United States: Snitches Don't Get Stitches: New Rule Requires Supply Chain Disclosures

The Federal Acquisition Regulatory Council (FARC) issued a new final interim rule requiring contractors to review their supply chain to ensure no companies, products or services they are providing the federal government or using in the performance of a contract have been excluded by the Federal Acquisition Security Council (FASC). This rule, which will take effect on Dec. 4, 2023, will require contractors to regularly review the System for Acquisition Management (SAM), conduct a reasonable inquiry and make disclosures if excluded sources, products or services have been, are being or will be used or provided. All requirements are applicable to contracts below the simplified acquisition threshold (which is currently $250,000) and contracts for commercial products and services (including commercial off-the-shelf products).

The FASC was established by the Federal Acquisition Supply Chain Security Act (Title II of the SECURE Act) following successive years of exclusions in the National Defense Authorization Act (NDAA). First, in the fiscal year (FY) 2018 NDAA, Kaspersky Lab products and services were mostly banned from the federal supply chain. That followed the next year, in the FY 2019 NDAA, with partial bans for products and services from five Chinese companies and their subsidiaries and affiliates from the federal government supply chain. In the case of the Chinese ban, the use of certain products by prime contractors, even when it was unrelated to the government contracts being performed, was also prohibited. Since the establishment of the FASC, there have been additional restrictions included in the FY 2020 and FY 2023 NDAA, both related to the purchase of drones manufactured in certain foreign countries.

Representatives from the U.S. General Services Administration (GSA), Department of Homeland Security (DHS), Department of Justice (DOJ), Department of Commerce (DOC) and Director of National Intelligence staff the FASC, which is also chaired by a representative from the Office of Management and Budget (OMB). The function and procedures for an exclusion order was established under a final rule effective on Sept. 27, 2021. Exclusion or removal orders can cover a source (a company) or a specific product/service, but are limited to "covered articles," which includes information technology, telecommunications equipment or services processing information on a federal or non-federal system and "[h]ardware, systems, devices, software, or services that include embedded or incidental information technology."

As part of the regulatory changes, FARC created three new Federal Acquisition Regulation (FAR) clauses: FAR 52.204-28 (Federal Acquisition Supply Chain Security Act Orders – Federal Supply Schedules, Governmentwide Acquisition Contracts and Multi-Agency Contracts) – FAR 52.204-29 (Federal Acquisition Supply Chain Security Act Orders-Representation and Disclosures) and FAR 52.204-30 (Federal Acquisition Supply Chain Security Act Orders – Prohibition). With respect to these clauses:

• FAR 52.204-28 is applicable to federal supply schedules, governmentwide acquisition contracts and multiagency contracts and requires that contractors comply with removal or exclusion orders during contract performance or remove any products or services that, upon notification from a contracting officer, are the subject of a governmentwide exclusion order from the FASC.
• FAR 52.204-29 is applicable for all contracts (except for contracts covered by FAR 52.204-28) and: 1) prohibits contractors from utilizing or providing a prohibited product or service, 2) requires contractors to review SAM for any prohibited product and service or the solicitation prior to submission of an offer and 3) provides that by submitting an offer, a contractor implicitly represents that it has conducted a "reasonable inquiry" and does not plan to use or offer a prohibited product or service. Further, if a contractor wants to provide or use a prohibited product or service, it must make a disclosure in the offer that includes the name of the product or service, other information specific to the product and service and why it is being provided or used. With that information, the contracting officer can determine whether to pursue a waiver, which is in its discretion.
• FAR 52.204-30 is applicable to all solicitations and contracts (with alternate versions being applicable to certain governmentwide contracts) and: 1) prohibits the use or provision of a product or service if an applicable exclusion order applies, 2) requires contractors search for exclusion orders in SAM and 3) requires contractors disclose if they intend to use or provide impacted products or services. Contractors are also required to review SAM once every three months during contract performance to determine whether a new exclusion order has been issued and, if so, make a reasonable inquiry to determine whether that exclusion order impacts existing contracts (whether the prohibited product or service was used in the performance of a contract or provided to the government in the performance of a contract). An initial report is required within three business days and, within 10 business days, a description of mitigation efforts and a report on efforts made to ensure prohibited products or services were not included as part of an order. All DOD reports must be submitted via the DIBNet, while all other reports are submitted to the appropriate contracting officer.

Taking these new FAR provisions as a whole, contractors will regularly be required to review SAM for new exclusion orders both prior to the submission of an offer and once every three months while a contract is being performed. Contractors should update their procedures and compliance plans to ensure that SAM is reviewed in a manner that allows compliance with these new requirements.

Contractors should also be aware that exclusions include products or services being used in support of the performance of a contract. See FAR 52.204-29(b). An expansive reading of that could include products or services that are never delivered to the federal government but aid the contractor in performance.

Parties interested in providing comments to the rule have until Dec. 4, 2023, to do so.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.