Security: Tennessee Procurement Protection Act (TPPA) Requirements for Technology Purchases

Overview 

Effective July 1, 2026, the Tennessee Procurement Protection Act (TPPA) restricts the purchase of certain information and communications technology (ICT) products and services from companies that meet the definition of a "Foreign Adversary Company." The law applies to all technology purchases, regardless of dollar amount, including purchases made with procurement cards (P-Cards).  

As part of the University of Tennessee's Data and Technology Risk Review process, requestors must attest that the final products or services being purchased are not from a Foreign Adversary Company.  

Why Am I Being Asked This Question? 

The Tennessee Procurement Protection Act requires state agencies and political subdivisions to avoid purchasing final information and communications technology products and services from Foreign Adversary Companies. The University must perform a compliance review before technology purchases can proceed.  

Foreign Adversary Countries 

Current federal regulations identify the following countries as foreign adversaries: 

  • China (including Hong Kong) 
  • Cuba 
  • Iran 
  • North Korea 
  • Russia 
  • Venezuela (Maduro regime) 

These countries are identified in 15 CFR ยง791.4 and are subject to change by the federal government.  

What Is a Foreign Adversary Company? 

A company may be considered a Foreign Adversary Company if it: 

  • Is domiciled, incorporated, issued, or publicly listed in a foreign adversary country. 
  • Is headquartered in a foreign adversary country. 
  • Has its principal place of business in a foreign adversary country. 
  • Is controlled by the government of a foreign adversary. 
  • Is majority-owned or board-controlled by an entity under the jurisdictional control of a foreign adversary government.  

What Technology Is Covered? 

The law applies to Information and Communications Technology (ICT), including: 

  • Hardware 
  • Computers 
  • Laptops 
  • Tablets 
  • Mobile devices 
  • Peripheral equipment 

Software and Cloud Services 

  • Software applications 
  • Operating systems 
  • Databases 
  • Software-as-a-Service (SaaS) 
  • Cloud-hosted services 

Web Technologies 

  • Websites 
  • Web applications 
  • Digital content platforms 

Communications Technologies 

  • Voice systems 
  • Video systems 
  • Messaging platforms 
  • Data communications services 

Related Technologies 

  • Electronic documents and media 
  • Embedded technology 
  • Associated firmware and hardware components 

The law generally applies to technology products and services that create, process, store, transmit, receive, or display information. 

What Is NOT Prohibited? 

The law does not prohibit purchasing from every company that has operations in a foreign adversary country. 

A company may still be eligible if it has offices, affiliates, subsidiaries, or business operations in a foreign adversary country, provided the company itself is not classified as a Foreign Adversary Company.  

The law also distinguishes between: 

  • Final products or services provided by a Foreign Adversary Company (generally prohibited) 
  • Products that merely contain inputs or components originating from a foreign adversary company (not automatically prohibited)  

How Do I Answer the Attestation Question? 

Select "Yes" if: 

You reasonably believe that the final product or service is provided by a company that is not a Foreign Adversary Company. Examples may include: 

  • U.S.-based software vendors 
  • Companies headquartered in allied countries 
  • Vendors that have global operations but are not headquartered, controlled, or majority-owned by a foreign adversary government 

Select "No" if: 

  • The vendor is headquartered in one of the listed foreign adversary countries. 
  • The vendor appears to meet the definition of a Foreign Adversary Company. 
  • You are aware that the final product or service originates from a Foreign Adversary Company. 
  • You are uncertain and need assistance determining eligibility. 

When "No" is selected, the request should not proceed without additional review by the appropriate Procurement Services and GRC personnel.  

Scenario 

Likely Response 

Purchasing Microsoft 365 

Yes 

Purchasing Zoom 

Yes 

Purchasing a SaaS platform headquartered in Germany 

Yes 

Purchasing software developed and sold by a company headquartered in China 

No 

Unsure whether the vendor is owned or controlled by a foreign adversary government 

No / Request review 

Examples are illustrative only. Procurement Services will make the final determination when required. 

Additional Requirements 

  • All software purchases should be submitted through the Data and Technology Risk Review process before purchase.  
  • The requirement applies regardless of cost, including P-Card purchases.  
  • Purchases involving foreign companies should be routed through the University's contract management process.  

Need Help? 

If you are unsure whether a vendor qualifies as a Foreign Adversary Company: 

  1. Submit the Data and Technology Risk Review request. 
  2. Provide the vendor name and product details. 
  3. The GRC team and Procurement Services will assist with the review.  
Print Article