Contracting America First Act

This Act may be cited as the Contracting America First Act.

The head of an agency may not enter into, renew, or extend a contract for a covered software system with an internationally owned software company.

The head of an agency shall require any contract related to a covered software system to require an offeror to such contract to certify, under penalty of perjury, that the offeror is not an internationally owned software company.

The head of an agency may waive the requirements of subsections (a) and (b) on a case-by-case basis if the head of the agency determines that the waiver is necessary in the interest of national security and submits a written justification for the waiver to the appropriate congressional committees not later than 30 days after granting the waiver.

Upon determination by the head of an agency that a contractor has violated subsection (a) or knowingly provided a false certification under subsection (b), the head of the agency may terminate the contract for default or for convenience, as appropriate, and may pursue any other remedies available under the contract or law, including debarment or suspension from future Federal contracting.

Not later than 180 days after the date of the enactment of this Act, the Federal Acquisition Regulation shall be amended to implement this Act.

In this section:

The term agency has the meaning given the term executive agency in section 133 of title 41, United States Code.

The term covered software system means a software system that stores, processes, or provides access to sensitive personal information of 500 or more employees or officers of the Federal Government.

The term internationally owned software company means a company, or any subsidiary of a company, that has a majority ownership held by individuals who are not United States citizens.

The term sensitive personal information means any of the following:

(A) Social Security number.

(B) Medical or health record.

(C) Personal identifiable information.

(D) Any other information that, if compromised, could reasonably be expected to result in identity theft, personal harm, or national security risk.