§1326 Requirements for Executive Agencies

Summary

Agency leaders must check the supply chain risks when buying or using covered articles. They must then avoid, reduce, accept, or transfer those risks using the standards the Council sets. They must also do risk checks first for the things that matter most to their mission. Agencies must make a risk plan and rules, use risk practices through a system’s whole life, share relevant information with other agencies, and report progress under OMB and Council guidance. They must include all relevant facts, even classified ones, in their reviews and program management. If one agency pays for a purchase, that agency normally does the risk work unless an agreement says otherwise. The terms “interagency acquisition” and “assisted acquisition” are defined in the federal acquisition rules. The Secretary of Homeland Security can help agencies with assessments, tools, and guidance, especially for information and communications technology.