Supply chain risk strategies for aerospace & defense

The map from entry one will surface a list of parts with exactly one qualified source. Some are unavoidable. A specialty forging or a radiation-hardened device may have one maker on earth. Many are not: they are single-sourced because qualification was expensive once and nobody revisited the decision after the program moved from development to sustainment.

Dual sourcing is a capital decision, so rank the list before you fund it. The supply chain resilience strategies that hold up weigh three things per part: the consequence of a stop (line idle, delivery slip, safety), the time to qualify a second source, and whether the two sources are genuinely independent. Two distributors drawing from one fab are one source with two invoices. Where a second source is not realistic, the fallback is a strategic buffer sized to the re-qualification lead time, and that buffer has to be documented as a deliberate risk acceptance rather than an accident of inventory.

Obsolescence is where counterfeit risk is born. A platform designed in 2004 and flying in 2040 will outlive most of the semiconductor lines it was built on. DFARS 252.246-7007 defines an obsolete electronic part as one "no longer available from the original manufacturer or an authorized aftermarket manufacturer," and item (c)(12) of the same clause makes "control of obsolete electronic parts" a required element of the detection and avoidance system, aimed at maximizing the availability of authentic, qualified parts.

Obsolescence management therefore belongs inside the supplier program rather than in a separate engineering silo. The practical loop is short. Monitor end-of-life and last-time-buy notices for every active device, decide per part between a lifetime buy, a qualified alternate, or a redesign, and record the decision with its date. The risk register entry for a part that went obsolete without a plan should read exactly like a finding, because the next purchase of that part will come from a broker and 252.246-7008 then puts the authenticity burden on you.

CMMC moved from program to contract clause on November 10, 2025, the effective date of the DFARS rule Assessing Contractor Implementation of Cybersecurity Requirements (90 FR 43560). Under 32 CFR 170.3(e) the rollout runs in four phases, Phase 1 beginning on that date and each later phase "one calendar year following the start date" of the one before it, with the DFARS prescription reaching all applicable solicitations and contracts on or after November 10, 2028. Level 1 maps to the fifteen safeguarding requirements of FAR 52.204-21, Level 2 to NIST SP 800-171 Rev. 2, and Level 3 to selected requirements from NIST SP 800-172.

The flowdown is explicit, and it is the part most supplier programs are not ready for. Section 170.23 applies the requirements to "prime contractors and subcontractors throughout the supply chain at all tiers that will process, store, or transmit any FCI or CUI." A subcontractor that handles only FCI needs Level 1 (Self). One that handles CUI needs at least Level 2 (Self), and Level 2 (C3PAO) when the prime's contract requires Level 2 (C3PAO) or Level 3 (DIBCAC). Clause 252.204-7021 then requires the prime, before award, to ensure the subcontractor has a current CMMC status at the level appropriate to the information flowed down, and requires an annual affirmation of continuous compliance in SPRS.

Cmmc compliance verification is therefore a data problem across the supply base: for every subcontract, the information type, the required level and assessment type, the subcontractor's CMMC unique identifier, and the date of its last affirmation. A spreadsheet can hold that for twenty suppliers. It cannot hold it for two thousand with option periods.

The International Traffic in Arms Regulations sit in 22 CFR Parts 120 through 130 and implement section 38 of the Arms Export Control Act. Two definitions drive supplier risk. Technical data under 22 CFR 120.33 includes information "required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of defense articles," down to blueprints, drawings and photographs. And export under 120.50 includes "releasing or otherwise transferring technical data to a foreign person in the United States," the deemed export, with foreign person defined in 120.63 to cover any entity "not incorporated or organized to do business in the United States" and any natural person who is not a lawful permanent resident or protected individual.

