Requirements for information relating to supply chain risk

Section 3252 of title 10, United States Code, is amended— (1) in subsection (b)— (A) in paragraph (1), by inserting officials, general counsels, after procurement; (B) in paragraph (2)(B), by striking measures are not reasonably available to reduce and inserting measures have been taken and are not reasonably expected to reduce; (C) in paragraph (3)— (i) in subparagraph (A)— (I) by inserting, including the nature of the supply chain risk, after risk assessment; and (II) by striking; and and inserting a semicolon; and (ii) in subparagraph (B)— (I) by striking measures that were considered and why they were not reasonably available to reduce and inserting measures that were taken and why they were not reasonably expected to reduce; and (II) by striking the period at the end and inserting; and; and (iii) by adding at the end the following new subparagraph: (C) a legal opinion from the Department of Defense Office of General Counsel that the determination required in paragraph (2), as well as the analysis required in subparagraphs (A) and (B) of this paragraph, meets the statutory requirements of this section;; and (D) by adding at the end the following new paragraphs: (4) determining and certifying to the appropriate congressional committees that a foreign entity of concern in the supply chain has carried out nefarious, malicious, or concerning actions warranting such exercise of authority; and (5) the Inspector General of the Department of Defense conducts a review and determines that all requirements under this subsection have been met.; (2) in subsection (c)(2)— (A) by redesignating subparagraphs (B) and (C) as subparagraphs (C) and (D), respectively; and (B) by inserting after subparagraph (A) the following new subparagraph: (B) allow the appropriate parties of a covered procurement action a 30-day window to address the Department’s concerns or take other remedial actions;; (3) by redesignating subsection (d) as subsection (e); and (4) by inserting after subsection (c) the following new subsection: (d) Limitations on authority (1) Unless a complete and detailed notification has been received by the appropriate congressional committees within 5 days of a determination under this section, the determination shall have no effect for purposes of this section until the notification has been so received. (2) A determination under this section shall not be invoked for contract disputes or as a negotiating tool and shall only be invoked to protect critical defense systems from adversary exploitation by screening out suppliers who pose unacceptable risks of sabotage or malicious subversion in the procurement process..