This bill, known as the ICTS Supply Chain Security Act of 2026, aims to amend the Export Control Reform Act of 2018 to significantly enhance the security of information and communications technology and services (ICTS) supply chains. Its primary purpose is to protect the United States from national security threats posed by foreign adversaries in the digital realm. To achieve this, the legislation mandates the establishment of a new Assistant Secretary of Commerce for Information and Communications Technology Supply Chains and an Office of Information and Communications Technology and Services within the Bureau of Industry and Security. This new office will be responsible for administering the bill's provisions and will report annually to Congress on its actions. A key provision of the bill is the prohibition of certain ICTS transactions, including the acquisition, importation, or use of hardware, software, or services, if they originate from specified countries of concern such as China, Cuba, Iran, North Korea, and Russia. These transactions are banned if the Secretary of Commerce, in consultation with other federal agencies, determines they pose an undue risk of sabotage, catastrophic effects on U.S. critical infrastructure or the digital economy, or an unacceptable risk to national security. The bill includes exceptions for the free flow of information, such as the importation or exportation of expressive materials like publications and digital content, and transactions specifically intended to provide public access to open-source software . The Secretary is granted broad authority to prescribe regulations, identify particular risky transactions, impose mitigation measures, and establish criteria for compliance. Violations of these prohibitions carry substantial criminal and civil penalties , including fines up to $1,000,000 and 20 years imprisonment for willful criminal acts, and civil fines up to $1,500,000 or five times the transaction value. Judicial review for challenges to actions under this part is exclusively vested in the U.S. Court of Appeals for the District of Columbia Circuit, with provisions for handling sensitive information. The legislation clarifies that its provisions do not supersede existing authorities under other federal laws, such as the Defense Production Act of 1950, and ensures the continuation of regulations issued under related Executive Orders. Importantly, the core prohibitions and authorities established by this part are set to terminate five years after the bill's enactment, indicating a focused, time-limited approach to addressing these supply chain security concerns.