Executive Order 18

= aif Dow,

Pectin taias, oy

IN THE NAME AND BY THE AUTHORITY OF THE STATE OF IOWA

EXECUTIVE ORDER NUMBER EIGHTEEN

WHEREAS, the U.S. Department of Commerce in 15 C.F.R. §791.4 has defined “foreign adversaries” to include the People’s Republic of China (“China”) because it has “engaged in a long-term pattern or serious instances of conduct significantly adverse to the national security of the United States or the security and safety of United States persons”; and

WHEREAS, in 2022 the Office of the Director of National Intelligence stated that China “represents the broadest, most active, and persistent cyber espionage threat to U.S. Government and private sector networks”; and

WHEREAS the technology products and services most vulnerable to malicious foreign exploitation are sold by companies that the Chinese government influences through whole or partial ownership, direct funding, or having members in high-ranking company positions; and

WHEREAS U.S. officials have confirmed that at least some of these technology products and services contain serious vulnerabilities, including malicious code, with the capability to store critical network credentials and other sensitive information, and preinstalled hidden hardware and software that could be used for disruptive and destructive cyber activity against critical infrastructure in the event of armed conflict; and

WHEREAS the Chinese government uses backdoor access to technology products, including communications devices, DNA sequencing devices, drones, internet connectivity devices, laser detection and ranging devices, along with software applications to surveil and track their own citizens; and

WHEREAS procurement for critical technologies and supplies is single sourced from China and could become unavailable in the event of armed Pacific conflict; and

WHEREAS Iowa Code Chapter 12K, the Restrictions on China-Related Investments Act, requires certain public funds, including Iowa Public Employee Retirement System (IPERS”), to identify prohibited companies (owned or controlled by Chinese military or government services which has been designated by the United States as restricted or prohibited for certain transactions), not to acquire certain holdings from such prohibited companies and to divest therefrom; and

WHEREAS Iowa Code Chapter 8 and 8A provide that the Department of Administrative Services (“DAS”) and the Department of Management (“DOM”), respectively, are responsible for procurement policies, procedures, and practices to be used by state agencies in acquiring commodities, including information technology, and contractual services; for prescribing the methods to award contacts, including, but not limited to, through securing competitive sealed bids, prescribing specific commodities and quantities to be purchased locally.

NOW, THEREFORE, I, KIMBERLY K. REYNOLDS, Governor of the State of lowa, by virtue of the power and authority vested in me by the Constitution and statutes of the State of Towa do hereby ORDER and DIRECT the following:

SECTION ONE. It is the policy of my administration that the State:

e Support the civilian and military command of the United States of America and its efforts to promote and maintain prosperity, peace and security for America and her allies; and

e Enhance the defensive posture of the State to protect Iowa citizens and assets and to contribute to the broader defensive posture of the United States of America by reducing security vulnerabilities within the State; and

e Protect Chinese dissidents within Iowa, and other Iowans, particularly those who are targeted by China’s communist regime.

SECTION TWO. I direct the Director of the Department of Homeland Security and Emergency Management (“DHSEM”) to administer an annual state risk assessment (“Risk Assessment”). This assessment shall include all substantial risks to state or national security, including, but not limited to, vulnerability to cybersecurity attacks, state or national economic security, and state or national public health, including, but not limited to, the power grid and water infrastructure security, or any combination thereof, occurring within and threatening the State. I further direct DHSEM to identify the parameters for all critical procurements purchased or supplied to the State through a state supply chain or state vendor supply chain.

SECTION THREE. I direct DHSEM to administer a study identifying and assessing areas of state vulnerability (“Vulnerability Study”) related to the security, economic stability, and public health and safety of this State which would come under threat in the event of a potential armed conflict. This shall include an assessment of vulnerabilities in state critical infrastructure, telecommunications infrastructure, supply chains, cybersecurity, public safety and security, and public health, and any other areas of concern identified by the Director of DHSEM.

SECTION FOUR. On or before July 1, 2026, and on or before each July 1st annually thereafter, that two reports—(1) the Risk Assessment administered by DHSEM, and (2) the Vulnerability Study conducted by DHSEM—to be submitted to the Governor, the Speaker of the House of Representatives, and the President of the Senate. These reports shall be deemed confidential under law pursuant to Iowa Code §22.7(50) and shall not be released to the public.

