this Act may be used to acquire telecommunications equipment produced by Huawei Technologies Company, ZTE Corporation or a high-impact or moderate-impact information system, as defined for security categorization in the National Institute of Standards and Technology’s (NIST) Federal Information Processing Standard Publication 199, Standards for Security Categorization of Federal Information and Information Systems unless the agency, office, or other entity acquiring the equipment or system has— (1) reviewed the supply chain risk for the information systems against criteria developed by NIST to inform acquisition decisions for high-impact and moderate-impact information systems within the Federal Government