Companies that sell masks, respirators, gloves, gowns and other protective gear to the Department of Homeland Security will need to source nearly all of it from domestic manufacturers starting next month, and the contracts that require it will lock vendors in for years rather than one-off buys. DHS published a final rule on Sept. 18 amending the Homeland Security Acquisition Regulation (HSAR) at 48 CFR Parts 3025 and 3052, closing out HSAR Case 2024-003 (RIN 1601-AB15, Docket DHS-2024-0020). The rule takes effect Oct. 19, 2026.

The regulation codifies how DHS complies with the Make PPE in America Act (MPAA), a provision Congress folded into the 2021 Infrastructure Investment and Jobs Act (Pub. L. 117-58, div. G, title IX, subtitle C, secs. 70951-70953). The law requires DHS, the Department of Veterans Affairs and the Department of Health and Human Services to buy domestically grown, reprocessed, reused or produced personal protective equipment — a category that spans surgical masks, respirators, face shields, gloves, gowns, and head and foot coverings. "DHS is issuing a final rule to amend the Homeland Security Acquisition Regulation (HSAR) codifying how DHS complies with the requirements of the Make Personal Protective Equipment (PPE) in America Act," the agency's Office of the Chief Procurement Officer wrote in the rule's preamble.

Why Covered Contracts Now Run at Least Two Years

The most concrete operational change for vendors is contract duration. Under the final rule, any DHS contract covered by the MPAA — meaning it involves domestically sourced PPE — must run for a minimum of two years, counting all option periods. The two-year floor is not incidental language; Congress wrote it into the statute specifically to give domestic PPE manufacturers enough order volume and schedule certainty to justify building or expanding U.S. production lines, rather than bidding on a single-year buy that could evaporate the following cycle.

That changes the calculus for contracting officers as much as for suppliers. A short-term surge buy of gloves or gowns that might once have gone out as a one-year award now has to be structured, priced and resourced as a multi-year commitment if it falls under the MPAA's PPE categories. For small and mid-size domestic manufacturers weighing whether to add a shift or a production line, that longer runway is the point.

The Nitrile Glove Workaround DHS Disclosed

The final rule also surfaces how DHS is actually managing the mandate on the ground, and the nitrile glove supply chain is the clearest example. DHS disclosed that as of January 2026 it moved all of its nitrile glove purchasing to domestic manufacturers — even though those manufacturers still depend on foreign-sourced nitrile butadiene rubber (NBR), the raw material gloves are made from, because no domestic NBR production exists.

"Prior to January 2026, DHS sourced nitrile gloves from both domestic and foreign manufacturers. However, as domestic manufacturing capacity expanded, DHS transitioned to sourcing all nitrile glove requirements from domestic manufacturers," DHS wrote in its discussion of public comments on the final rule. The agency is bridging the NBR gap using the MPAA's built-in nonavailability waivers, which let DHS buy foreign-sourced components or materials when a fully domestic supply chain doesn't exist. Those waivers aren't a one-time pass: wherever DHS relies on the domestic-alternative or nonavailability exceptions, the secretary has to recertify the need every 120 days, forcing the agency to keep checking whether domestic NBR production has come online.

Why DHS Rejected Industry's FAR Cross-Reference Request

DHS received 23 public comments on the October 2024 proposed version of the rule, and one recurring industry request didn't make it into the final text. Commenters asked DHS to write a specific cross-reference to FAR 25.104(a) — the Federal Acquisition Regulation's list of articles the government has already determined aren't available domestically — directly into the HSAR's nonavailability definitions, which would have given contractors a fixed, citable list to check against.

DHS declined. The agency's reasoning was that hard-coding a reference to the FAR's nonavailable-articles list would create a maintenance problem: if the FAR list changes — items get added or removed — a rigid cross-reference in the HSAR could go stale or conflict with the FAR itself, creating exactly the kind of inconsistency the comment was trying to avoid. Instead, DHS kept its nonavailability standard written more generally, leaving contracting officers to make that determination case by case rather than pointing straight at the FAR list.

What It Means for Contractors

For PPE suppliers already selling to DHS, the rule mostly formalizes practices the agency was already moving toward — but it removes the ambiguity. Contractors bidding on covered PPE work should expect solicitations to specify domestic-sourcing requirements up front, contract terms structured for a minimum two-year base-plus-options window, and — where a nonavailability or domestic-alternative exception applies — a recurring 120-day recertification cycle built into contract administration rather than a one-time waiver.

Manufacturers positioned entirely in the U.S. supply chain, including finished-glove producers who still import NBR, are the rule's clearest beneficiaries: they get multi-year DHS demand without having to solve the raw-material sourcing problem themselves, as long as the nonavailability waiver keeps getting renewed. Foreign PPE manufacturers and any domestic reseller of foreign-made PPE, by contrast, are effectively locked out of covered DHS contracts unless they can show a nonavailability or domestic-alternative exception applies. Companies working other MPAA-covered agencies — VA and HHS — should also watch for parallel rulemaking, since the underlying statute applies to all three departments even though this rule only amends DHS's acquisition regulation.

Sources