APPENDIX C Final Regulatory Flexibility Analysis 1. As required by the Regulatory Flexibility Act of 1980, as amended (RFA), 5 U.S.C. §§ 601 et seq., as amended by the Small Business Regulatory Enforcement and Fairness Act (SBREFA), Pub. L. No. 104-121, 110 Stat. 847 (1996). the Federal Communications Commission (Commission) incorporated an Initial Regulatory Flexibility Analysis (IRFA) in the Second Equipment Authorization Security Report and Order, Order and Further Notice of Proposed Rulemaking (Second Report and Order and Second Further Notice). Protecting Against National Security Threats to the Communications Supply Chain through the Equipment Authorization Program, ET Docket No. 21-232, Second Report and Order and Second Further Notice of Proposed Rulemaking, 40 FCC Rcd 8430 (2025) (Second Report and Order and Second Further Notice). The Commission sought written public comment on the proposals in the Second Report and Order and Second Further Notice, including comment on the IRFA. No comments were filed specifically addressing the IRFA, however, we address ex parte comments received after the close of the comment period and the public release of the draft of the Third Report and Order in section B below. This Final Regulatory Flexibility Analysis (FRFA) conforms to the RFA and it (or summaries thereof) will be published in the Federal Register. 5 U.S.C. § 604. A. Need for, and Objectives of, the Rules 2. In the Second Report and Order and Second Further Notice, the Commission expanded upon previously adopted rules to further proscribe the authorization of communications equipment determined to “pose an unacceptable risk to the national security of the United States or the security and safety of United States persons” under our equipment authorization program (EA program). See Second Report and Order and Second Further Notice. Such equipment, also known as “covered equipment,” is identified on the Commission’s Covered List. Pursuant to sections 2(a) and (d) of the Secure and Trusted Communications Networks Act of 2019 and sections 1.50002 and 1.50003 of the Commission's rules, the Federal Communications Commission's Public Safety and Homeland Security Bureau (PSHSB) publishes a list of communications equipment and services that have been determined by one of the sources specified in that statute to pose an unacceptable risk to the national security of the United States or the security and safety of United States persons (covered equipment). Secure and Trusted Communications Networks Act of 2019, Pub. L. No. 116-124, 133 Stat. 158 (2020) (codified as amended at 47 U.S.C. §§ 1601-1609) (Secure Networks Act); 47 CFR §§ 1.50002, 1.50003. In the Third Report and Order, the Commission takes additional action to strengthen the Commission’s equipment authorization (EA) program against national security risks to the communications supply chain by adopting clarifications and revisions to our part 2 rules. See supra Section III (Third Report and Order). Specifically, we close previous loopholes by prohibiting the authorization of devices that include logic-bearing hardware components that are covered equipment. We further require that any modification or permissive changes by entities identified on the Covered List undergo full certification and clarify that the marketing rules reach any entity (including online marketplaces) that markets unauthorized equipment, including through the listing of regulated equipment on an online marketplace in combination with fulfillment activities such as consignment, warehousing, inventory management, order processing, labelling, packaging, or billing. 3. Finally, we require online marketplaces to display the FCC ID of certified devices at the online point of sale under new section 2.803(c) of our rules. As adopted, this requirement is narrower than the version in the public draft of the Order. In response to ex parte comments raising practical implementation concerns (including concerns specific to small businesses and casual sellers) the final rule (i) applies only to devices subject to certification and does not require display of Supplier’s Declaration of Conformity (SDoC) compliance information; (ii) applies only to listings published, amended, or updated on or after the rule’s effective date, grandfathering existing listings; (iii) exempts listings made by third-party sellers that are not “high-volume third-party sellers” as defined in the INFORM Consumers Act; (iv) exempts listings for used radiofrequency devices; and (v) imposes a reduced, validity-only verification obligation on online marketplaces that never take title to, or have physical access to, the listed device. See supra Section III.C. Adopted 47 CFR § 2.803(c) sets forth the FCC ID display requirements, including the exemptions for