DOC Submits Final Rule on ICT Supply Chain Security to OMB

Yesterday, OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a final rule from the Department of Commerce on “Securing the Information and Communications Technology and Services Supply Chain; Connected Software Applications”. 

The Spring 2022 Unified Agenda listing for this rulemaking describes its purpose as:

“To implement Executive Order 14034, Protecting Americans’ Sensitive Data from Foreign Adversaries (EO 14034), the Department of Commerce is proposing to amend its Interim Final Rule on Securing the Information and Communications Technology and Services Supply Chain (Supply Chain IFR), that was published on January 19, 2021.  Specifically, this proposed rule would update the Supply Chain IFR to clarify that the term information and communications technology and services (ICTS) includes connected software applications. This update also would add the term connected software applications to the definition section of the Supply Chain IFR, as well as to the definition of ICTS and ICTS Transaction.  Additionally, this proposed rule would make other conforming changes to the Supply Chain IFR to explicitly state that ICTS Transactions include transactions that involve connected software applications.”