Redesignation of Regulations for Securing the Information and Communications Technology and Services Supply Chain

• Published date: 18 July 2024
• Citation: 89 FR 58263
• Pages: 58263-58265
• FR Document: 2024-15258
• Section: Rules and Regulations
• Issuer: Industry and Security Bureau,Commerce Department,Industry And Security Bureau

Federal Register, Volume 89 Issue 138 (Thursday, July 18, 2024)

[Federal Register Volume 89, Number 138 (Thursday, July 18, 2024)]
                [Rules and Regulations]
                [Pages 58263-58265]
                From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
                [FR Doc No: 2024-15258]
                =======================================================================
                -----------------------------------------------------------------------
                DEPARTMENT OF COMMERCE
                Office of the Secretary
                15 CFR Part 7
                Bureau of Industry and Security
                15 CFR Part 791
                [Docket No. 240620-0169]
                RIN 0694-AJ71
                Redesignation of Regulations for Securing the Information and
                Communications Technology and Services Supply Chain
                AGENCY: Bureau of Industry and Security, Department of Commerce.
                ACTION: Final rule.
                -----------------------------------------------------------------------
                SUMMARY: This rule redesignates regulations governing the procedures
                for the review of certain transactions involving information and
                communications technology and services (ICTS) designed, developed,
                manufactured, or supplied by persons owned by, controlled by, or
                subject to the jurisdiction or direction of a foreign adversary and
                which pose or may pose undue or unacceptable risks to the United States
                or U.S. persons. This action reflects the transfer of responsibility
                for implementing these regulations from the Secretary of Commerce to
                the Bureau of Industry and Security (BIS), Office of Information and
                Communications Technology and Services (OICTS).
                DATES: This rule is effective July 18, 2024.
                FOR FURTHER INFORMATION CONTACT: Rachel O'Meara, U.S. Department of
                Commerce, telephone: (202) 482-4124, email: [email protected]. For
                media inquiries: Jessica Stallone, Office of Congressional and Public
                Affairs, Bureau of Industry and Security, U.S. Department of Commerce:
                [email protected].
                [[Page 58264]]
                SUPPLEMENTARY INFORMATION:
                I. Introduction
                 This final rule is a procedural action to redesignate U.S.
                Department of Commerce (Department) regulations that govern the
                procedures for the review of certain transactions involving ICTS
                designed, developed, manufactured, or supplied by persons owned by,
                controlled by, or subject to the jurisdiction or direction of a foreign
                adversary and which pose or may pose undue or unacceptable risks to the
                United States or U.S. persons. Responsibility for implementing these
                regulations lies within the BIS's OICTS. This action moves regulations
                from subtitle A in the Code of Federal Regulations (CFR), which is
                generally reserved for Secretarial actions and Department-wide
                activities and operations, to chapter VII in title 15 of the CFR, where
                BIS regulations are located. Specifically, this action removes the
                regulations in title 15, subtitle A, part 7 (under the ``Office of the
                Secretary of Commerce''), reserving that part, and redesignates them as
                title 15, subtitle B, chapter VII, part 791 (under the ``Bureau of
                Industry and Security, Department of Commerce'').
                 The provisions being redesignated were originally administered by
                the Office of the Secretary, but were formally transferred to BIS when
                OICTS was established on March 15, 2022 (consistent with the
                Consolidated Appropriations Act for Fiscal Year 2022). Therefore, the
                Department is transferring the regulations to subtitle B, ``Regulations
                Relating to Commerce and Foreign Trade,'' chapter VII, ``Bureau of
                Industry and Security, Department of Commerce.'' title 15, subtitle B,
                chapter VII regulations are specific to BIS authorities and processes.
                This is a procedural change that does not impact any processes of the
                Department or BIS, and will have no impact on any public or private
                entity outside of BIS.
                II. Background
                 The existing 15 CFR part 7 regulations, which are being
                redesignated, implement Executive Orders (E.O.s), E.O. 13873,
                ``Securing the Information and Communications Technology and Services
                Supply Chain'' (84 FR 22689, May 17, 2019) and E.O. 14034, ``Protecting
                Americans' Sensitive Data From Foreign Adversaries'' (86 FR 31423, June
                11, 2021).