pre-existing listings, listings by third-party sellers that are not “high-volume third-party sellers,” and listings for used radiofrequency devices. See infra Section F of this FRFA. The adoption of these rule clarifications and revisions will further our goals of strengthening the security of the Commission’s EA program and, by extension, our national security. B. Summary of Significant Issues Raised by Public Comments in Response to the IRFA 4. No comments were filed that specifically addressed the IRFA. However, after the close of the comment period and the public release of the draft of the Third Report and Order, several parties filed ex parte comments raising concerns regarding the economic impact of the draft marketing rules, including their impact on small entities. In particular, the PASS Coalition urged the Commission to adopt a small-seller exemption to account for “the practical realities that small businesses and casual sellers would face if they were covered by this rule,” and commenters including CTA, CCIA, eBay, and the NRF raised concerns regarding the feasibility and cost of verifying FCC IDs, the treatment of used devices and existing listings, the absence of a centralized SDoC database, and the need for adequate transition periods. See supra Section III.C (discussing ex parte comments of the National Retail Federation and joining member associations (NRF Comment), the Coalition to Protect America's Small Sellers (PASS Coalition), CTA, CCIA, and eBay). See, e.g., PASS Coalition Comment (July 15, 2026) at 4 (urging the Commission to “consider incorporating a small seller exemption that balances the Commission's objectives with the practical realities that small businesses and casual sellers would face if they were covered by this rule”). Although these filings did not respond to the IRFA as such, the Commission has considered them in this FRFA because they bear directly on the economic impact of the final rules on small entities. As described in Sections E and F below, the Commission modified the marketing rules in the final Order in direct response to these concerns, materially reducing the compliance burden on small entities relative to the public draft. C. Response to Comments by the Chief Counsel for the Small Business Administration Office of Advocacy 5. Pursuant to the Small Business Jobs Act of 2010, which amended the RFA, Small Business Jobs Act of 2010, Pub. L. No. 111-240, 124 Stat. 2504 (2010). the Commission is required to respond to any comments filed by the Chief Counsel for the Small Business Administration (SBA) Office of Advocacy, and also provide a detailed statement of any change made to the proposed rules as a result of those comments. 5 U.S.C. § 604(a)(3). The Chief Counsel did not file any comments in response to the proposed rules in this proceeding. D. Description and Estimate of the Number of Small Entities to Which the Rules Will Apply 6. The RFA directs agencies to provide a description of, and where feasible, an estimate of the number of small entities that may be affected by the adopted rules. Id. § 604. The RFA generally defines the term “small entity” as having the same meaning as the terms “small business,” “small organization,” and “small governmental jurisdiction.” Id. § 601(6). In addition, the term “small business” has the same meaning as the term “small business concern” under the Small Business Act. Id. § 601(3) (incorporating by reference the definition of “small-business concern” in the Small Business Act, 15 U.S.C. § 632). Pursuant to 5 U.S.C. § 601(3), the statutory definition of a small business applies “unless an agency, after consultation with the Office of Advocacy of the Small Business Administration and after opportunity for public comment, establishes one or more definitions of such term which are appropriate to the activities of the agency and publishes such definition(s) in the Federal Register.” A “small business concern” is one which: (1) is independently owned and operated; (2) is not dominant in its field of operation; and (3) satisfies any additional criteria established by the SBA. 15 U.S.C. § 632. The SBA establishes small business size standards that agencies are required to use when promulgating regulations relating to small businesses; agencies may establish alternative size standards for use in such programs, but must consult and obtain approval from SBA before doing so. 13 CFR 121.903. 7. Our actions, over time, may affect small entities that are not easily categorized at present. We therefore describe three broad groups of small entities that could be directly affected by our actions. 