; or (D) any procurement made via Government Purchase Care for a covered article when supply chain risk has been identified as a concern. (3) Covered procurement action The term covered procurement action means any of the following actions, if such action takes place in the course of conducting a covered procurement: (A) The exclusion of a source that fails to meet qualification requirements established pursuant to section 3311 of title 41, United States Code, for the purpose of reducing supply chain risk in the acquisition or use of a covered article. (B) The exclusion of a source that fails to achieve an acceptable rating with regard to an evaluation factor providing for the consideration of supply chain risk in the evaluation of proposals for the award of a contract or the issuance of a task or delivery order. (C) The determination that a source is not a responsible source based on considerations of supply chain risk. (D) The decision to withhold consent for a contractor to subcontract with a particular source or to direct a contractor to exclude a particular source from consideration for a subcontract. (4) Information system The term information system has the meaning given such term in section 3502 of title 44, United States Code. (5) Information technology The term information technology has the meaning given such term in section 11101 of title 40, United States Code. (6) Responsible source The term responsible source has the meaning given such term in section 113 of title 41, United States Code. (7) Supply chain risk The term supply chain risk means the risk that a malicious actor may sabotage, maliciously introduce an unwanted function, extract or modify data, or otherwise manipulate the design, integrity, manufacturing, production, distribution, installation, operation, or maintenance of a covered article so as to surveil, deny, disrupt, or otherwise manipulate the function, use, or operation of the information technology or information stored or transmitted on the covered articles. (8)