SAFE Supply Chains Act

This bill requires the Department of Defense to buy and use information and communications technology products only from original equipment manufacturers or authorized resellers, with limited exceptions.

Sec. 2, Agency use of IT products: The Secretary of Defense is prohibited from procuring, obtaining, renewing a contract for, or using a covered product (an information and communications technology end-use hardware product or component, including its software and firmware) unless it comes from an original equipment manufacturer or an authorized reseller. An authorized reseller is a reseller, supplier, or distributor with a direct contractual arrangement or express written authority from the original equipment manufacturer. The Secretary may waive this prohibition for scientifically valid research or to avoid jeopardizing mission critical functions, after notifying the congressional defense committees. The waiver notice must include justification, security mitigations, a declaration that the product is not from a foreign adversary, and may include a classified annex. A research waiver lasts for the duration of the research. The Secretary must establish guidance to help entities become authorized resellers. The Secretary must report annually to the Armed Services Committees for six years on the number and types of waivers granted, the legal authority for each, and actions to reduce waivers. No new funds are authorized. The section takes effect one year after enactment.