                 E.O. 13873 declares a national emergency under the National
                Emergencies Act (50 U.S.C. Ch. 34, section 1601 et seq.) and invokes
                the International Emergency Economic Powers Act (IEEPA) (50 U.S.C. 1701
                et seq.) to take certain actions regarding the unrestricted acquisition
                and use in the United States of certain information and communication
                technology and services (ICTS) and classes of ICTS designed, developed,
                manufactured, or supplied by persons owned by, controlled by, or
                subject to the jurisdiction or direction of foreign adversaries. E.O.
                13873 authorizes the Secretary, pursuant to IEEPA, to prohibit certain
                ICTS transactions or approve them subject to the establishment of
                measures to mitigate identified risks. To implement E.O. 13873, on
                January 19, 2021, the Department published an interim final rule (86 FR
                4909) creating 15 CFR part 7, which sets forth definitions and
                procedures for the Department to review and determine whether ICTS
                transactions involving entities with a foreign adversary nexus and U.S.
                entities present an undue risk of sabotage to or subversion of the ICTS
                supply chain, or an unacceptable risk to U.S. persons or national
                security.
                 E.O. 14034 (86 FR 31423), elaborates on measures to address the
                national emergency declared in E.O. 13873 with respect to the ICTS
                supply chain and authorizes the Secretary to evaluate connected
                software application transactions that may pose an unacceptable risk to
                the national security of the United States or the security and safety
                of U.S. persons. To implement E.O. 14034, the Department published a
                Final Rule (88 FR 39353) that amended 15 CFR 7.1, 7.2, and 7.3.
                 In June 2023, consistent with the Consolidated Appropriations Act
                for Fiscal Year 2022, responsibility for implementing the authorities
                in E.O.s 13873 and 14034, as described above, was transferred by the
                Secretary to the Deputy Under Secretary of Commerce for Industry and
                Security, and OICTS was established, with responsibilities managed by
                an Executive Director who reports to the Under Secretary of Commerce
                for Industry and Security.
                III. Establishment of Subchapter E in Chapter VII and Realignment
                 Consistent with this transfer, this final rule redesignates the
                regulations that were promulgated as 15 CFR part 7 of Subtitle A--
                ``Office of the Secretary of Commerce''--to Subtitle B--``Regulations
                Relating to Commerce and Foreign Trade.'' Within subtitle B, chapter
                VII includes other regulations that implement BIS authorities. This
                final rule also establishes Subchapter E, following Subchapter D, and
                creates a new part 791 for OICTS's regulations. Subchapter E is titled
                ``Information and Communications Technology and Services Regulations.''
                 The redesignation in this final rule clarifies to the public that
                BIS, not the Office of the Secretary, is responsible for implementation
                of the ICTS regulations. This shift in no way impacts the content or
                text of current and proposed regulations. Because of this, publication
                of this final rule is merely procedural and therefore advance notice
                and opportunity for comment and delay in effective date are unnecessary
                under the Administrative Procedures Act (4 U.S.C. 553), because OICTS
                is making a technical change in merely updating the designation of
                existing regulations.
                IV. Redesignation
                 This final rule redesignates all sections of 15 CFR part 7 as 15
                CFR part 791, which will be in the newly created subchapter E of
                chapter VII. All sections in 15 CFR part 7 will be designated under 15
                CFR part 791. Future rulemakings by BIS OICTS will be finalized in
                title 15, subtitle B, chapter VII.
