(1) IN GENERAL- Subject to paragraphs (2) and (3), not later than six months after the commencement or designation of a contingency operation outside the United States that includes or is expected to include combat operations, the head of each covered agency shall perform a comprehensive risk assessment and develop a risk mitigation plan for operational and political risks associated with contractor performance of critical functions in support of the operation for such covered agency.

(2) EXCEPTIONS- Except as provided in paragraph (3), a risk assessment and risk mitigation plan shall not be required under paragraph (1) for an overseas contingency operation if--

(3) TERMINATION OF EXCEPTIONS- Notwithstanding paragraph (2), the head of a covered agency shall perform a risk assessment and develop a risk mitigation plan under paragraph (1) for an overseas contingency operation with regard to which a risk assessment and risk mitigation plan has not previously been performed under paragraph (1) not later than 60 days after the date on which--

(1) The goals and objectives of the operation (such as risks from contractor behavior or performance that may injure innocent members of the local population or offend their sensibilities).

(2) The continuity of the operation (such as risks from contractors refusing to perform or being unable to perform when there may be no timely replacements available).

(3) The safety of military and civilian personnel of the United States if the presence or performance of contractor personnel creates unsafe conditions or invites attack.

(4) The safety of contractor personnel employed by the covered agency.

(5) The managerial control of the Government over the operation (such as risks from over-reliance on contractors to monitor other contractors or inadequate means for Government personnel to monitor contractor performance).

(6) The critical organic or core capabilities of the Government, including critical knowledge or institutional memory of key operations areas and subject-matter expertise.

(7) The ability of the Government to control costs, avoid organizational or personal conflicts of interest, and minimize waste, fraud, and abuse.

(1) For each high-risk area identified in the comprehensive risk assessment for the operation performed under subsection (b)--

(2) A continuing process for identifying and addressing new and changed risks arising in the course of the operation, including the periodic reassessment of risks and the development of appropriate risk mitigation or reduction plans for any new or changed high-risk area identified.

(1) Private security functions, as that term is defined in section 864(a)(6) of the National Defense Authorization Act for Fiscal Year 2008 (10 U.S.C. 2302 note).

(2) Training and advising Government personnel, including military and security personnel, of a host nation.

(3) Conducting intelligence or information operations.

(4) Any other functions that are closely associated with inherently governmental functions, including the functions set forth in section 7.503(d) of the Federal Acquisition Regulation.

(5) Any other functions that are deemed critical to the success of the operation.