Most Department of Defense (DoD) suppliers don’t spend much time mapping their Tier 2 and Tier 3 vendors. That’s understandable when your Tier 1 relationships are qualified, and the rest of the supply base has been someone else’s problem.
In our work with DoD suppliers, we hear the same concern: Tier 2 and Tier 3 visibility is the hardest part of N-tier supply chain mapping.
Section 805 of the FY2024 National Defense Authorization Act is going to make that mapping unavoidable. Phase 1 landed June 30, 2026. Phase 2, the one that reaches into indirect sourcing, follows a year later. If you sell to the DoD or supply someone who does, the visibility you’ve deferred is now the compliance question you have to answer.
Section 805 fundamentally changes how the DoD evaluates suppliers. The law prohibits the DoD from entering, renewing, or extending a contract for goods, services, or technology with any entity on the 1260H list. The list, established under the FY2021 NDAA, identifies companies the DoD has designated as Chinese military companies.
In plain terms, the DoD can’t contract with companies connected to China’s military, directly or indirectly. Exceptions are narrow. Existing contracts are exempt from the new requirements, though renewals fall under the new rules, and certain third-party facility connections are carved out. The DoD is required to amend the Defense Federal Acquisition Regulation Supplement (DFARS) to implement the prohibition but hasn’t yet.
Regulation happens in two phases
Section 805 is implemented in two phases:
Phase 1 — effective June 30, 2026
The DoD may not directly enter, renew, or extend a contract for goods, services, or technology with any 1260H company or an entity under its control.
Phase 2 — effective June 30, 2027
The DoD may not indirectly contract with a 1260H company, meaning it can’t buy goods or services that contain goods or services produced by a listed entity anywhere upstream. Phase 2 is harder because the risk starts outside your direct supplier relationships. Indirect exposure lives in Tier 2 and Tier 3 suppliers, and “this is usually the biggest challenge to overcome with N-tier supply chain mapping.” Tier 1 vendors treat their upstream relationships as proprietary and are slow to disclose. If your DoD revenue depends on components that you don’t source yourself, Phase 2 is your problem before it’s anyone else’s. Waivers exist, but the bar is high. The DoD requires a compelling justification and a credible phaseout plan. If waiver relief is too narrow to rely on, suppliers need to treat Section 805 as a sourcing issue now, not a contract problem later.
Why does this matter
Much like the tariff work of 2025, Section 805 turns supply chain visibility into a contract requirement. If your company sources from a 1260H company, directly or indirectly, your DoD contracts are exposed at renewal, and any deal currently in negotiation is exposed now.
The tariff response gave A&D suppliers a template. Companies that moved early created vendor maps, qualified alternates, and documented country of origin before they had to. Companies that waited paid for the same work under deadline pressure, with fewer sourcing options and thinner margins. Section 805 rewards the same discipline.
Tariffs changed the cost of a supplier’s decision. Section 805 changes whether the supplier can stay in the contract at all. If you can’t clear a supplier against the 1260H list, the issue is eligibility rather than price.
One point gets missed in early compliance conversations: the initial 1260H screen only works if your supplier master data is clean. A supplier record with the wrong name can make a risky vendor look clear. Clean data is what lets the screen produce a defensible answer.
Compliance roadmap
The work ahead is straightforward, but it doesn’t compress well. Start now and the pieces sequence naturally. Start late and they collide.
1. Assign executive ownership.
Section 805 is a C-suite matter. Companies that treat it as a mid-level procurement issue underestimate the complexity and the revenue at stake. Name an executive sponsor and give them the authority to move contracts, vendors, and budget.
2. Map your DoD revenue streams.
Identify every contract, subcontract, and arrangement that touches DoD spending, directly or indirectly. Quantify the revenue at risk. That number is the business case for the investment the rest of the roadmap requires.
3. Screen your current vendors against the 1260H list.
Download the current 1260H list from the Federal Register and run every active vendor, supplier, and service provider against it. Use exact name matching and fuzzy matching, since listed entities often operate under subsidiary or d/b/a names. Pair the screen with a supplier master data cleanup. The baseline you set here feeds every step that follows.
4. Review your supply chain beyond direct vendors.
This is the tariff lesson in action. Indirect exposure lives in Tier 2 and Tier 3, and Tier 1 suppliers treat their upstream relationships as proprietary. The most effective way to secure cooperation is to narrow the ask to a list of risk-relevant components and route the disclosure through a third-party platform. That approach lets suppliers share subtier identity and country of origin under controlled visibility, protecting their commercial relationships while giving you the traceability you need.
5. Revise agreements.
Work with legal counsel to update supplier agreements. Add representations and warranties regarding 1260H status, notification obligations if a supplier becomes listed, termination-for-convenience rights tied to Section 805, and audit rights that let you verify disclosures. Flow the same obligations down to Tier 2. Without flow-down, your audit rights stop with your direct supplier before they reach the upstream relationships most likely to create exposure.
6. Develop alternative sourcing plans for at-risk components.
For every vendor or component identified as a compliance risk, document an alternative-sourcing plan. Qualify domestic or allied-nation alternates through your supplier approval process. Early movers have the advantage here. Qualified alternates for specialty inputs are finite, and the same primes chasing compliance are chasing the same alternates.
7. Document your considerations.
In a contract audit or inquiry, your documented process is your primary defense. Keep records of screening dates, the list of versions used, supplier disclosures received, corrective actions taken, and the rationale for any exceptions claimed. Maintain a compliance file for each active and anticipated DoD contract.
8. Build a governance process.
The 1260H list is updated annually, and a supplier that clears today may be listed next year. Continuous monitoring is the floor. The ceiling is a governance process that gates new vendor onboarding behind a 1260H screen and a country-of-origin disclosure, and that shapes sourcing strategy for the components most likely to carry indirect exposure, including electronics, rare earths, specialty alloys, and semiconductors. Compliance stops being a project and becomes how the company sources.
The bottom line
The law is enacted. The 1260H list is published. DFARS implementation is underway. What remains is execution, and suppliers need time to do it well. Phase 1 is here. Phase 2 arrives in a year. If you do nothing, the problem will appear at renewal, when a prime asks for supplier disclosures that can’t be produced yet. That’s a bad time to discover your Tier 1 vendors won’ t share upstream detail and your alternate source still needs approval.
So, what do you need to do first? Start with what you can see and screen your direct vendors this quarter. Outside perspective can help you ask the right supplier questions first before your team spends months collecting answers that might not change the risk.