5 U.S.C. § 601(3)-(6). In general, a small business is an independent business having fewer than 500 employees. See SBA, Office of Advocacy, Frequently Asked Questions About Small Business (July 23, 2024), https://advocacy.sba.gov/wp-content/uploads/2024/12/Frequently-Asked-Questions-About-Small-Business_2024-508.pdf. These types of small businesses represent 99.9% of all businesses in the United States, which translates to 34.75 million businesses. Id. Next, “small organizations” are not-for-profit enterprises that are independently owned and operated and are not dominant in their field. 5 U.S.C. § 601(4). While we do not have data regarding the number of non-profits that meet that criteria, over 99 percent of nonprofits have fewer than 500 employees. See SBA, Office of Advocacy, Small Business Facts, Spotlight on Nonprofits (July 2019), https://advocacy.sba.gov/2019/07/25/small-business-facts-spotlight-on-nonprofits/. Finally, “small governmental jurisdictions” are defined as cities, counties, towns, townships, villages, school districts, or special districts with populations of less than fifty thousand. 5 U.S.C. § 601(5). Based on the 2022 U.S. Census of Governments data, we estimate that at least 48,724 out of 90,835 local government jurisdictions have a population of less than 50,000. See U.S. Census Bureau, 2022 Census of Governments – Organization, https://www.census.gov/data/tables/2022/econ/gus/2022-governments.html, tables 1-11. 8. The rules adopted in the Third Report and Order will apply to small entities in the industries identified in the chart below by their six-digit North American Industry Classification System (NAICS) The North American Industry Classification System (NAICS) is the standard used by Federal statistical agencies in classifying business establishments for the purpose of collecting, analyzing, and publishing statistical data related to the U.S. business economy. See www.census.gov/NAICS for further details regarding the NAICS codes identified in this chart. codes and corresponding SBA size standard. The size standards in this chart are set forth in 13 CFR 121.201, by six digit NAICS code. Where available, we also provide additional information regarding the number of potentially affected entities in the identified industries below. Regulated Industry (Footnotes specify potentially affected entities within a regulated industry where applicable) NAICS Code SBA Size Standard Total Firms U.S. Census Bureau, “Selected Sectors: Employment Size of Firms for the U.S.: 2022.” Economic Census, ECN Core Statistics Economic Census: Establishment and Firm Size Statistics for the U.S., Table EC2200SIZEEMPFIRM, 2025; “Selected Sectors: Sales, Value of Shipments, or Revenue Size of Firms for the U.S.: 2022.” Economic Census, ECN Core Statistics Economic Census: Establishment and Firm Size Statistics for the U.S., Table EC2200SIZEREVFIRM, 2025. Total Small Firms Id. % Small Firms Electronic Computer Manufacturing 334111 1,250 employees 148 128 86.49% Computer Terminal Manufacturing 334118 1,000 employees 201 194 96.52% Telephone Apparatus Manufacturing Affected Entities in this industry include Multi-Line Telephone System Manufacturers, Importers, Sellers, or Lessors. 334210 1,250 employees 155 136 87.74% Radio and Television Broadcasting and Wireless Communications Equip Manufacturing Affected Entities in this industry include Aviation Radio Equipment Manufacturers, Broadcast Auxiliary Services (BAS) Remote Pickup (RPU) Manufacturing, part 15 Handset Manufacturers, Radio Frequency Equipment Manufacturers, Uncrewed Aircraft Radio Equipment Manufacturers, Vendors of Infrastructure Development_Network Buildout. 334220 1,250 employees 155 136 87.74% Other Communications Equipment Manufacturing Affected Entities in this industry include Radio Frequency Equipment Manufacturers (Non-standard specialized equipment) and Vendors of Infrastructure Development_Network Buildout. 334290 800 employees 310 294 94.84% Audio and Video Equipment Manufacturing 334310 750 employees 506 492 97.23% Semiconductor and Related Device Manufacturing 334413 1,250 employees 675 610 90.37% Search Detection Navigation Guidance...Nautical Sys and Instrument Manufacturing 334511 1,350 employees 404 369 91.34% Aircraft Manufacturing Affected Entities in this industry include Uncrewed Aircraft Radio Equipment Manufacturers. 