Suppliers outside the United States

Defence supply chains are not confined to one country

Manufacturers in allied countries sit inside programmes governed by United States requirements, and suppliers inside the United States buy from abroad. Both directions raise questions the requirement was not written with in mind.

Ask the prime rather than assuming

Whether and how the certification requirement applies to a supplier outside the United States, and what an equivalent looks like, is a question with a developing answer and one that depends on the programme and the contract.

The reliable route is to ask the contracting party what they will require of you and by when, in writing. Guessing produces either wasted preparation or a surprise.

Four that are real regardless of the rules

Assessor availability. Fewer accredited assessors operate outside the United States, and the constraint described in the entry on slippage is sharper.

Data location. Requirements about where covered information may sit interact with local law about where data must sit.

Export control. Cross-border arrangements engage it more readily than domestic ones. The entry that names it applies with force here.

Language and interpretation. The standard is written in one legal and technical idiom, and translating a control into another regulatory culture produces genuine ambiguity rather than laziness.

Controls travel; evidence conventions do not

The technical controls are the same everywhere. What differs is what counts as acceptable evidence, what records local employment or privacy law permits you to keep, and how monitoring must be notified.

The entry on what staff are told is the clearest example: the same deployment requires different steps in different countries, and the strictest applies to that part of your workforce.

Three things to establish early

What standard they will hold you to and on what timescale. Whether they will accept evidence in the form you can produce. And who at their end owns the answer, because supply chain security questions are frequently routed between procurement and security with neither answering.

The same six questions

From the entry on your own suppliers, plus one: where are the people who administer your systems and hold your data. That question matters for export purposes and it is the one least often asked.

Jurisdiction makes this harder, not easier

Everything in this entry sits at the intersection of at least two legal systems and an export regime. It describes considerations and states no position on any of them. Take advice in each jurisdiction you operate in.

Elsewhere in the wider regime

• What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
• Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
• What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
• Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
• Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
• Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
• Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
• Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
• Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
• Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
• Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
• Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
• What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
• The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
• Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
• Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
• Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
• What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.