OMB Approved DOC ICTS Supply Chain Security Final Rule

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a final rule from the Department of Commerce on “Securing the Information and Communications Technology and Services Supply Chain”. The notice of proposed rulemaking was published on November 27^th, 2019. An interim final rule (IFR) was published on January 19^th, 2021.

According to the Spring 2024 Unified Agenda entry for this rulemaking:

“Pursuant to Executive Order 13873 [link added] of May 15,2019,"Securing the Information and Communications Technology and Services Supply Chain” and Executive Order 14034 [link added] of June 9, 2021, Protecting Americans' Sensitive Data From Foreign Adversaries,” the Department of Commerce is finalizing the rule that sets forth the process and procedures that the Secretary of Commerce will use to identify, assess, and address transactions that pose an undue risk to the security, integrity, and reliability of information and communications technology and services provided and used in the United States.”

With a probable effective date well after Trumps inauguration in January, the new administration will be able to effectively kill this final rule with an executive order (the underlying IFR would take a new rulemaking to undo). While the rulemaking was initiated under Trumnp 45, the Biden Administration put their stamp on the rulemaking, so it is unclear whether the new administration would let this rule stand.

I will probably not be covering the publication of this final rule in any detail. I will, however, note its publication in the appropriate Short Takes post.