336411 1,500 employees 234 209 89.32% Medical Laboratories 621511 $41.5 million 4,527 3,525 77.87% Uncrewed Aircraft System (UAS) Operators None 100 employees or less See Federal Aviation Administration, Department of Transportation, Remote Identification of Unmanned Aircraft, 86 Fed. Reg. 4390, 4494 (Jan. 15, 2021) (Remote ID Rule). Data Not Disclosed Data Not Disclosed 92.20% Id. 9. In addition, the marketing rules adopted in Section III.C of the Third Report and Order will apply to online marketplaces, as that term is defined in section 2.902 of the Commission’s rules, 47 CFR § 2.902 (defining “online marketplace” by reference to 15 U.S.C. § 45f(f)(4)). and may affect third-party sellers, including retailers and resellers, that offer radiofrequency equipment for sale through such marketplaces. Comprehensive data on the number of small online marketplaces and small third-party sellers is not available. The SBA Office of Advocacy has found, however, that 99.9 percent of online sellers are small, and that most e-commerce sales are conducted by approximately 1,000 large companies. See U.S. Small Business Administration, Office of Advocacy, An Analysis of Internet Sales Taxation and the Small Seller Exemption (November 2013) (finding that 99.9 percent of online sellers are small, and most e-commerce sales are conducted by approximately 1,000 large companies). As discussed in Section F below, the Commission has exempted from the FCC ID display requirement listings made by any third-party seller that is not a “high-volume third-party seller” as defined in the INFORM Consumers Act. 15 U.S.C. § 45f(f)(6); 47 CFR § 2.803(c)(3)(b). Because the overwhelming majority of small third-party sellers fall below the high-volume threshold, this exemption substantially reduces the number of small entities to which the FCC ID display requirement will apply in practice. E. Description of Economic Impact and Projected Reporting, Recordkeeping and Other Compliance Requirements for Small Entities 10. The RFA directs agencies to describe the economic impact of proposed rules on small entities, as well as projected reporting, recordkeeping and other compliance requirements, including an estimate of the classes of small entities which will be subject to the requirement and the type of professional skills necessary for preparation of the report or record. 5 U.S.C. § 604(a)(5). 11. In the Third Report and Order, we build upon the steps taken in the Second Report and Order and Second Further Notice by amending the Commission’s part 2 rules concerning the equipment authorization program’s requirements, processes, and guidance to include additional provisions and further clarification of our current reporting and certification requirements. Specifically, the adopted rules affect small entity grantees that seek authorization of any equipment identified on the Covered List that fails to comply with our rules regarding covered equipment. Further, the adopted rules address the prohibited authorization of devices that contain logic-bearing hardware components produced by entities identified on the Covered List, the prohibition on importation and marketing, and the prohibition of devices posing unacceptable risks to national security. 12. The adopted rules also affect online marketplaces, which must display FCC IDs for certified devices at the online point of sale under section 2.803(c). The compliance obligation is tiered. An online marketplace that markets its own devices, or that offers a third-party seller’s device for sale and has physical access to or takes title to that device, must display a valid and accurate FCC ID for the device at the online point of sale. 47 CFR § 2.803(c)(1). By contrast, an online marketplace that lists a third-party seller’s device but never has physical access to, or takes title to, the device must display only a valid FCC ID, and is not liable for the inaccuracy of seller-supplied information, provided that the marketplace has taken reasonable steps to verify that the FCC ID supplied corresponds to a validly issued FCC ID in the Commission’s Equipment Authorization System (EAS) database and has required the third-party seller to certify the accuracy of the information supplied. 47 CFR § 2.803(c)(2). The rule does not apply to listings published before the effective date (unless amended, updated, or republished thereafter), to listings made by third-party sellers that are not high-volume third-party sellers, or to listings for used radiofrequency devices. 47 CFR § 2.803(c)(3). Many small entities — including virtually all casual and low-volume sellers, and sellers of used equipment — will accordingly face no new compliance obligations under section 2.803(c). 13. The recordkeeping associated with these requirements is expected to be modest. For marketplaces subject to section 2.803(c)(2), compliance entails collecting an FCC ID and an accuracy certification from the third-party seller and performing a validity check against the EAS database, which offers a working FCC ID Application Programming Interface (API). While the Commission’s statement of enforcement priorities identifies best practices (such as screening listings, cross-referencing the EAS database, and maintaining records sufficient to demonstrate diligence), those practices are enforcement guidance rather than mandatory reporting or recordkeeping requirements. See supra Section III.C (stating that the Commission is unlikely to pursue enforcement action against an online marketplace that undertakes reasonable due diligence to verify that a device being offered for sale may be validly marketed under section 2.803(a), even where an isolated or inadvertent listing error occurs, and identifying best practices drawn from the Commission's “Operation Clean Carts” initiative). The Commission expects that all filing, recordkeeping, and reporting requirements associated with the adopted rules will be the same for small and other entities, and the existing record does not reflect that the rules adopted today would disproportionately affect small entities. 