SECTION FIVE. I direct DAS and DOM, in cooperation with DHSEM, to prepare any inventory of all critical procurements purchased or supplied to the State through a state supply chain or state vendor supply chain.

SECTION SIX. I direct DAS to promulgate rules requiring that no equipment, supplies or services be purchased from a Prohibited Company as defined in Iowa Code §12K.1(4) (Prohibited Company”) and requiring all vendors seeking to do business with the state to disclose any relationship with a Prohibited Company, including the nature and extent of such relationship, if any.

SECTION SEVEN. I direct DOM, pursuant to lowa Code §8.85, to develop policies that would prevent the procurement of information technology through any means, including, but not limited to, a cooperative procurement agreement, negotiated contract, or competitive bidding, from a Prohibited Company and to promulgate rules to prevent procurement from any Prohibited Company.

SECTION EIGHT. I direct DAS and DOM to take any additional agency action necessary, consistent with the Constitution and laws of the United States and the State of Iowa, to ensure commodities, including, but not limited to, information technology, and services used by the State are not susceptible to exploitation by any Prohibited Company and such action shall include, but not be limited to:

A. Preventing the State from procuring or utilizing any information or communications technologies or services, components, networks, or systems that DAS or DOM has determined, after review of relevant materials, including, but not limited to, documentation prepared by any governmental agency cybersecurity firm, or expert, that pose an undue or unacceptable risk to the safety and security of Iowa, including the connections with or use by any Prohibited Company; and

B. Preventing the State from procuring or utilizing any information or communications technologies or services, components, networks, or systems in similar use cases where any federal agency has prohibited, restricted the transactions or licensing of, or otherwise limited such information or communications technologies or services, components, networks or systems because of national security concems; and

C. Preventing the State from procuring or utilizing any information or communications technologies or services, components, networks, or systems that are designed, developed, manufactured, or supplied by companies or affiliates determined by any federal or state governmental agency to be owned or controlled by a Prohibited Company, to the extent feasible; and

D. Preventing the exposure of governmental information and communications technologies and services, equipment, components, networks, and systems in Iowa to any person or entity that is determined by any federal or state government agency to be owned, controlled or affiliated with a Prohibited Company, to the extent feasible.

E. Considering, if and to what extent, exceptions should exist to ensure the State does not incur losses in quality, design, workmanship, performance, or capabilities that are more detrimental to the interests of the State than the dangers outlined in

this Order.

SECTION NINE. Each state agency whose agency head is appointed by and serves at the pleasure of the Governor, must, to the extent possible during rule promulgation and policy

development as outlined herein, ensure its current practices conform with the requirements of Sections 6 through 9.

SECTION TEN. All other state and local governmental entities are strongly encouraged, to the extent possible during rule promulgation and policy development as outlined herein, to conform their current practices with the requirements in Sections 6 through 9.

SECTION ELEVEN. I direct the Executive Director of the Board of Regents to compile a report within 180 days after execution of this Executive Order which summarizes all gifts, contracts, agreements, arrangements, or other exchanges entered into within the five years prior to this order by any regent university with any Chinese educational institution or other Chinese entity with an explanation of the conditions of such gifts, contracts, agreements, arrangements, or other exchanges, along with a list identifying any current relationship between any student or faculty groups, clubs, associations, or other entities and any such Chinese institution or entity.

SECTION TWELVE. All Executive departments, officers, agencies, and employees of the State shall cooperate with the implementation of this Order, including providing any information, data, records, and reports as may be requested by the Department of Management pursuant to lowa Code Chapter 8E.

SECTION THIRTEEN. If any provision of this Executive Order, or the application of any provision to any person or circumstance, is held to be invalid, the remainder of the Order and the applicability of its other provisions to any other persons or circumstances shall not be affected thereby.

SECTION FOURTEEN. This Executive Order shall be distributed to the Directors of each cabinet department, the Treasurer of the State, the Board of Regents and the head of IPERS.

ATTEST:

PABL D. PATE SECRETARY OF STATE

IN TESTIMONY WHEREOF, I HAVE HEREUNTO SUBSCRIBED MY NAME AND CAUSED THE GREAT SEAL OF THE STATE OF IOWA TO BE AFFIXED AT DES MOINES, IOWA THIS TENTH DAY OF FEBRUARY IN THE YEAR OF OUR LORD TWO THOUSAND TWENTY-SIX

~( KIMBERL' REYN GOVERNOR