                 Redesignations
                ------------------------------------------------------------------------
                 Old section in 15 CFR, subtitle A, part 7 New section in 15 CFR,
                ------------------------------------------- subtitle B, chapter VII,
                 newly established subchapter
                 E, part 791
                 Part 7 -----------------------------
                 Part 791
                ------------------------------------------------------------------------
                Subpart A--General Subpart A--General
                ------------------------------------------------------------------------
                7.1....................................... 791.1
                7.2....................................... 791.2
                7.3....................................... 791.3
                7.4....................................... 791.4
                7.5....................................... 791.5
                7.6....................................... 791.6
                7.7....................................... 791.7
                ------------------------------------------------------------------------
                Subpart B--Review of Subpart B--Review of
                ICTS Transaction ICTS Transaction
                ------------------------------------------------------------------------
                7.100..................................... 791.100
                7.101..................................... 791.101
                7.102..................................... 791.102
                7.103..................................... 791.103
                7.104..................................... 791.104
                7.105..................................... 791.105
                7.106..................................... 791.106
                7.107..................................... 791.107
                7.108..................................... 791.108
                7.109..................................... 791.109
                7.110..................................... 791.110
                ------------------------------------------------------------------------
                Subpart C--Enforcement Subpart C--Enforcement
                ------------------------------------------------------------------------
                7.200..................................... 791.200
                ------------------------------------------------------------------------
                Rulemaking Requirements
                 1. This action has not been determined to be significant under
                Executive Order 12866, as it is a technical redesignation that does not
                materially affect the substance of the underlying rule.
                 2. Notwithstanding any other provision of law, no person is
                required to respond to, nor shall any person be
                [[Page 58265]]
                subject to a penalty for failure to comply with, a collection of
                information subject to the requirements of the Paperwork Reduction Act
                of 1995 (44 U.S.C. 3501 et seq.) (PRA), unless that collection of
                information displays a currently valid Office of Management and Budget
                (OMB) Control Number. This action does not impact any information
                collection or recordkeeping requirements under the PRA.
                 3. This rule does not contain policies with federalism implications
                as that term is defined in Executive Order 13132.
                 4. BIS finds good cause under 5 U.S.C. 553(b)(B) to waive prior
                notice and an opportunity for public comment on this action because
                this action merely re-designates existing regulatory text in the Code
                of Federal Regulations and therefore notice and comment are
                unnecessary. Furthermore, because this action makes no substantive
                changes, it does not constitute a substantive rule, and it is not
                subject to the requirement for a 30-day delay in effective date under 5
                U.S.C. 553(d).
                 5. Because a notice of proposed rulemaking and an opportunity for
                public comment are not required to be given for this rule by 5 U.S.C.
                553, or by any other law, the analytical requirements of the Regulatory
                Flexibility Act, 5 U.S.C. 601, et seq., are not applicable.
                Accordingly, no regulatory flexibility analysis is required, and none
                has been prepared.
                List of Subjects in 15 CFR Parts 7 and 791
                 Administrative practice and procedure, Business and industry,
                Communications, Computer technology, Critical infrastructure, Executive
                orders, Foreign persons, Investigations, National security, Penalties,
                Technology, Telecommunications.
                Subtitle A--Office of the Secretary of Commerce
                PART 7--SECURING THE INFORMATION AND COMMUNICATIONS TECHNOLOGY AND
                SERVICES SUPPLY CHAIN
                0
                1. The authority citation for part 7 continues to read as follows:
                 Authority: 50 U.S.C. 1701 et seq.; 50 U.S.C. 1601 et seq.; E.O.
                13873, 84 FR 22689; E.O. 14034, 86 FR 31423.
                PART 7--[REDESIGNATED AS PART 791]
                0
                2. Redesignate part 7 as part 791, according to the following table:
                ------------------------------------------------------------------------
                 Part 7 Part 791
                ------------------------------------------------------------------------
                Subpart A Subpart A
                ------------------------------------------------------------------------
                Sec. Sec. 7.1 through 7.7.............. Sec. Sec. 791.1 through
                 791.7.
                ------------------------------------------------------------------------
                Subpart B Subpart B
                ------------------------------------------------------------------------
                Sec. Sec. 7.100 through 7.110.......... Sec. Sec. 791.100 through
                 791.110
                ------------------------------------------------------------------------
                Subpart C Subpart C
                ------------------------------------------------------------------------
                Sec. 7.200.............................. Sec. 791.200.
