Government Reduces Representation Burdens for Supply Chain Rule Banning Some Chinese Equipment 

Sashkin/Shutterstock.com

Contractors continue to question inconsistent language and push for the need for more clarity around Section 889 Part B.

A new provision easing some of the strain caused by a major supply chain rule banning use of some Chinese equipment took effect last week, but some in the contracting community say more clarity is still needed in order to make implementing the rule doable. 

Section 889(a)(1)(b) of the 2019 National Defense Authorization Act prohibits contractors from using equipment from five Chinese companies including Huawei, ZTE and their subsidiaries or affiliates as part of their work for the federal government. Part B went into effect August 13, and October 26, an addendum to the rule went out changing representation requirements from an offer-by-offer basis to a once-annually recertification process in the System for Awards Management, or SAM.

But inconsistencies in language throughout the life of Section 889 may be adding confusion to what was already a difficult rollout. While there is broad consensus that the intent of 889 is the right move for the federal government, some in industry say the rule is effectively too big to implement. 

Part B of Section 889 drops language that was included in the NDAA, according to comments submitted to the FAR Council by the industry group the Internet Association. While the NDAA language specified “use” meant as part of a “substantial or essential component” or as a “critical technology” in any system, Part B’s representation language doesn’t include these qualifiers. The second sequence of Part B that went into effect Monday does not fix this problem, but instead still lacks the qualifiers.  

The annual representation language asks contractors to say whether they use equipment provided by the covered entities—or their subsidiaries or affiliates—regardless of import or how high in the supply chain the equipment sits. This also applies to any work a contractor performs, not just in products or services provided for the government. 

“The way Section 889 is being implemented, especially with the representation that's being required, it is not allowing for a risk-based approach,” Omid Ghaffari-Tabrizi, IA’s director of cloud policy, told Nextgov

In its comments, IA referenced supply chain risk management guidance from the Cybersecurity and Infrastructure Security Agency and the National Institute for Standards and Technology to point out accepted standards suggest organizations should focus on systems and components with the potential to do the most damage if they are compromised instead of the “entire universe of hypothetical risks.” 

“The only way to do this effectively is to take an iterative sort of approach and really break this up,” Ghaffari-Tabrizi said. “Take those substantial and critical components, analyze what's involved in those first, and then build yourself out to what may be directly or indirectly connected to those components and analyze what kind of threats may exist in those.”

The unlimited language adds work on both sides of the procurement table and is out of line with the intent of the provision as it was written in the 2019 NDAA, Ghaffari-Tabrizi added. It is also likely to have a negative impact on competition as smaller contractors struggle to cover costs to enable compliance, he said. IA’s comments suggested reasonable inquiry at this point essentially creates a need for audits, which the government has said would not be required under 889.

“Where does the decision get made about whether an item is in fact included in the definition of critical technology or a substantial or essential component?” Alan Chvotkin, executive vice president at the Professional Services Council, said of the confusion over the language in Part B. 

In its comments on the new representation requirements, PSC lauded the FAR Council for the annual representation component but asked for more clarity around audits. PSC requested the FAR Council put in writing that reasonable inquiry burdens explicitly exclude any requirement to conduct audits. It also wants the reasonable inquiry language to be added to the first Section 889 rule, which took effect in 2019 without the more approachable reasonable inquiry standard. 

Jennifer Bisceglie, chief executive officer at Interos, an artificial intelligence platform that analyzes supply chains, told Nextgov national security risks associated with the covered entities can realistically be stopped by focusing on the top five tiers of the supply chain. Beyond the prime plus the four tiers below the prime, the amount of impact compromised equipment could have is—in most cases—minimized.  

“The challenge is that we want something that industry can actually accomplish,” Bisceglie said. “And right now, there's just no way to accomplish it as it's written.” 

One significant problem contractors face is a lack of information around identifying the subsidiaries and affiliates of the covered entities as well as what commercial products may be connected to the covered entities. 

During a September webinar covering Section 889 implementation, the General Services Administration said it does not provide a comprehensive list of subsidiaries and affiliates. In a frequently asked questions document updated October 23, the U.S. Agency for International Development referred those looking for such a list to the Bureau of Industry and Security within the Commerce Department. 

It is not immediately clear to what list USAID was referring, but a BIS official told Nextgov its Entity List identifies foreign parties that are subject to certain trade regulations. Commenters identified only as persons who implement contracts for USAID in Ethiopia and Kenya asked the government to either come up with its own list or to confirm contractors should be using the BIS Entity List to guide 889 compliance. 

Bisceglie said a supply chain analysis conducted by the Interos platform revealed this subsidiaries and affiliates list may include several hundred entities linked to the five original covered entities. 

But the government is likely hesitant to publish a list for 889 subsidiaries and affiliates because companies that find themselves on the list may see it and change their name or create a new product, Chvotkin said. 

The complications around implementing Part B of 889 have led the Office of the Director of National Intelligence to grant several waivers to agencies including USAID and the Defense and State departments. Waivers for these agencies have been extended through September 2022. 

PSC said in its comments the waiver extensions “[verify] the need for the government to address concerns raised by the contractor community in response to Section 889’s Implementation Rules.” 

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.