Requirement for memoranda of agreement regarding vulnerability disclosure and prohibition on procurement from IT providers who share cyber vulnerabilities with countries of concern

(a) Requirement On and after the date that is 270 days after the date of the enactment of this Act, the Secretary of Defense shall not enter into or renew a contract for the procurement of information technology with any entity that makes such technology commercially available to customers in a country of concern or has operations, subsidiaries, or personnel located in a country of concern unless such entity has entered into a memorandum of agreement with the Department of Defense in accordance with subsection (b). (b) Memorandum of agreement The Secretary of Defense shall require an entity covered under subsection (a) to agree to a memorandum of agreement under which the entity shall— (1) disclose to the Department of Defense, prior to any advance disclosure to any other entity, all security vulnerabilities affecting the information technology procured under the contract; and (2) not provide advance disclosure of such vulnerabilities to any covered company. (c) Definitions In this section: (1) The term advance disclosure means any action that preemptively and privately discloses information pertaining to security vulnerabilities to a select number of entities before publicly making such information available to the general public, including through a trusted partners program. (2) The term control means the power, direct or indirect, whether or not exercised, to determine, direct, dictate, or decide important matters affecting an entity, including through— (A) the ownership of at least 20 percent of the total outstanding voting interest in an entity; (B) board representation; (C) the ability to appoint or discharge any board members, officers, directors, employees, or contractors; (D) proxy voting, a special share, contractual arrangements, legal obligations, formal or informal arrangements to act in concert; or (E) other means. (3) The term country of concern has the meaning given the term covered nation in section 4872(f) of title 10, United States Code. (4) The term covered company means— (A) any entity owned or operated in whole or in part by a country of concern, or subject to the control of such country of concern, and any subsidiary or parent of such entity; or (B) any entity organized under the laws of a country of concern, or having its principal place of business in a country of concern, and any subsidiary of any such entity. (5) The term information technology has the meaning given the term in section 11101 of title 40, United States Code. (6) The term owned or operated in whole or in part means that a country of concern— (A) for an entity that is a publicly traded company, has the ability to control the company, has access to any material nonpublic technical information in the possession of the company, or has any other rights or involvement in directing, dictating, controlling, or participating in the decision-making of the company beyond those available to a retail investor holding an equivalent share of ownership; and (B) for an entity that is a privately held company, has any share of ownership of such company. (7) The term security vulnerability has the meaning given the term in section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650). (8) The term trusted partners program means any initiative or program run by an information technology provider to provide advanced warnings of security vulnerabilities to defensive security providers for the purpose of helping such providers proactively develop defenses against such vulnerabilities. (d) Waiver The Secretary of Defense may waive the requirement in subsection (a) on a case-by-case basis if the Secretary certifies, in writing, to the congressional defense committees that the procurement action is required in the national interest of the United States.