; (3) by amending subsection (b) to read as follows: (b) Authority (1) Identification The combatant commander shall identify covered persons or entities engaged in covered activities through the program established under subsection (a). Upon identification of a covered person or entity, combatant commanders, or their designated deputies, shall notify and provide rationale for such an identification to the Under Secretary of Defense for Acquisition and Sustainment, the Under Secretary of Defense for Intelligence and Security, and the Under Secretary of Defense for Policy. (2) Covered procurement actions (A) In general The head of a contracting activity may exercise a covered procurement action on a covered persons or entity. (B) Limitation on covered procurement actions The head of a contracting activity may exercise a covered procurement action only after receiving a notification and recommendation from the Under Secretary of Defense for Acquisition and Sustainment, based on a risk assessment by the identifying combatant commander, that states that— (i) the person or entity identified by the combatant commander meets the criteria for a covered person or entity and was or is actively engaged in one or more covered activities; and (ii) less intrusive measures are not reasonably available to manage the risk.