14. The Commission expects that the actions taken in the Third Report and Order will efficiently advance our nation’s security objectives without incurring substantial costs to small and other entities. For example, some measures, such as the prohibition of logic-bearing hardware components and the broad scope of the prohibition on authorization of equipment identified on the Covered List, are minimal changes reflecting clarifications of measures previously taken and, as such, should present minimal compliance costs to small entities. Broad alternatives (such as banning all components produced by any foreign adversary-controlled actor) were rejected because they would impose sweeping and disproportionate burdens on small entities. With respect to the FCC ID display requirement, online marketplaces already display product information of comparable complexity (such as model numbers, UPC codes, and regulatory marks for other agencies) and implementation is expected to involve routine updates to product-page templates, terms of service, and back-end infrastructure performed in the normal course of business. The Commission acknowledged, however, that the current tools available to verify FCC IDs at scale have limits, and it responded by narrowing the rules as described in Section F, by adopting differentiated transition periods of 180 days (for section 2.803(c)(1)) and 270 days (for section 2.803(c)(2)) after Federal Register publication. See supra Section III.C (adopting an effective date of 180 days after Federal Register publication for § 2.803(c)(1) and 270 days after Federal Register publication for § 2.803(c)(2)). The Commission also directed the Office of Engineering and Technology (OET) to modernize the EAS and engage with online marketplaces on machine-readable compliance resources. In addition, while we cannot conclusively determine whether the rules adopted in the Third Report and Order will necessitate the need for small entities to hire professionals to assist them with complying with the adopted rules, we note that the comments in the existing record do not indicate such a need. 15. With the adoption of the Third Report and Order, the further revisions to the rules will help advance the Commission’s goals of protecting national security and public safety from threats to the communications supply chain and help to ensure we have the necessary information to prohibit authorization of equipment deemed to be a threat to our nation’s communications systems. F. Discussion of Steps Taken to Minimize the Significant Economic Impact on Small Entities, and Significant Alternatives Considered 16. The RFA requires an agency to provide “a description of the steps the agency has taken to minimize the significant economic impact on small entities…including a statement of the factual, policy, and legal reasons for selecting the alternative adopted in the final rule and why each one of the other significant alternatives to the rule considered by the agency which affect the impact on small entities was rejected.” 5 U.S.C. § 604(a)(6). 17. The Third Report and Order adopts revisions to the Commission’s part 2 rules regarding covered equipment identified on the Covered List in order to protect our nation’s communications systems from equipment that poses a national security risk or a threat to the safety of U.S. persons. Future prohibitions of covered equipment are mandated by the Secure Equipment Act, requiring that the Commission prohibit authorization or approval of any application for covered equipment, such as logic-bearing hardware components in devices. Secure Equipment Act of 2021, Pub. L. No. 117-55, 135 Stat. 423. Pursuant to Executive Order 12866, the Commission considered alternatives to these rules that would impose less of a societal burden. With respect to the statutorily mandated prohibitions, we did not find any reasonable alternative that would have decreased the impact on small entities but still achieve the objective of the rule. With respect to the marketing rules, however, and as described below, the Commission adopted a series of significant alternatives to the draft rules specifically in order to reduce the burden on small entities. 