House NDAA moves FASC from OMB to White House, mandates NSA and DoD seats
Three failed attempts in four years to fix the Federal Acquisition Security Council; folding it into the NDAA is Congress signaling it won't wait for OMB to sort itself out.
TL;DR
The Chairman's mark for the fiscal 2027 National Defense Authorization Act, set for a June 4 House Armed Services Committee markup, incorporates the Federal Acquisition Security Council Improvement Act. The bill relocates the FASC from the Office of Management and Budget to the Executive Office of the President, creates a dedicated FASC Program Office, mandates two DoD seats including one filled by the National Security Agency, and adds designated seats for CISA, ONCD, ODNI, FBI, GSA, and NIST. A streamlined process lets Congress itself designate sources of concern and requires the FASC to open investigations into those designations. A nearly identical bill passed the House in 2024 and cleared the Senate Homeland Security Committee but died on the Senate floor in the 118th Congress.
The Federal Acquisition Security Council was established by the 2018 Federal Acquisition Supply Chain Security Act as an interagency body housed at the Office of Management and Budget, tasked with coordinating supply chain risk assessments and issuing exclusion and removal orders against covered sources. OMB issued its implementing rule in 2021 and an interim final rule in 2023. What the council has not done at any volume is move quickly. That gap is what the FASC Improvement Act addresses, and Congress embedding it in the NDAA rather than passing it as standalone legislation is itself a data point: this is the third serious push in four years.
What the bill actually changes
The structural shift is the most significant piece. Moving the FASC from OMB to the Executive Office of the President creates a new FASC Program Office within EOP that provides administrative, legal, and policy support alongside subject-matter expertise on information and communications technology, acquisition security, and supply chain risk. The council chairperson would be a member designated by the President rather than an OMB official by default. For contractors, the practical effect is a council that sits closer to White House authority and farther from the procurement-policy bureaucracy that has historically set its pace.
The membership mandates are also meaningful. The bill requires two DoD officials as council members, one of them from the National Security Agency. Combined with the designated CISA seat within DHS's two slots, and seats for ONCD, ODNI, FBI, GSA, and NIST, the council's composition shifts toward defense and intelligence representation. A body with mandatory NSA and CISA participation will evaluate supply chain risk differently than one where those agencies participate at the margin.
The congressional designation process is the sharpest new instrument. Under the bill, Congress can itself designate a source of concern, which triggers a mandatory FASC investigation with due-process protections but with the inquiry now obligatory rather than discretionary. The bill also contemplates second-order prohibitions, case-by-case agency waivers, and grandfathering provisions, though the scope and triggers for each remain unspecified in the available summary.
What contractors should watch
For defense primes and their supply chains, the FASC has historically mattered less in day-to-day contracting than DFARS 252.204-7012 or the Section 889 prohibition on Huawei and ZTE equipment, largely because FASC-issued removal and exclusion orders have been limited in number. A reconstituted FASC with mandatory defense-intel seats, congressional designation authority, and EOP-level backing has the structural capacity to issue findings faster and at greater scope. Whether it will is a question of execution, not just structure.
The DoD-specific provisions add a compliance hook: the Secretary of Defense must notify congressional defense committees of which officials are designated to the council, certify their regular participation, and ensure the department responds to FASC information requests on a timely basis. That notification and certification requirement creates a paper trail that oversight committees can use and that contractors may eventually see reflected in procurement regulations downstream.
The timeline for the OMB-to-EOP transition is not specified in the summary, and neither are the precise triggers for second-order prohibitions or the waiver standard. Those details will matter significantly for contractors holding contracts with suppliers who could plausibly appear on a congressionally designated list. The June 4 markup is the next milestone.
Published ·Updated ·Deep Fathom