Att_28_-_Supply_Chain_Risk_Assessment_(SCRA)_0001.pdf

Instructions to Offerors:

As a part of its proposal, the offeror must submit the completed provision HHSAR 352.204-74, Supply Chain Risk Assessment (Deviation), including all potential subcontractor information and representations as required by paragraph (g) of the provision.

PROSPECTIVE CONTRACTOR RESPONSIBILITY AND ELIGIBILITY STANDARDS: SUPPLY CHAIN RISK

ASSESSMENT

Federal Acquisition Regulation (FAR) Subpart 9.1 sets the standards and procedures for determining prospective contractor and subcontractor responsibility. FAR 9.104-2 allows for special standards of responsibility.

Special standards in the responsibility determination: The government will assess the offeror’s submitted information in provision HHSAR 352.204-74, Supply Chain Risk Assessment (Deviation), any required supporting data, and information from other sources for the purpose of evaluating foreign ownership, control or influence and other areas of supply chain risk, when necessary, and this information will be treated by HHS, to the extent permitted by law, as business or financial information submitted in confidence.

The Government may request additional information or a mitigation plan from the offeror that addresses risks identified in the supply chain risk assessment. Any requests for additional information resulting from the supply chain risk assessment do not constitute exchanges or discussions as described in FAR 15.306.

Any mitigation plans and amendments determined necessary and required to be implemented and sustained during contract performance will be incorporated into the contract.

In order to manage supply chain risk, the Government may consider information, public and non-public, relating to an offeror’s supply chain in determining responsibility. The Government may remove the offeror from further consideration due to a Supply Chain Risk determination, which renders the offeror non-responsible. The Government reserves the right to limit the disclosure of information to the Offeror regarding the risk in accordance with all applicable laws or regulations.

Failure by the offeror to affirmatively demonstrate adequate compliance with the general standards of prospective contractor responsibility at FAR 9.104-1, and any special standards established for this acquisition under FAR 9.104-2, may result in a determination of non-responsibility. As with all aspects of prospective contractor responsibility, a finding of non-responsibility can be made at any time prior to contract award. Per FAR 9.103(b), if the prospective contractor is a small business concern, responsibility will be determined in accordance with Subpart 19.6, Certificates of Competency and Determinations of Responsibility. If the prospective contractor is a Section 8(a) participant, see Subpart 19.8.

HHSAR 352.204-74 Supply Chain Risk Assessment (DEVIATION)

As prescribed 304.7304(a) insert the following provision: Supply Chain Risk Assessment (OCT 2024)

(DEVIATION)

(a) Definitions. As used in this provision—

Contract means as defined in FAR 2.101.

Foreign person means as defined in 31 CFR 800.224.

Mission-critical acquisition means the acquisition of products, materials, information, or services that are identified as—

(1) Contract support or development services for HHS or OpDiv/StaffDiv research and development;

(2) Contract support or development services for HHS or OpDiv/StaffDiv financial databases and services;

(3) Contract support services that require utilization or sharing of HHS or OpDiv/StaffDiv Intellectual property;

(4) Contract services supporting HHS or OpDiv/StaffDiv continuity of operations (COOP) mission essential functions;

(5) Contract support services or development initiatives for HHS or OpDiv/StaffDiv critical infrastructure;

(6) An HHS or OpDiv/StaffDiv high-value/dollar acquisition; or

(7) Other acquisitions for critical assets or services as identified by OpDiv/StaffDiv leadership.

Office of National Security (ONS) means the HHS office responsible for the management, oversight, policy, guidance, and implementation of the HHS Enterprise Supply Chain Risk Management (E-SCRM) Program, including the conducting of supply chain risk assessments.

State-owned enterprise means a legal entity that is created by a government in order 6 HHSAR Class Deviation 2025-01 Attachment 1 to partake in commercial activities on the government's behalf. A state-owned enterprise or government-owned enterprise is a business enterprise where the government or state has significant control through full, majority, or significant minority ownership.

Supply chain risk means the potential for harm or compromise that arises as a result of security risks from suppliers, their supply chains, and their products, materials, information, or services.

Supply chain risks include exposures, threats, and vulnerabilities associated with the products and services traversing the supply chain as well as the exposures, threats, and vulnerabilities to the supply chain.

