Overview
This section provides the foundational vocabulary for implementing the Federal Acquisition Supply Chain Security Act (FASCSA), establishing specific criteria for restricted technologies, types of exclusion orders, and the standards of diligence required by contractors. It identifies the authorities allowed to issue removal orders and defines the broad scope of what constitutes a "supply chain risk" in federal procurement.
Key Rules
- Covered Articles: Broadly includes all information technology (IT), cloud computing, telecommunications equipment/services, and any hardware or software containing embedded or incidental IT.
- FASCSA Orders: These are mandatory directives to exclude or remove specific articles or sources, issued by three distinct authorities: the Secretary of Homeland Security (civilian agencies), the Secretary of Defense (DoD), or the Director of National Intelligence (intelligence community).
- Reasonable Inquiry: Contractors are held to a standard of "reasonable inquiry" to uncover restricted articles; notably, this requires searching information in the entity’s possession but does not require a formal internal or third-party audit.
- Source Scope: The definition of "source" extends to non-Federal suppliers or potential suppliers at any tier of the supply chain.
- Supply Chain Risk Information: This encompasses a wide range of data, including foreign ownership/influence, the legal regimes of a source's headquarters, and the technical functionality of the products themselves.
- National Security Systems: Specifically excludes systems used for routine administrative and business applications (e.g., payroll, finance, and personnel management).
Practical Implications
- Contractors must monitor three separate streams of exclusion orders (DHS, DoD, and DNI) to ensure compliance, as a source may be permitted by one authority but restricted by another.
- Because "sources" include suppliers at any tier, prime contractors must implement internal vetting processes that go beyond their immediate subcontractors to identify the original manufacturers of embedded IT components.