(a) This part applies only to an ICTS Transaction that:

(1) Is conducted by any person subject to the jurisdiction of the United States or involves property subject to the jurisdiction of the United States;

(2) Involves any property in which any foreign country or a national thereof has an interest (including through an interest in a contract for the provision of the technology or service);

(3) Is initiated, pending, or completed on or after January 19, 2021, regardless of when any contract applicable to the transaction is entered into, dated, or signed or when any license, permit, or authorization applicable to such transaction was granted. Any act or service with respect to an ICTS Transaction, such as execution of any provision of a managed services contract, installation of software updates, or the conducting of repairs, that occurs on or after January 19, 2021 may be deemed an ICTS Transaction within the scope of this part, even if the contract was initially entered into, or the activity commenced, prior to January 19, 2021; and

(4) Involves one of the following ICTS:

(i) ICTS that will be used by a party to a transaction in a sector designated as critical infrastructure by Presidential Policy Directive 21—Critical Infrastructure Security and Resilience, including any subsectors or subsequently designated sectors;

(ii) Software, hardware, or any other product or service integral to:

(A) Wireless local area networks, including:

(1) Distributed antenna systems; and

(2) Small-cell or micro-cell base stations;

(B) Mobile networks, including:

(1) eNodeB based stations;

(2) gNodeB or 5G new radio base stations;

(3) NodeB base stations;

(4) Home location register databases;

(5) Home subscriber servers;

(6) Mobile switching centers;

(7) Session border controllers; and

(8) Operation support systems;

(C) Satellite payloads, including:

(1) Satellite telecommunications systems;

(2) Satellite remote sensing systems; and

(3) Satellite position, navigation, and timing systems;

(D) Satellite operations and control, including:

(1) Telemetry, tracking, and control systems;

(2) Satellite control centers;

(3) Satellite network operations;

(4) Multi-terminal ground stations; and

(5) Satellite uplink centers;

(E) Cable access points, including:

(1) Core routers;

(2) Core networks; and

(3) Core switches;

(F) Wireline access points, including:

(1) Access infrastructure datalinks; and

(2) Access infrastructure digital loops;

(G) Core networking systems, including:

(1) Core infrastructure synchronous optical networks and synchronous digital hierarchy systems;

(2) Core infrastructure dense wavelength division multiplexing or optical transport network systems;

(3) Core infrastructure internet protocol and internet routing systems;

(4) Core infrastructure content delivery network systems;

(5) Core infrastructure internet protocol and multiprotocol label switching systems;

(6) Data center multiprotocol label switching routers; and

(7) Metropolitan multiprotocol label switching routers; or

(H) Long- and short-haul networks, including:

(1) Fiber optical cables; and

(2) Repeaters;

(iii) Software, hardware, or any other product or service integral to data hosting or computing services, to include software-defined services such as virtual private servers, that uses, processes, or retains, or is expected to use, process, or retain, sensitive personal data on greater than one million U.S. persons at any point over the twelve (12) months preceding an ICTS Transaction, including:

(A) Internet hosting services;

(B) Cloud-based or distributed computing and data storage;

(C) Managed services; and

(D) Content delivery services;

(iv) Any of the following ICTS products, if greater than one million units have been sold to U.S. persons at any point over the twelve (12) months prior to an ICTS Transaction:

(A) Internet-enabled sensors, webcams, and any other end-point surveillance or monitoring device;

(B) Routers, modems, and any other home networking device; or

(C) Drones or any other unmanned aerial system;

(v) Software designed primarily to enable connecting with and communicating via the internet, which is accessible through cable, telephone line, wireless, or satellite or other means, that is in use by greater than one million U.S. persons at any point over the twelve (12) months preceding an ICTS Transaction, including:

(A) Desktop applications;

(B) Mobile applications;

(C) Gaming applications;

(D) Web-based applications; and

(E) Connected software applications; or

(vi) ICTS integral to:

(A) Artificial intelligence and machine learning;

(B) Quantum key distribution;

(C) Quantum computing;

(D) Drones;

(E) Autonomous systems; or

(F) Advanced Robotics.

(b) This part does not apply to an ICTS Transaction that:

(1) Involves the acquisition of ICTS items by a United States person as a party to a transaction authorized under a U.S. government-industrial security program; or

(2) The Committee on Foreign Investment in the United States (CFIUS) is actively reviewing, or has reviewed, as a covered transaction or covered real estate transaction or as part of such a transaction under section 721 of the Defense Production Act of 1950, as amended, and its implementing regulations.

(c) Notwithstanding the exemption in paragraph (b)(2) of this section, ICTS Transactions conducted by parties to transactions reviewed by CFIUS that were not part of the covered transaction or covered real estate transaction reviewed by CFIUS remain fully subject to this part.

[86 FR 4923, Jan. 19, 2021, as amended at 88 FR 39358, June 16, 2023]