                ------------------------------------------------------------------------
                Sec. 791.102 Confidentiality of information.
                0
                3. In newly redesignated Sec. 791.102 amend paragraph (c) by removing
                ``Sec. 7.109 of this part'' and adding ``Sec. 791.109'' in its place.
                Sec. 791.103 Initial review of ICTS Transactions.
                0
                4. In newly redesignated Sec. 791.103:
                0
                a. Amend paragraph (a) by removing ``Sec. 7.100(a)'' and adding
                ``Sec. 791.100(a)'' in its place;
                0
                b. Amend paragraph (b) introductory text by removing ``Sec. 7.3(a) of
                this part'' and adding ``Sec. 791.3(a)'' in its place; and
                0
                c. Amend paragraph (b)(2) by removing ``Sec. 7.100(a)'' and adding
                ``Sec. 791.100(a)'' in its place.
                Sec. 791.104 First interagency consultation.
                0
                5. In newly redesignated Sec. 791.104, remove ``Sec. 7.103'' and add
                ``Sec. 791.103'' in its place and remove the two instances of ``Sec.
                7.103(c)'' and add ``Sec. 791.103(c)'' in their place.
                Sec. 791.105 Initial determination.
                0
                6. In newly redesignated Sec. 791.105:
                0
                a. Amend paragraph (a) introductory text by removing ``Sec. 7.104''
                and adding ``Sec. 791.104'' in its place and removing ``Sec.
                7.103(c)'' and adding ``Sec. 791.103(c)'' in its place;
                0
                b. Amend paragraph (b) introductory text by removing ``Sec. 7.104''
                and adding ``Sec. 791.104'' in its place and removing the two
                instances of ``Sec. 7.103(c)'' and adding ``Sec. 791.103(c)'' in
                their place.
                Sec. 791.107 Procedures governing response and mitigation.
                0
                7. In newly redesignated Sec. 791.107:
                0
                a. Amend the introductory text by removing ``Sec. 7.105'' and adding
                ``Sec. 791.105'' in its place;
                0
                b. Amend paragraph (d) by removing ``Sec. 7.109'' and adding ``Sec.
                791.109'' in its place; and
                0
                c. Amend paragraph (f) by removing ``section 7.108 of this rule'' and
                adding ``Sec. 791.108'' in its place.
                Sec. 791.108 Second interagency consultation.
                0
                8. In newly redesignated Sec. 791.108:
                0
                a. Amend paragraph (a) by removing ``Sec. 7.107'' and adding ``Sec.
                791.107'' in its place and removing ``Sec. 7.103(c)'' and adding
                ``Sec. 791.103(c)'' in its place;
                0
                b. Amend paragraph (b) by removing ``Sec. 7.107'' and adding ``Sec.
                791.107'' in its place and by adding ``of this section'' after ``with
                paragraph (a)''; and
                0
                c. Amend paragraph (d) by removing ``Sec. 7.109'' and adding ``Sec.
                791.109'' in its place.
                Sec. 791.109 Final determination.
                0
                9. In newly redesignated Sec. 791.109, amend paragraph (b) by removing
                ``Sec. 7.103'' and adding ``Sec. 791.103'' in its place.
                0
                10. Under the authority of section 301 of Title 5, United States Code,
                (5 U.S.C. 301) and Chapter 40 of Title 15 of the United States Code (15
                U.S.C. 1501 et seq.), add subchapter E, consisting of parts 790 through
                799, to read as follows:
                Subchapter E--Information and Communications Technology and Services
                Regulations
                PART 790 [RESERVED]
                PART 791--SECURING THE INFORMATION AND COMMUNICATIONS TECHNOLOGY
                AND SERVICES SUPPLY CHAIN.
                PARTS 792-799 [RESERVED]
                0
                11. Transfer part 791 to subchapter E.
                Elizabeth Cannon,
                Executive Director for the Office of Information and Communications
                Technology and Services.
                [FR Doc. 2024-15258 Filed 7-17-24; 8:45 am]
                BILLING CODE 3510-20-P