Sec. 514. ### (a)

348 words·~2 min read·/statute-compilations/comps-15475/sec-514

A research copy — for the controlling text, always check the official state or federal source. Not legal advice.

## SEC. 514 ###

(a)None of the funds appropriated or otherwise made available under this Act may be used by the Departments of Commerce and Justice, the National Aeronautics and Space Administration, or the National Science Foundation to acquire a high-impact or moderate-impact information system, as defined for security categorization in the National Institute of Standards and Technology’s

(NIST)Federal Information Processing Standard Publication 199, “Standards for Security Categorization of Federal Information and Information Systems” unless the agency has— ####

(1)reviewed the supply chain risk for the information systems against criteria developed by NIST and the Federal Bureau of Investigation

(FBI)to inform acquisition decisions for high-impact and moderate-impact information systems within the Federal Government; ####

(2)reviewed the supply chain risk from the presumptive awardee against available and relevant threat information provided by the FBI and other appropriate agencies; and ####

(3)in consultation with the FBI or other appropriate Federal entity, conducted an assessment of any risk of cyber-espionage or sabotage associated with the acquisition of such system, including any risk associated with such system being produced, manufactured, or assembled by one or more entities identified by the United States Government as posing a cyber threat, including but not limited to, those that may be owned, directed, or subsidized by the People’s Republic of China, the Islamic Republic of Iran, the Democratic People’s Republic of Korea, or the Russian Federation. ###

(b)None of the funds appropriated or otherwise made available under this Act may be used to acquire a high-impact or moderate-impact information system reviewed and assessed under subsection

(a)unless the head of the assessing entity described in subsection

(a)has— ####

(1)developed, in consultation with NIST, the FBI, and supply chain risk management experts, a mitigation strategy for any identified risks; ####

(2)determined, in consultation with NIST and the FBI, that the acquisition of such system is in the national interest of the United States; and ####

(3)reported that determination to the Committees on Appropriations of the House of Representatives and the Senate and the agency Inspector General.