Redesignation of Regulations for Securing the Information and Communications Technology and Services Supply Chain

AGENCY:

Bureau of Industry and Security, Department of Commerce.

ACTION:

Final rule.

SUMMARY:

This rule redesignates regulations governing the procedures for the review of certain transactions involving information and communications technology and services (ICTS) designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary and which pose or may pose undue or unacceptable risks to the United States or U.S. persons. This action reflects the transfer of responsibility for implementing these regulations from the Secretary of Commerce to the Bureau of Industry and Security (BIS), Office of Information and Communications Technology and Services (OICTS).

DATES:

This rule is effective July 18, 2024.

FOR FURTHER INFORMATION CONTACT:

Rachel O'Meara, U.S. Department of Commerce, telephone: (202) 482-4124, email: ictsupplychain@doc.gov. For media inquiries: Jessica Stallone, Office of Congressional and Public Affairs, Bureau of Industry and Security, U.S. Department of Commerce: OCPA@bis.doc.gov.

SUPPLEMENTARY INFORMATION:

I. Introduction

This final rule is a procedural action to redesignate U.S. Department of Commerce (Department) regulations that govern the procedures for the review of certain transactions involving ICTS designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary and which pose or may pose undue or unacceptable risks to the United States or U.S. persons. Responsibility for implementing these regulations lies within the BIS's OICTS. This action moves regulations from subtitle A in the Code of Federal Regulations (CFR), which is generally reserved for Secretarial actions and Department-wide activities and operations, to chapter VII in title 15 of the CFR, where BIS regulations are located. Specifically, this action removes the regulations in title 15, subtitle A, part 7 (under the “Office of the Secretary of Commerce”), reserving that part, and redesignates them as title 15, subtitle B, chapter VII, part 791 (under the “Bureau of Industry and Security, Department of Commerce”).

The provisions being redesignated were originally administered by the Office of the Secretary, but were formally transferred to BIS when OICTS was established on March 15, 2022 (consistent with the Consolidated Appropriations Act for Fiscal Year 2022). Therefore, the Department is transferring the regulations to subtitle B, “Regulations Relating to Commerce and Foreign Trade,” chapter VII, “Bureau of Industry and Security, Department of Commerce.” title 15, subtitle B, chapter VII regulations are specific to BIS authorities and processes. This is a procedural change that does not impact any processes of the Department or BIS, and will have no impact on any public or private entity outside of BIS.

II. Background

The existing 15 CFR part 7 regulations, which are being redesignated, implement Executive Orders (E.O.s), E.O. 13873, “Securing the Information and Communications Technology and Services Supply Chain” (84 FR 22689, May 17, 2019) and E.O. 14034, “Protecting Americans' Sensitive Data From Foreign Adversaries” (86 FR 31423, June 11, 2021).

E.O. 13873 declares a national emergency under the National Emergencies Act (50 U.S.C. Ch. 34, section 1601 et seq.) and invokes the International Emergency Economic Powers Act (IEEPA) (50 U.S.C. 1701 et seq.) to take certain actions regarding the unrestricted acquisition and use in the United States of certain information and communication technology and services (ICTS) and classes of ICTS designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of foreign adversaries. E.O. 13873 authorizes the Secretary, pursuant to IEEPA, to prohibit certain ICTS transactions or approve them subject to the establishment of measures to mitigate identified risks. To implement E.O. 13873, on January 19, 2021, the Department published an interim final rule (86 FR 4909) creating 15 CFR part 7, which sets forth definitions and procedures for the Department to review and determine whether ICTS transactions involving entities with a foreign adversary nexus and U.S. entities present an undue risk of sabotage to or subversion of the ICTS supply chain, or an unacceptable risk to U.S. persons or national security.

E.O. 14034 (86 FR 31423), elaborates on measures to address the national emergency declared in E.O. 13873 with respect to the ICTS supply chain and authorizes the Secretary to evaluate connected software application transactions that may pose an unacceptable risk to the national security of the United States or the security and safety of U.S. persons. To implement E.O. 14034, the Department published a Final Rule (88 FR 39353) that amended 15 CFR 7.1, 7.2, and 7.3.

In June 2023, consistent with the Consolidated Appropriations Act for Fiscal Year 2022, responsibility for implementing the authorities in E.O.s 13873 and 14034, as described above, was transferred by the Secretary to the Deputy Under Secretary of Commerce for Industry and Security, and OICTS was established, with responsibilities managed by an Executive Director who reports to the Under Secretary of Commerce for Industry and Security.

III. Establishment of Subchapter E in Chapter VII and Realignment

Consistent with this transfer, this final rule redesignates the regulations that were promulgated as 15 CFR part 7 of Subtitle A—“Office of the Secretary of Commerce”—to Subtitle B—“Regulations Relating to Commerce and Foreign Trade.” Within subtitle B, chapter VII includes other regulations that implement BIS authorities. This final rule also establishes Subchapter E, following Subchapter D, and creates a new part 791 for OICTS's regulations. Subchapter E is titled “Information and Communications Technology and Services Regulations.”

The redesignation in this final rule clarifies to the public that BIS, not the Office of the Secretary, is responsible for implementation of the ICTS regulations. This shift in no way impacts the content or text of current and proposed regulations. Because of this, publication of this final rule is merely procedural and therefore advance notice and opportunity for comment and delay in effective date are unnecessary under the Administrative Procedures Act (4 U.S.C. 553), because OICTS is making a technical change in merely updating the designation of existing regulations.

