Final Determination: Case No. ICTS-2021-002, Kaspersky Lab, Inc.

Document Headings Document headings vary by document type but may contain the following: the agency or agencies that issued and signed a document the number of the CFR title and the number of each part the document amends, proposes to amend, or is directly related to the agency docket number / agency internal file number the RIN which identifies each regulatory action listed in the Unified Agenda of Federal Regulatory and Deregulatory Actions See the Document Drafting Handbook for more details. Department of Commerce Bureau of Industry and Security ( printed page 52434) Pursuant to the authorities granted in Executive Order (“E.O.”) 13873, “Securing the Information and Communications Technology and Services Supply Chain,” the Department of Commerce (the “Department”) has reviewed transactions involving cybersecurity and anti-virus software supplied by Kaspersky Lab, Inc. (together with all affiliates, subsidiaries, and parent companies, “Kaspersky”) to determine (1) whether those transactions are covered ICTS transactions under 15 CFR 7.103(b) ; and if so, (2) whether those transactions pose an undue or unacceptable risk to U.S. national security or the safety and security of U.S. persons, as set out in E.O. 13873 and 15 CFR part 7 . The Department finds that Kaspersky's provision of cybersecurity and anti-virus software to U.S. persons, including through third-party entities that integrate Kaspersky cybersecurity or anti-virus software into commercial hardware or software, poses undue and unacceptable risks to U.S. national security and to the security and safety of U.S. persons. Consistent with 15 CFR 7.109(a) , the Secretary now issues this Final Determination, which sets forth the Department's decision, based on the risks presented in the Initial Determination and the subsequent responses and mitigation proposals from Kaspersky, as further detailed below. Background Consistent with 15 CFR 7.1(b) , the Secretary eva…