Public Law 115–390: To require the Secretary of Homeland Security to establish a security vulnerability disclosure policy, to establish a bug bounty program for the Department of Homeland Security, to amend title 41, United States Code, to provide for Federal acquisition supply chain security, and for other purposes.

The Office of Management and Budget.

The General Services Administration.

The Department of Homeland Security, including the Cybersecurity and Infrastructure Security Agency.

The Office of the Director of National Intelligence, including the National Counterintelligence and Security Center.

The Department of Justice, including the Federal Bureau of Investigation.

The Department of Defense, including the National Security Agency.

The Department of Commerce, including the National Institute of Standards and Technology.

Such other executive agencies as determined by the Chairperson of the Council.

The lead representative of an agency designated under subparagraph (A) shall ensure that appropriate personnel, including leadership and subject matter experts of the agency, are aware of the business of the Council.

subject to subsection (d), developing a schedule for meetings of the Council;

designating executive agencies to be represented on the Council under subsection (b)(1)(H);

in consultation with the lead representative of each agency represented on the Council, developing a charter for the Council; and

not later than 7 days after completion of the charter, submitting the charter to the appropriate congressional committees and leadership.

the content to be shared;

the circumstances under which sharing is mandated or voluntary; and

the circumstances under which it is appropriate for an executive agency to rely on information made available through such sharing in exercising the responsibilities and authorities provided under this section and section 4713 of this title.

accept information submitted by executive agencies based on the criteria established under paragraph (2);

facilitate the sharing of information received under subparagraph (A) to support supply chain risk analyses under section 1326 of this title, recommendations under this section, and covered procurement actions under section 4713 of this title;

share with the Council information regarding covered procurement actions by executive agencies taken under section 4713 of this title; and

inform the Council of orders issued under this section.

shared services, such as support for making risk assessments, validation of products that may be suitable for acquisition, and mitigation activities; and

common contract solutions to support supply chain risk management activities, such as subscription services or machine-learning-enhanced analysis applications to support informed decision making.

recommending orders applicable to executive agencies requiring the exclusion of sources or covered articles from executive agency procurement actions (in this section referred to as ‘exclusion orders’);

recommending orders applicable to executive agencies requiring the removal of covered articles from executive agency information systems (in this section referred to as ‘removal orders’);

requesting and approving exceptions to an issued exclusion or removal order when warranted by circumstances, including alternative mitigation actions or other findings relating to the national interest, including national security reviews, national security investigations, or national security agreements; and

ensuring that recommended orders do not conflict with standards and guidelines issued under section 11331 of title 40 and that the Council consults with the Director of the National Institute of Standards and Technology regarding any recommended orders that would implement standards and guidelines developed by the National Institute of Standards and Technology.

information necessary to positively identify the sources or covered articles recommended for exclusion or removal;

information regarding the scope and applicability of the recommended exclusion or removal order;

a summary of any risk assessment reviewed or conducted in support of the recommended exclusion or removal order;

a summary of the basis for the recommendation, including a discussion of less intrusive measures that were considered and why such measures were not reasonably available to reduce supply chain risk;132 STAT. 5182

a description of the actions necessary to implement the recommended exclusion or removal order; and

where practicable, in the Council’s sole and unreviewable discretion, a description of mitigation steps that could be taken by the source that may result in the Council rescinding a recommendation.

that a recommendation has been made;

of the criteria the Council relied upon under paragraph (1) and, to the extent consistent with national security and law enforcement interests, of information that forms the basis for the recommendation;

that, within 30 days after receipt of notice, the source may submit information and argument in opposition to the recommendation;

of the procedures governing the review and possible issuance of an exclusion or removal order pursuant to paragraph (5); and

where practicable, in the Council’s sole and unreviewable discretion, a description of mitigation steps that could be taken by the source that may result in the Council rescinding the recommendation.

an exclusion or removal order is issued pursuant to paragraph (5); and

the source has been notified pursuant to paragraph (6).

Recommendations of the Council under paragraph (2), together with any information submitted by a source under paragraph (3) related to such a recommendation, shall be reviewed by the following officials, who may issue exclusion and removal orders based upon such recommendations:

The officials identified in subparagraph (A) may not delegate any authority under this subparagraph to an official below the level one level below the Deputy Secretary or Principal Deputy Director, except that the Secretary of Defense may delegate authority for removal orders to the Commander of the United States Cyber Command, who may not redelegate such authority 132 STAT. 5183 to an official below the level one level below the Deputy Commander.

If officials identified under this paragraph from the Department of Homeland Security, the Department of Defense, and the Office of the Director of National Intelligence issue orders collectively resulting in a governmentwide exclusion, the Administrator for General Services and officials at other executive agencies responsible for management of the Federal Supply Schedules, governmentwide acquisition contracts and multi-agency contracts shall help facilitate implementation of such orders by removing the covered articles or sources identified in the orders from such contracts.

The officials identified under this paragraph shall review all exclusion and removal orders issued under subparagraph (A) not less frequently than annually pursuant to procedures established by the Council.

Orders issued pursuant to subparagraph (A) may be rescinded by an authorized official from the relevant issuing agency.

notify any source named in the order of—

provide classified or unclassified notice of the exclusion or removal order to the appropriate congressional committees and leadership; and

provide the exclusion or removal order to the agency identified in subsection (a)(3).

the supply chain risk posed by the acquisition of covered articles; and

compliance with the requirements of this subchapter.

arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law;

contrary to constitutional right, power, privilege, or immunity;

in excess of statutory jurisdiction, authority, or limitation, or short of statutory right;

lacking substantial support in the administrative record taken as a whole or in classified information submitted to the court under paragraph (3); or

not in accord with procedures required by law.

The procedures described in this paragraph shall apply to the review of a petition under this section.

“(iii)

In camera and ex parte.—

A determination by the court under this subsection shall be the exclusive judicial remedy for any claim described in this section against the United States, any United States department or agency, or any component or official of any such department or agency.

Nothing in this section shall be construed as limiting, superseding, or preventing the invocation of, any privileges or defenses that are otherwise available at law or in equity to protect against the disclosure of information.

any information or material that has been determined by the United States Government pursuant to an Executive order, statute, or regulation to require protection against unauthorized disclosure for reasons of national security; and

any restricted data, as defined in section 11 of the Atomic Energy Act of 1954 (42 U.S.C. 2014).132 STAT. 5188