heads of executive agencies must check how buying and using covered articles could create supply chain risks and then avoid, reduce, accept, or transfer those risks under the standards set by the Council in section 1323(a)(1). They must do these checks first for the most critical missions, systems, components, services, or assets. They must also make a risk-management plan, use risk controls throughout the life of a system or product, fix or lessen problems found, share relevant information with other agencies as the Council allows, and report progress under guidance from the Office of Management and Budget and the Council. All relevant information, including classified material about covered articles, must be included in existing acquisition and program reviews. For interagency purchases, the agency providing the funds must do the assessment unless an assisted acquisition agreement says otherwise. The terms "assisted acquisition" and "interagency acquisition" mean what 48 CFR 2.101 says. The Secretary of Homeland Security may help agencies with risk checks and give extra guidance and tools for information and communications technology.