So itar compliance in the supply chain starts before any shipment. A drawing attached to a request for quote is a release of technical data. A machine shop with a foreign national on the floor who can see the print is a deemed export question. Registration follows the same logic: 22 CFR 122.1 requires anyone in the United States "engaged in the business of manufacturing or exporting" defense articles to register with the Directorate of Defense Trade Controls, and "a manufacturer who does not engage in exporting must nevertheless register."

• Classify each purchased item and the data that accompanies it (USML category or EAR) before the RFQ goes out.
• Collect and date each supplier's DDTC registration and its technology control plan where foreign persons are employed.
• Screen the supplier and its owners against denied and restricted party lists at onboarding and continuously, not annually.

Under 32 CFR 117.11 a U.S. entity is under FOCI when "a foreign interest has the power to direct or decide issues affecting the entity's management or operations" in a way that could result in unauthorized access to classified information or adversely affect performance of a classified contract. Factors are weighed in the aggregate, and they include the "source, nature, and extent of FOCI" across "the immediate, intermediate, and ultimate parent entities" and whether a foreign government owns or controls the entity directly or indirectly.

Cleared entities report through the SF 328 and update it "when significant changes occur." Mitigation runs from a board resolution for minority holdings without board rights, to a security control agreement when a foreign interest has board representation but not control, to a special security agreement when the foreign interest effectively owns or controls the entity. The clearance side is DCSA's job. The supplier side is yours, because a Tier 2 that changes hands to a foreign parent does not stop shipping while the paperwork catches up.

Run beneficial ownership on cleared, sole-source and data-handling suppliers at onboarding, and watch for the changed conditions the rule itself lists: "a change in ownership, indebtedness, or a foreign intelligence threat." A debt facility from a foreign bank can be as relevant as a share sale.

The deepest tiers of a defense program are full of small companies with one or two products, a handful of customers and no public financials. They are also the ones most likely to be sole sources. A quiet exit, a distressed sale or a bankruptcy at that level rarely announces itself through the prime's procurement channel. It shows up as a late delivery, then as a changed remittance address, then as a new owner you never screened.

Monitor the signal rather than the annual request for statements. Payment behavior, legal filings, credit changes and employee count moves all precede a stop. Certa's platform pulls live financial health data from Rapid Ratings alongside security ratings from BitSight and Black Kite, so a critical provider's viability score sits in the same supplier profile as its CMMC status and ownership record, and a drop triggers a reassessment rather than waiting for next year's review. Whatever feed you use, pair it with the dual sourcing list from entry two: the small suppliers that are also sole sources are the ones a finance alert should route straight to a program manager.

DFARS 225.7018 restricts acquisition of covered materials, defined as samarium-cobalt magnets, neodymium-iron-boron magnets, tantalum metals and alloys, tungsten metal powder, and tungsten heavy alloy or any finished or semi-finished component containing it. Through December 31, 2026, the rule bars covered material "melted or produced" in a covered country (North Korea, China, Russia and Iran under 225.7001) and any end item manufactured there that contains one. Effective January 1, 2027, the restriction reaches back to covered material "mined, refined, separated, melted, or produced" in a covered country. Exceptions exist for acquisitions at or below the simplified acquisition threshold, items acquired and used outside the United States, certain COTS items and electronic devices, and nonavailability determinations, and the clause that carries the restriction is 252.225-7052.

The 2027 date turns a procurement rule into a mapping requirement. For a magnet, melted or produced is one tier of evidence, and mined and separated is two or three more. Specialty metals under 225.7003 add the long-standing requirement that specialty metals in aircraft, missile, ship, weapon system and ammunition components be melted or produced in the United States, with its own exceptions. Confirm the scope of each with counsel for the programs you run, because the exceptions matter as much as the rule.

Concentration is the same problem without a statute. Three suppliers that all buy their rare earth oxide from one separator in one province are one supplier for resilience purposes. Certa's guide to vendor concentration risks covers the mapping method. The A&D version adds country of origin for each covered material as a mandatory field on the supply chain map, so the 225.7018 answer and the concentration answer come from the same record.