Supply Chain Security Training Act of 2021

Mr. Speaker, I move to suspend the rules and pass the bill (S. 2201) to manage supply chain risk through counterintelligence training, and for other purposes.

Mr. Speaker, I ask unanimous consent that all Members may have 5 legislative days in which to revise and extend their remarks and include extraneous material on this measure.

Mr. Speaker, I yield myself such time as I may consume.

Mr. Speaker, I rise in support of S. 2201, the Supply Chain Security Training Act, led by Chairman Gary Peters of the Committee on Homeland Security and Governmental Affairs and Senator Ron Johnson of Wisconsin.

I thank Representatives Joe Neguse and Scott Franklin, who did excellent bipartisan work here to lead the House companion, H.R. 5962, which was reported by the Oversight and Reform Committee on February 4 without opposition.

This important bill to defend our Nation's information and communications technology supply chains cannot be enacted soon enough.

In December 2020, a Government Accountability Office report revealed that Federal agencies had failed to fully implement supply chain and risk management standards for information and communications technology.

That same month, the discovery of the SolarWinds breach made urgently clear how dangerous supply chain vulnerabilities can be. The networks of at least nine Federal agencies were compromised by Russian actors, allowing

them access to Federal systems for months before they were even discovered.

To help address these concerns, the Supply Chain Security Training Act establishes a training program for agency employees with responsibilities related to supply chain risk management, better preparing them to identify and mitigate supply chain threats associated with the acquisition of products and services.

The training requirements created by this bill will ensure that the acquisition workforce has the capability to identify items in the supply chain that could be used to exploit Federal information systems.

As the largest purchaser of goods and services in the world, the Federal Government relies on a complex supply chain that spans continents and is continuously targeted by foreign adversaries and cybercriminals scheming to breach Federal information systems.

To protect our national security interests and guard against these attacks, we must equip our Federal acquisition officials with the expertise and skills they need to reinforce our cybersecurity defenses through purchasing decisions.

I encourage my colleagues to support this bill, and I reserve the balance of my time.

Mr. Speaker, I have no further speakers on this side. I reserve the balance of my time.

Mr. Speaker, I thank my friend from South Carolina for her leadership and support on this important piece of legislation, which will help guard Federal assets.

I urge passage of the bill, and I yield back the balance of my time.

Mr. Speaker, I yield myself such time as I may consume.

Mr. Speaker, recent cyberattacks on the U.S. Government continue to reveal weaknesses in our Federal information technology systems. One such weakness resides in the software products Federal agencies purchase from the private sector.

IT and software products, like most goods and services, now rely on global supply chains for their development, and this means increased vulnerabilities to threats from malicious and criminal actors, as well as our foreign enemies, as my colleague, Mr. Connolly, just recognized.

Congress must ensure Federal agencies proactively address supply chain security risks. The Supply Chain Security Training Act will ensure the Federal workforce properly understands these supply chain risks and the appropriate policies to implement to address the risks.

Specifically, the bill tasks the General Services Administration with developing, and the Office of Management and Budget, OMB, with implementing a governmentwide supply chain security training program. This training will prepare the Federal workforce to better identify and mitigate the security risks throughout the acquisition lifecycle of information and communications technology products and services. For instance, Federal agency personnel would be better able to recognize and avoid purchasing software products with malware vulnerabilities.

This is smart legislation that builds on existing congressional reforms. For instance, the bill requires coordination with the existing Federal Acquisition Security Council, an interagency effort established by Congress in 2018 to develop policies and procedures addressing supply chain risks.

Despite these existing efforts, there are currently no Federal workforce training requirements in place to ensure supply chain security policies are properly and consistently implemented. The national security stakes are too high to leave such a strategic gap in our Federal defenses.

S. 2201 represents a practical policy reform to a very real threat. I appreciate my colleagues Representatives Neguse and Franklin's leadership on championing the House companion bill, H.R. 5962.

I look forward to seeing the Supply Chain Security Training Act pass the House and advance to the President's desk.

Mr. Speaker, I reserve the balance of my time.

Mr. Speaker, I also want to again recognize my colleagues, Representatives Neguse and Franklin, who crafted the House companion legislation, H.R. 5962.

I encourage my colleagues to support this bill, and I yield back the balance of my time.