Supply chain risk assessment means a systematic examination of supply chain risks, likelihoods of their occurrence, and potential impacts. Supply chain risk management (SCRM) means a systematic process for managing risk to the integrity, trustworthiness, and authenticity of products, materials, information, and services within the supply chain. It addresses the activities of foreign and other adversaries aimed at compromising the supply chain, which may include the introduction of counterfeit or malicious items into the supply chain. It is conducted through identification of threats, vulnerabilities, and consequences throughout the supply chain and development of mitigation strategies to address the respective risks presented by the supplier, the supplied products, materials, information, and services, or the supply chain at any point during the life cycle.

(b) Supply chain risk assessment. The Office of National Security (ONS) or delegated designee may perform a supply chain risk assessment of the Offeror’s proposal. In performing the supply chain risk assessment, the Government may consider public and non-public information relating to the Offeror’s supply chain.

(c) Required information submittal. The Offeror shall provide the following information for products, materials, information, or services provided under their proposal:

(1) Description of the type of products, materials, information, or services provided.

(2) Vendor and manufacturer’s company, if applicable, including name and address.

(3) If known, vendor’s and manufacturer’s web site, and the Commercial and Government Entity (CAGE) code and Unique Entity Identifier (UEI).

(d) Representations. The Offeror represents that— 7 HHSAR Class Deviation 2025-01 Attachment 1

(1) It [ ] does, [ ] does not have any foreign ownership, outside of retail shareholders, who control more than 10% of the company’s total shares. If yes, identify the legal name of the owning organization/individual and their country of affiliation.

(2) It [ ] does, [ ] does not have any of the following business affiliations with foreign entities:

technology development partnerships, strategic partnerships, joint ventures, foreign subsidiaries, grants from a foreign entity. If yes, identify the legal name of the organization, its foreign address, and the nature of the relationship.

(3) It [ ] does, [ ] does not have any foreign governments, or state-owned enterprises that have investments or ownership interest in the company. If yes, identify the foreign government, the ownership stake percentage, and the nature of the relationship.

(4) The company leadership (C-Suite executives, Board members, etc.) [ ] does, [ ] does not have any substantial ties to foreign countries, including being citizens of a foreign country, graduates of a foreign university, or investments in a foreign country. If yes, identify the individual, the nature of the tie, and the country they are tied to.

(5) It [ ] has, [ ] has not violated export controls or the Foreign Corrupt Practices Act within 5 years. If yes, enter the event, the date, and any remediation the company committed after the event.

(6) It [ ] has, [ ] has not been prohibited from doing business with the government of the US or any of its administrative subdivisions to include agencies, states, territories or municipalities. If yes, enter the event, the date, and any remediation the company committed after the event.

(7) It [ ] has, [ ] has not been prohibited from doing business with any foreign governments or subdivisions thereof. If yes, enter the event, the date, and any remediation the company committed after the event.

(8) It [ ] has had, [ ] has not had affiliations with any entities prohibited (e.g. Huawei, see SAM.gov “exclusions” page for additional information regarding prohibited entities) from doing business with the government of the US or any of its administrative 8 HHSAR Class Deviation 2025-01 Attachment 1 subdivisions to include agencies, states, territories or municipalities? If yes, enter the event, the date, and any remediation the company committed after the event.

(9) It [ ] has, [ ] has not been suspended or debarred at any point while doing business with the U.S. Government or any of its administrative subdivisions to include agencies, states, territories or municipalities. If yes, enter the event, the date, and details below.

(10) It [ ] has previously filed for or is currently in, [ ] has not previously filed for or is not currently in bankruptcy in the last 10 years. If yes, enter the event, the date, and details below.

(11) It [ ] was or is currently in, [ ] was not or is not currently in litigation in the last 10 years.

If yes, enter the event, the date, and details below.

(e) Supply chain risk determination. Findings from the supply chain risk assessment will be considered in connection with a determination of the Offeror’s responsibility and eligibility for award. Failure of the

Offeror to furnish the information required in this provision or provide additional information as requested by the Contracting Officer may render the Offeror non-responsible and ineligible for award.

The Government reserves the right to limit the disclosure of information to the Offeror regarding the risk in accordance with all applicable laws or regulations.

(f) Mitigation plans. Any mitigation plans and amendments determined necessary and to be implemented and sustained during contract performance will be incorporated into the contract.

(g) Subcontracts. The Offeror shall include the substance of this provision, including the information and representations at paragraphs (c) and (d), and including this paragraph (g), in subcontracts with persons or entities proposed to be used involving the development or delivery of any mission-critical products, materials, information, or services. The Offeror shall submit all potential subcontractor information and representations with its proposal for any mission-critical products, materials, information, or services provided for in the proposal.

(End of provision)