IV. Redesignation

This final rule redesignates all sections of 15 CFR part 7 as 15 CFR part 791, which will be in the newly created subchapter E of chapter VII. All sections in 15 CFR part 7 will be designated under 15 CFR part 791. Future rulemakings by BIS OICTS will be finalized in title 15, subtitle B, chapter VII.

Rulemaking Requirements

1. This action has not been determined to be significant under Executive Order 12866, as it is a technical redesignation that does not materially affect the substance of the underlying rule.

2. Notwithstanding any other provision of law, no person is required to respond to, nor shall any person be subject to a penalty for failure to comply with, a collection of information subject to the requirements of the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.) (PRA), unless that collection of information displays a currently valid Office of Management and Budget (OMB) Control Number. This action does not impact any information collection or recordkeeping requirements under the PRA.

3. This rule does not contain policies with federalism implications as that term is defined in Executive Order 13132.

4. BIS finds good cause under 5 U.S.C. 553(b)(B) to waive prior notice and an opportunity for public comment on this action because this action merely re-designates existing regulatory text in the Code of Federal Regulations and therefore notice and comment are unnecessary. Furthermore, because this action makes no substantive changes, it does not constitute a substantive rule, and it is not subject to the requirement for a 30-day delay in effective date under 5 U.S.C. 553(d).

5. Because a notice of proposed rulemaking and an opportunity for public comment are not required to be given for this rule by 5 U.S.C. 553, or by any other law, the analytical requirements of the Regulatory Flexibility Act, 5 U.S.C. 601, et seq., are not applicable. Accordingly, no regulatory flexibility analysis is required, and none has been prepared.

List of Subjects in 15 CFR Parts 7 and 791

• Administrative practice and procedure
• Business and industry
• Communications
• Computer technology
• Critical infrastructure
• Executive orders
• Foreign persons
• Investigations
• National security
• Penalties
• Technology
• Telecommunications

Subtitle A—Office of the Secretary of Commerce

PART 7—SECURING THE INFORMATION AND COMMUNICATIONS TECHNOLOGY AND SERVICES SUPPLY CHAIN

1. The authority citation for part 7 continues to read as follows:

Authority: 50 U.S.C. 1701 et seq.; 50 U.S.C. 1601 et seq.;E.O. 13873, 84 FR 22689; E.O. 14034, 86 FR 31423.

PART 7—[REDESIGNATED AS PART 791]

2. Redesignate part 7 as part 791, according to the following table:

3. In newly redesignated § 791.102 amend paragraph (c) by removing “§ 7.109 of this part” and adding “§ 791.109” in its place.

4. In newly redesignated § 791.103:

a. Amend paragraph (a) by removing “§ 7.100(a)” and adding “§ 791.100(a)” in its place;

b. Amend paragraph (b) introductory text by removing “§ 7.3(a) of this part” and adding “§ 791.3(a)” in its place; and

c. Amend paragraph (b)(2) by removing “§ 7.100(a)” and adding “§ 791.100(a)” in its place.

5. In newly redesignated § 791.104, remove “§ 7.103” and add “§ 791.103” in its place and remove the two instances of “§ 7.103(c)” and add “§ 791.103(c)” in their place.

6. In newly redesignated § 791.105:

a. Amend paragraph (a) introductory text by removing “§ 7.104” and adding “§ 791.104” in its place and removing “§ 7.103(c)” and adding “§ 791.103(c)” in its place;

b. Amend paragraph (b) introductory text by removing “§ 7.104” and adding “§ 791.104” in its place and removing the two instances of “§ 7.103(c)” and adding “§ 791.103(c)” in their place.

7. In newly redesignated § 791.107:

a. Amend the introductory text by removing “§ 7.105” and adding “§ 791.105” in its place;

b. Amend paragraph (d) by removing “§ 7.109” and adding “§ 791.109” in its place; and

c. Amend paragraph (f) by removing “section 7.108 of this rule” and adding “§ 791.108” in its place.

8. In newly redesignated § 791.108:

a. Amend paragraph (a) by removing “§ 7.107” and adding “§ 791.107” in its place and removing “§ 7.103(c)” and adding “§ 791.103(c)” in its place;

b. Amend paragraph (b) by removing “§ 7.107” and adding “§ 791.107” in its place and by adding “of this section” after “with paragraph (a)”; and

c. Amend paragraph (d) by removing “§ 7.109” and adding “§ 791.109” in its place.

9. In newly redesignated § 791.109, amend paragraph (b) by removing “§ 7.103” and adding “§ 791.103” in its place.

10. Under the authority of section 301 of Title 5, United States Code, (5 U.S.C. 301) and Chapter 40 of Title 15 of the United States Code (15 U.S.C. 1501 et seq.), add subchapter E, consisting of parts 790 through 799, to read as follows:

Subchapter E—Information and Communications Technology and Services Regulations

PART 790 [RESERVED]

PART 791—SECURING THE INFORMATION AND COMMUNICATIONS TECHNOLOGY AND SERVICES SUPPLY CHAIN.

PARTS 792-799 [RESERVED]

11. Transfer part 791 to subchapter E.