18. Following the public release of the draft Order, ex parte commenters (including the PASS Coalition, CTA, CCIA, eBay, and the NRF) raised concerns that the draft FCC ID display requirement would impose disproportionate burdens on small businesses, casual sellers, sellers of used equipment, and smaller marketplaces lacking the ability to verify device-level compliance information at scale. In direct response to these concerns, the Commission narrowed the marketing rules in the final Order in the following respects, each of which reduces the economic impact on small entities: 19. First, the FCC ID display requirement applies only to radiofrequency devices subject to certification. Online marketplaces are not required to list SDoC compliance information for any product listing. Because no centralized SDoC database exists against which such information could be verified, requiring its display would have imposed verification costs that would fall hardest on smaller marketplaces and sellers; limiting the rule to certified devices with FCC IDs recorded in the EAS database eliminates that burden. 20. Second, the requirement applies only to product listings that are published for the first time, or amended or updated, on or after the effective date of the rule. Listings published before the effective date are grandfathered. Unlike the incremental burden of adding FCC ID information to a listing at the time it is created or edited, requiring marketplaces to retrofit their entire existing catalogs within a fixed compliance window would have imposed a materially greater, one-time burden untethered from the marketplace’s own editorial activity. This burden would weigh most heavily on small entities with limited engineering resources. 21. Third, the Commission exempted listings made by any third-party seller that is not a “high-volume third-party seller” as defined in the INFORM Consumers Act. The Commission adopted this small-seller exemption at the urging of organizations like the PASS Coalition, finding that low-volume and occasional sellers are less likely to have the resources or sophistication to obtain and verify equipment authorization information. The Commission also found that marketplaces’ practical ability to obtain compliance commitments is most developed with respect to sellers already subject to identity verification under the INFORM Consumers Act, and that imposing the requirement on the full population of third-party sellers (including individual and occasional sellers with minimal sales volume) would impose compliance costs disproportionate to the incremental public safety and national security benefit. Because the SBA Office of Advocacy has found that 99.9 percent of online sellers are small, this exemption removes the overwhelming majority of small sellers from the scope of the rule. 22. Fourth, the Commission exempted listings for used radiofrequency devices, defined as any device previously sold to a retail customer and marketed as “used” or otherwise not “new.” Requiring marketplaces to separately verify and display FCC ID information for every resale listing would have imposed recurring compliance costs on secondary-market transactions (a market segment in which small and casual sellers are heavily represented) without a corresponding increase in the reliability of the information provided to consumers. 23. Fifth, the Commission adopted a tiered verification standard. Online marketplaces that never take title to, or have physical access to, a listed device need only display a valid FCC ID; they are not responsible for confirming that the FCC ID corresponds to the specific device offered for sale, so long as they take reasonable steps to verify validity against the EAS database and require the third-party seller to certify the accuracy of the information supplied. This alternative responds to record evidence that device-level accuracy verification is not feasible at scale for non-custodial marketplaces, and it spares smaller marketplaces the cost of building verification systems for devices they never physically handle. 24. Sixth, although the Commission declined to adopt a formal safe harbor or a willfulness element, finding no such element in section 302(b) of the Act or the marketing rules, it issued a statement of enforcement priorities that mitigates compliance risk for good-faith actors. The Commission clarified that it is unlikely to pursue enforcement against a marketplace that undertakes reasonable due diligence, even where an isolated or inadvertent listing error occurs. The Commission further clarified that what constitutes reasonable due diligence will depend on the facts and circumstances, including the marketplace’s size, resources, and role in the transaction. The Commission further stated that enforcement resources will be prioritized toward knowing, willful, intentional, or negligent noncompliance; toward listings in which the marketplace sells its own devices or has custody of the device; and toward the marketing of covered or otherwise unauthorized equipment. The express consideration of a marketplace’s size and resources in the due-diligence inquiry directly reduces the enforcement exposure of small entities acting in good faith. 