Blog · Supply-chain risk

Eligible to Buy Is Not Safe to Field: What Each Supply-Chain Rule Leaves Unanswered

Chris A. Grable · October 7, 2026

A program office holding a Section 889 representation, a Trade Agreements Act certificate and a current CMMC status for a foreign-sourced component has three documents and no evidence on one specific risk: that the component carries a dormant function someone else can trigger. UDC's paper on war reserve modes calls this the gap between eligibility and trust. Here is what each common instrument proves, and what it leaves open.

Named-source bans prove the supplier is not on a list

Section 889 bars buying covered telecommunications and video-surveillance equipment and services from Huawei and ZTE, and from Hikvision, Dahua and Hytera for security-related purposes. It also bars contracting with any entity that uses such equipment as a substantial or essential component, or as critical technology, of any system. The representation rests on a reasonable inquiry across the firm's operations, not only its federal work, and the rule reaches micro-purchases. What it does not establish: the security of anything outside its covered scope, including a part altered at an offshore integration step.

Two newer named-entity rules work the same way. Since 30 June 2026, Section 805 of the FY2024 NDAA has barred DOW from contracting with companies on the Section 1260H list and entities they control. Section 1532 of the FY2026 NDAA requires removal of covered AI, which includes DeepSeek and High Flyer-related AI, from Department systems and bars contractors from using it in contract performance, subject to case-by-case waivers. Both work by name, and neither reaches a product outside its named scope.

FASCSA orders prove no one has named the threat yet

Under the Federal Acquisition Supply Chain Security Act, DHS, DOW or the Director of National Intelligence can issue exclusion and removal orders that flow to every subcontract tier, with reports due within 72 hours under the overhauled clause at FAR 52.240-91 (the older FAR 52.204-30 uses three business days for its initial report). The order clauses have been in effect since December 2023, and the first order issued in September 2025. The mechanism acts only after a threat is identified and named. A dormant capability in a product no order covers is untouched.

CMMC and DFARS 252.204-7012 assess specified safeguards within a defined scope

DFARS 252.204-7012 requires NIST SP 800-171 safeguarding on covered contractor information systems that process, store or transmit covered defense information. CMMC adds assessment in levels: Level 1 covers the basic safeguarding of federal contract information under FAR 52.204-21, and Level 2 covers the NIST SP 800-171 Revision 2 requirements for controlled unclassified information. Since November 10, 2025, a solicitation can require a current CMMC status at a specified level. On 13 July 2026 the Department suspended the Phase 2 transition, leaving Level 1 and Level 2 self-assessments available. Under either posture the assessment asks whether specified safeguards are in place within a defined scope. It does not ask what a component inside that system will do when triggered.

Origin rules prove where something was made or transformed

The Trade Agreements Act limits purchases above the threshold, $174,000 for WTO GPA goods and services in 2026–2027, to U.S.-made or designated-country end products, with origin set by substantial transformation. Components from a nondesignated country can be transformed in a designated one, and the finished product then counts as a designated-country end product. That is the same offshore integration step where hardware insertion can happen. The Buy American Act is a price preference, and its content test is waived for most COTS items. The Berry Amendment and the specialty-metals rule govern where commodities were grown or metals melted. None asks whether an electronic or software function can be trusted.

Sorting what the paperwork cannot

Because none of these instruments answers the trust question, the paper sorts products into three tiers:

Adversary-controlled hosted services, such as a foreign AI app or API or foreign SaaS: data leaves your control by design. Ruled out for CUI, proprietary or capture-sensitive work.
Adversary-origin hardware or open-weight models run in isolation: a dormant capability cannot be ruled out. Evaluate and contain; never trust.
Domestic or allied products with known provenance and contractual data handling: residual conventional risk. Verify provenance to the component level and monitor the update channel.

For anything below the first tier, UDC recommends four practices: trace provenance to the component and its origin, not the subassembly; treat every patch as a new article to inspect; test for dormancy by hunting for a trigger instead of waiting for a fault; and use segmentation, egress control and full isolation of the highest-risk tier to cut off external activation and exfiltration paths. Write data residency into the contract, and keep the eligibility review and the fielding review on separate tracks.

Public sources

The paper behind this post cites these public documents, among others.

The paper lays out the documented cases behind the threat, from port cranes to trained-in model backdoors, adds a regulatory quick-reference appendix, and ends with six questions to put to a vendor before a foreign-sourced product is fielded.

War Reserve Modes in the Supply Chain

See what is in the paper