Overview and Procedural Context
The Federal Communications Commission (FCC) released a draft Third Report and Order and Third Further Notice of Proposed Rulemaking in ET Docket No. 21-232, titled 'Protecting Against National Security Threats to the Communications Supply Chain through the Equipment Authorization Program.' Circulated under permit-but-disclose ex parte procedures for tentative consideration at an Open Meeting, the draft addresses unresolved supply-chain and component-level vulnerabilities under the Secure and Trusted Communications Networks Act of 2019, the Secure Equipment Act of 2021, and the Communications Act of 1934.
The item builds on the Commission's First and Second Report and Orders, as well as recent Covered List updates incorporating uncrewed aircraft systems (UAS), UAS critical components, and foreign-produced routers.
- Docket: ET Docket No. 21-232.
- Document Number: FCC-CIRC2607-05 (DOC-422746A1).
- Statutory Authorities: Communications Act of 1934 (as amended, 47 U.S.C. 154(i), 301, 302a, 303, 403, 503), Secure and Trusted Communications Networks Act of 2019 (47 U.S.C. 1601-1609), and Secure Equipment Act of 2021 (47 U.S.C. 1601 note).
Third Report and Order: Logic-Bearing Hardware Components
The draft Third Report and Order closes the 'component part loophole' by prohibiting the equipment authorization of logic-bearing hardware components produced by entities named on the Covered List. It also bars authorization for any host device incorporating such a component if the device would have been prohibited had the Covered List entity manufactured the entire product.
The rule adds a formal definition of 'Logic-bearing hardware component' to 47 CFR § 2.902, drawing from the technical baseline in 47 CFR § 15.3(k) for digital devices operating in excess of 9,000 pulses per second (9 kHz), while encompassing intentional radiators.
This prohibition applies prospectively to new equipment authorizations upon adoption, with no transition period, while leaving previously authorized devices unaffected unless modified.
- Adds 47 CFR § 2.902 defining logic-bearing hardware components generating/using timing signals exceeding 9,000 pulses per second with digital techniques or data processing functions.
- Amends 47 CFR § 2.903(b) to prohibit devices containing Covered List logic-bearing hardware components.
- Applies component bans strictly to producer/provider-based Covered List determinations, not broad production location-based entries unless specifically named.
Marketing Rules and Point-of-Sale FCC ID Display
The Commission clarifies that 'marketing' under 47 CFR § 2.803(a) includes activities by online marketplaces that list, distribute, or offer regulated equipment, even when sold by third parties, when paired with consignment, warehousing, order processing, packaging, billing, or fulfillment services.
The order confirms that common carriers merely transporting equipment without trading in it remain exempt under Section 302(c) of the Communications Act, but platforms performing fulfillment services fall within regulatory reach.
Online marketplaces will be required under 47 CFR § 2.803(c) to display the valid FCC ID of certified equipment in product marketing materials at the online point of sale.
- Defines 'Online marketplace' by adopting the definition in 15 U.S.C. § 45f(f)(4) under Commission Communications Act authority.
- Requires display and verification of FCC IDs at the online point of sale to allow pre-purchase verification in the Equipment Authorization System (EAS) database.
- Subjects online marketplaces that market unauthorized equipment to FCC enforcement.
Equipment Modifications and Critical Infrastructure Definition
The draft amends 47 CFR §§ 2.932 and 2.1043 to prohibit any modification or permissive change that would cause previously authorized equipment to become covered equipment. Furthermore, Covered List entities seeking any modification must submit a full application for certification and are barred from utilizing the Supplier's Declaration of Conformity (SDoC) pathway.
In response to the D.C. Circuit remand in Hikvision USA, Inc. v. FCC, the draft adopts a narrowed definition of 'critical infrastructure' in 47 CFR § 1.50001(f) matching Section 1016(e) of the USA PATRIOT Act (42 U.S.C. § 5195c(e)). The definition eliminates the broad 'connected to' language and focuses on systems and assets vital to the 16 critical infrastructure sectors providing any of the 55 National Critical Functions (NCFs).
- Revises 47 CFR §§ 2.932(f) and 2.1043(a) requiring full recertification for any change made by a Covered List entity.
- Clarifies that 'produced by' continues to be evaluated under the totality of circumstances regarding substantial control over design, development, manufacture, or assembly.
- Corrects internal cross-reference errors in 47 CFR § 2.903 and administrative errors in 47 CFR § 2.1204(a).
Third Further Notice of Proposed Rulemaking Proposals
The accompanying Third FNPRM seeks comment on several regulatory proposals to strengthen supply-chain visibility and post-market enforcement.
Key proposals include bifurcating the Covered List into separate producer/provider-based and production location-based categories, introducing mandatory Hardware Bills of Materials (HBOM) and Software Bills of Materials (SBOM), and mandating unique registration numbers for SDoC-authorized devices.
The Commission also seeks comment on establishing a U.S.-based liable party requirement for foreign-grantee certified equipment under 47 CFR § 2.909, setting term limits on equipment authorizations, streamlining revocation under 47 CFR § 2.939, and codifying permissive change waivers for routine security updates to existing covered equipment.
- Proposes HBOM and SBOM reporting under 47 CFR § 2.911 for all or sector-specific equipment authorization applications.
- Proposes mandatory certification for unintentional radiators and all devices within Covered List sectors (UAS, UAS critical components, and routers) under 47 CFR §§ 2.907(c) and 15.101(f).
- Proposes restricting import pathways for unauthorized covered equipment under 47 CFR § 2.1204 to narrow exceptions (testing up to 40 units, import for export, and federal use).
- Proposes prohibiting use of the FCC logo on incidental radiators and unauthorized devices under 47 CFR § 2.1074.