WASHINGTON, D.C. — President Donald Trump signed an executive order requiring the Department of War to develop new rules for mapping and securing critical defense supply chains. The directive includes software, services, and technology used in national security systems within the scope of these supply chains.

The order states that the United States must protect its defense supply chains against physical, cyber, and economic subversion. To achieve this, the Secretary of War must develop policies requiring defense contractors to map critical supply chains supporting national security acquisitions within 180 days of the order.

These supply chain mapping requirements apply to prime contractors and potentially to subcontractors at every level of the defense supply chain. Implementing regulations for the supply chain mapping policies are due within 90 days after the policies are completed.

Contractors are required to submit a complete indentured Bill of Materials tracing components, equipment, software, and materials through the supply chain to the origin of the underlying raw materials. The order defines a critical supply chain as all tiers of suppliers and subcontractors providing goods, materials, systems, software, or services essential to contract delivery, mission assurance, security, or resilience.

In addition to mapping, contractors are required to establish written procedures for proactively vetting suppliers and subcontractors. Supplier vetting reviews must consider financial stability, foreign ownership or influence, and manufacturing and supply risks. Contractors must identify concerns such as sole-source dependencies, inadequate production capacity, supplier concentration, and overreliance on a single source.

The order defines foreign ownership, control, or influence partly in terms of whether a foreign interest could obtain unauthorized access to information or adversely affect the performance of a national security contract. The government is directed to prohibit contractors from using covered materials supplied by an unreliable foreign supplier, subject to certain exceptions.

Contractors must mitigate identified supply chain risks and track corrective actions until closure. Supply chain risks must be reported to the Department of War within 15 days after vetting activities are completed. Contractors have 45 days to submit a confidential corrective action plan detailing mitigations and a timeline for completing the work after identifying risks.

A closeout report is required after corrective actions have been implemented. Starting January 1, 2027, the Secretary of War and service secretaries will generally stop issuing waivers under 10 U.S.C. § 4872 that allow the acquisition of covered materials from prohibited sources. Waivers for prohibited sources may still be granted if the prime contractor or subcontractor submits a formal mitigation plan identifying the non-compliant source, documenting efforts to find a compliant alternative, and setting a timeline for removal.

Contractors found to have committed fraud or knowingly failed to carry out an approved mitigation plan could face contractual penalties and referral to the Attorney General. Contractors whose supply chains depend on an unreliable foreign supplier are required to qualify and move to an alternative source as soon as practicable. Failure to move to an alternative source from an unreliable foreign supplier could result in suspension or termination of task orders, declining to exercise contract options, or termination of the contract.

The order allows some bill-of-materials information to be disclosed to government support contractors when necessary, provided proprietary information is protected against unauthorized access or use. The order directs the Department of War to use available tools and technologies, including artificial intelligence, to analyze contractor acquisition information and identify national security vulnerabilities, bottlenecks, and single points of failure.