Subpart 504.70 - Supply Chain Risk Management

504.7000 Scope of subpart.

This subpart prescribes acquisition policies and procedures mitigating supply chain risks in the post-award phase of a procurement funded by GSA. Procedures in this subpart apply to all GSA funded contracts and orders. These procedures apply regardless of the estimated value of the contract.

504.7001 Definitions.

“Prohibited article” means any prohibited product, system, or service that the contractor provides that conflicts with the supply chain terms or conditions of the contract (e.g., GSA CIO Order, counterfeit items, or a FAR clause, including without limitation the FAR Clause at 52.204-23, Prohibition on Contracting for Hardware, Software, Products and Services Developed or Provided by Kaspersky Lab and Other Covered Entities).

“Supply chain” means a linked set of resources and processes between multiple tiers of developers that begins with the sourcing of products and services and extends through the design, development, manufacturing, processing, handling, and delivery of products and services to the acquirer.

504.7002 Policy.

      (a) The Federal Information Security Modernization Act of 2014 and associated National Institute of Standards and Technology (NIST) guidance requires Federal agencies to manage supply chain risks for Federal information systems.

      (b) OMB Circular A-130, “Managing Information as a Strategic Resource,” directs agencies to implement supply chain risk management principles to protect against the insertion of counterfeits, unauthorized production, tampering, theft, insertion of malicious software, as well as poor manufacturing and development practices throughout the system development life cycle.

      (c) The SECURE Technology Act (Public Law 115-390) requires GSA to have a lead representative of the agency on the Federal Acquisition Security Council as well as address supply chain risks posed by the acquisition of covered articles.

504.7003 General procedures.

      (a) Each service and staff office must provide a supply chain risk management point of contact to GSA’s representative to the Federal Acquisition Security Council or designee to assist in providing recommended guidance to mitigate supply chain risks.

      (b) GSA contracting activities may discuss supply chain concerns with the relevant Supply Chain Risk Management Point(s) of Contact listed on the GSA Acquisition Portal (http://insite.gsa.gov/scrm) at any time, including during acquisition planning and requirements development.

504.7004 [reserved]

504.7005 Post-award procedures.

      (a) Supply Chain Event Report.

           (1) If a prohibited article is discovered within the supply chain of a procurement, the contracting officer shall immediately submit a supply chain event report using the online form on the GSA Acquisition Portal (http://insite.gsa.gov/scrm) to ensure appropriate service and staff offices within GSA are notified.

           (2) The supply chain event report must include the following information:

                (i) Contract information, including contract number and contractor name;

                (ii) GSA contracting office;

                (iii) Prohibited article name; and

                (iv) Reason why prohibited article is banned on contract.

           (3) The contracting officer shall provide as much information as is available at the time of report submission.

           (4) GSA’s representative to the Federal Acquisition Security Council or designee will notify the contracting officer to confirm receipt of the report.

      (b) Supply Chain Event Risk Mitigation. The contract administration procedures under FAR part 49 (e.g., cure notice, termination for cause, past performance review) can be utilized as needed to address immediate or future supply chain event concerns. Additional guidance on contract administration procedures is available on the GSA Acquisition Portal (http://insite.gsa.gov/scrm).

      (c) Past Performance Evaluation. The contracting officer shall report any contractor non-compliance with supply chain requirements within the “Other Areas” portion of any applicable past performance evaluation form.