Release of Interim Rule for 2019 NDAA Section 889 (a) (1) (B): What Does It Mean for Your Company?

On July 10 the U.S. Government Federal Acquisition Regulatory (FAR) Council (the Department of Defense (DoD), General Services Administration, and the National Aeronautics and Space Administration) released a prepublication interim rule with changes to the Federal Acquisition Regulations (FAR) to implement Section 889 (a) (1) (B) (Section 889 (B)) of the 2019 National Defense Authorization Act (NDAA). This action was followed with formal publication in the Federal Register on July 14. The interim rule provides some clarity for government contractors on several of the key Section 889 (B) implementation issues that Ankura highlighted in a recent article.

Section 889 (B) prohibits executive agencies from entering into, extending, or renewing, a contract with an entity that uses any equipment, system, or service that uses “covered telecommunications equipment or services” (equipment or services offered by certain Chinese companies) as a substantial or essential component of any system, or as critical technology as part of any system (collectively “covered equipment/services”).

The interim rule notes that “supply chain exploitation is a complex and growing threat to important U.S. economic sectors and critical infrastructure.”  Moreover, foreign-owned or controlled telecommunications equipment and the growing use of networking technologies create additional supply chain vulnerabilities, particularly surrounding protection of sensitive data, trade secrets, and intellectual property.

Key Takeaways

• No delay: The interim rule indicated that there will be no delay in implementation of Section 889 (B). The interim rule will come into effect on August 13. Only the provision applicable to domestic affiliates, subsidiaries, and parents (discussed below) is delayed until August 13, 2021. While Congress may still delay implementation, little time remains for companies subject to Section 889 (B) to prepare for required representations before the rule becomes effective.
• Reasonable inquiry: The standard that underlies the Section 889 (B) compliance contract representation is that entities make a “reasonable inquiry,” which is defined as “an inquiry designed to uncover any information in the entity’s possession about the identity of the producer or provider of covered telecommunications equipment or services used by the entity.” The interim rule explicitly notes it need not include an independent or third-party audit. However, contractors subject to Section 889 (B) should carefully develop and document a methodology to be used for conducting the reasonable inquiry. This methodology should document the business functions examined, stakeholders interviewed, the technology examined, and the full range of documents and systems reviewed. Contractors should also make the reasonable inquiry, as well as any remediation findings (potential covered equipment/services) an input into its Section 889 (B) compliance program (discussed below).
• Scope of “use” and “covered telecommunications equipment or services”: The interim rule adopts an expansive definition of “use,” indicating that the rule applies “regardless of whether that use is in performance of work under a Federal contract.” It did not provide any additional modifications or limitation of the definition of “covered telecommunications equipment or services” or “critical technology” – both of which remain as defined in the 2019 NDAA and the Federal Investment Risk Review Modernization Act (FIRRMA), respectively.
• Supply chain diligence still required: A major concern for industry groups was that Section 889 (B) would require a company to represent whether its subcontractors were also compliant with the “use” prohibition. The interim rule indicates that the Section 889 (B) representation is to be made by the contracting entity only and not by its lower-tier subcontractors or suppliers. On its face, this is a positive development for contractors. In practice however, prime contractors must still exercise caution because they must still interact with their supply chain to determine whether the prime is using covered equipment/services provided by subcontractors, suppliers or vendors. In publishing the interim rule, the FAR Council emphasized the need for strong supply chain oversight generally. A mere insertion of Section 889 requirements in subcontracting terms and conditions may not satisfy the U.S. government’s expectations that Section 889 representations be backed up by reasonable inquiry. A robust program of supply chain due diligence will assure Section 889 compliance and will spin off other operational and compliance improvements.
• Delayed application to domestic affiliates, subsidiaries, and parents: Regulators are currently considering whether to extend Section 889 (B) to the contracting entity’s domestic affiliates, subsidiaries, and parents. If extended, this requirement will go into effect on August 13, 2021. While this is some relief to contractors, particularly those who feared application to many affiliates, subsidiaries, and parents, it still poses a significant but delayed regulatory risk and potential burden, particularly for companies that are not primarily government contractors.
• Compliance program: The interim rule conveys the government’s expectation that companies adopt a “robust, risk-based compliance approach,” including, at a minimum, the following six elements:
  1. Regulatory familiarization: The organization must familiarize itself with the rules and the various requirements.
  2. Corporate enterprise tracking: The organization must conduct a “reasonable inquiry” as to whether it uses covered equipment/services. The interim rule notes that the prime contractor must examine relationships with subcontractors or suppliers who may provide covered equipment/services.
     This diligence enables the prime contractor to confidently know whether the prime itself uses third party supplied covered equipment/services. Additionally, this information will be important in the event that the U.S. government expands the Section 889 (B) representations to include use by lower-tier suppliers, subcontractors, or vendors. Also, insofar as companies make similar inquiries of their lower-tier providers to assure compliance with Section 889 (A), seeking the additional information on use may not represent a significant additional undertaking and would serve to identify risks in the supply chain.
  3. Education: Organizations must ensure that their purchasing/procurement, and materials management professionals understand Section 889 (B) and the organizational compliance plan.
  4. Cost of removal: The prime contractor should put in place procedures to replace existing covered equipment/services and identify compliant replacements.
  5. Representation: A prime contractor must provide a representation as to whether it uses covered equipment/services, or whether such use is discovered during contract performance.
  6. Phase-out Plan and Waiver Submission: The interim rule lays out a detailed waiver request and approval process. A waiver provides a one-time extension to expire no later than August 13, 2022, and a waiver request will require (a) “compelling justification,” (b) a “full and complete laydown” of the presence of covered equipment/services, and (c) a “phase-out plan” to eliminate such covered equipment/services. Given this case-specific approach, the regulatory review process articulated in the interim rule, and the short period of time before the interim rule goes into effect, companies that suspect they will seek a waiver should immediately initiate reviews of their current portfolio to identify any covered equipment/services.

