The Department of Health and Human Services (HHS) is amending and updating its HHS Acquisition Regulation (HHSAR) to implement requirements for information, information technology, information security, privacy, security, and supply chain risk management. It removes outdated and redundant policy, aligns the HHSAR with the Federal Acquisition Regulation (FAR), and adds new requirements in HHS acquisitions to identify, assess, and mitigate risks to HHS mission-critical products, materials, information, and services within the supply chain.