Executive Order Tightens Defense Supply-Chain Mapping and FOCI Compliance

President Donald Trump signed an executive order directing the Department of War to impose stricter supply-chain security requirements on defense contractors, including end-to-end mapping of software, services, technology, raw materials, and components used in national security systems. The order prioritizes domestic and allied sourcing of critical materials, sharply limits waivers under 10 U.S.C. 4872 starting Jan. 1, 2027, and requires contractors seeking exceptions to submit mitigation plans. It also calls for supplier vetting for foreign ownership, control, or influence (FOCI), supply concentration, and manufacturing risk, while requiring significant supply-chain risks to be reported to the government; fraudulent or noncompliant contractors could face contractual remedies and possible referral to the Attorney General.

The new mandate lands alongside a proposed DFARS rule that could expand FOCI-related compliance across unclassified Department of Defense contracts and subcontracts above $5 million by making National Industrial Security System (NISS) eligibility a condition for awards, modifications, and option exercises. Contractors and subcontractors may need to submit SF 328, maintain eligible NISS status, and strengthen supplier oversight to avoid delays or blocked performance, especially where sensitive data or systems are involved. Reporting indicates the government also plans to use AI to analyze contractor-submitted supply-chain data for vulnerabilities, bottlenecks, and single points of failure, raising the stakes for both compliance programs and protection of the resulting supply-chain maps as high-value cyber targets.