Geopolitical Context and Business Impact

The FAR Council noted that Section 889 (B) and its implementing rule are designed to ensure that “Government contractors keep public national security interests in mind when making decisions.” The interim rule referenced multiple national security guidance documents, including the National Security Strategy for a New Era, the National Counterintelligence Strategy of the [USA] 2020-2022, and the 2019 Worldwide Threat Assessment, which collectively indicate the extent to which the U.S. government has substantial concerns about its supply chain.

The FAR Council recognized the higher costs, reduced competition, and potential mission impact of Section 889 (B) and noted that contractors would either pass along these costs or choose not to do business with the U.S. government. However, it found these outcomes justified in light of the “compelling national security objective.” Given this approach, companies of all sizes, and particularly those involved in business with the U.S. government, should re-examine the design and implementation of their existing supply chain and compliance programs, prepare to make informed representations in offers and contracts under the FAR, and ensure ongoing compliance as they seek to do business with the U.S. government. In parallel with efforts to comply with Section 889 (B), contractors will also be mitigating similar business risks such as theft of valuable trade secrets and intellectual property.

How Ankura Can Help

Supply Chain Risk Management (SCRM) – The starting point for Section 889 (B) compliance, as with other downstream supply chain compliance requirements, is to have in place an approach to monitor supply chain risk. Ankura assists companies in conducting a supply chain compliance program mapping assessment as part of its overall SCRM program, identifying the various regulatory requirements applicable depending on the sector, service/product, and other relevant factors. Our National Security, Trade, and Technology (NSTT) practitioners routinely work with federal contractors of all sizes to implement robust SCRM methodologies.

Compliance Program Enhancement – Companies should put in place policies, processes, and other elements of an internal control framework to comply with Section 889 (B), including third party identification and management. Our NSTT practitioners have designed compliance programs and internal controls that implement a range of emerging national security-related regulations. Our assistance has included conducting risk assessments, development of policies and processes, development and delivery of training, and designing and testing of internal controls.

Diligence/Investigations – Our NSTT practitioners can help companies quickly conduct detailed investigations to support the exercise of audit rights and conduct on-the-ground assessments of vendor/supplier compliance with Section 889 (B). In the event of a non-compliance event, NSTT practitioners, experienced in conducting investigations, audits, and monitorships, can assist companies to quickly communicate to regulators the scope of any violation and the effectiveness of mitigation/remediation measures.

© Copyright 2020. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC., its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.