25. Seventh, the Commission adopted differentiated transition periods: March 1, 2027 for online marketplaces subject to section 2.803(c)(1) and June 1, 2027 for online marketplaces subject to section 2.803(c)(2), which must first identify high-volume sellers, establish seller-certification processes, and integrate database cross-referencing into their listing workflows. The Commission found that a single transition period would either impose an unreasonably short timeline on marketplaces with more complex compliance obligations or an unnecessarily long timeline on marketplaces already well-positioned to comply. 26. Eighth, the Commission directed OET to work with the Enforcement Bureau and the Office of the Chief Information Officer to modernize and update the EAS as expeditiously as possible, and to engage with online marketplaces on improvements to the equipment authorization database, available APIs, and machine-readable data resources (including resolution of anti-scraping and rate-limiting barriers) that support automated compliance monitoring. Improved tooling lowers the ongoing per-listing cost of compliance, a benefit that accrues disproportionately to smaller entities that cannot spread fixed compliance costs across large catalogs. 27. The Commission considered and rejected several alternatives. It declined to require that FCC IDs be displayed on external product packaging based on comments citing the burden and cost of doing so, though it kept the record open on this point. It declined to extend the FCC ID display requirement to the full population of third-party sellers, for the reasons stated above. Conversely, the Commission considered and rejected proposals to limit marketing liability to bad actors who willfully or intentionally violate the marketing rules (or to exempt online marketplaces from marketing liability altogether), finding no willfulness or intent element in section 302(b) of the Act. Further, the Commission concluded that a blanket exemption would allow marketplaces to receive the benefits and profits of marketing unauthorized equipment while passing the costs on to consumers. The Commission instead addressed the underlying burden concerns through the narrower, targeted measures described above. See supra Section III.C (directing OET to work with the Enforcement Bureau and the Office of the Chief Information Officer to modernize and update the EAS and to engage with online marketplaces regarding technical improvements to the EAS, available APIs, and machine-readable data resources that support compliance monitoring). 28. Through its review of the record in this proceeding and in its ultimate adoption of the rules set forth in the Third Report and Order, the Commission has sought, where practicable, to minimize significant economic impact to small entities and, in doing so, has considered significant alternatives to those adopted today. The adopted rules have been narrowly tailored to account for commenter concerns that an overly broad approach would create significant financial and technological burdens for small and other entities that may lack the financial or human resources to effectively comply with the new rules. In addition, we also considered preserving the status quo by not adopting any new measures to address the persistent vulnerabilities identified in the record. While this alternative would, on the surface, provide the least amount of immediate regulatory cost impact, it would carry substantial hidden costs in the form of heightened exposure to national security threats. In making our determinations in this proceeding, we believe that the costs we are imposing are reasonable in light of our national security goals. G. Report to Congress 29. The Commission will send a copy of the Third Report and Order, including this Final Regulatory Flexibility Analysis, in a report to Congress pursuant to the Congressional Review Act. 5 U.S.C. § 801(a)(1)(A). In addition, the Commission will send a copy of the Third Report and Order, including this Final Regulatory Flexibility Analysis, to the Chief Counsel for the SBA Office of Advocacy and will publish a copy of the Third Report and Order and this Final Regulatory Flexibility Analysis (or summaries thereof) in the Federal Register. Id. § 604(b).