Executive Order 14415 directs the Department of War to develop deeper supply chain mapping, supplier vetting, mitigation, and source-qualification requirements for selected national security acquisitions.
The information may reach from the delivered system through components, software, services, materials, for subtier resilience, foreign ownership control and influence, and raw-material origin. An indentured Bill of Materials (iBOM) gives that evidence a product structure; a digital thread keeps the structure connected to engineering, procurement, supplier, and risk data as products and requirements change.
Key Takeaways
- EO 14415 broadens the supply chain view to include goods, materials, systems, software, services, and suppliers supporting selected acquisitions.
- An iBOM creates a hierarchical record linking the delivered system to its parts, software, materials, and raw-material origins.
- BOM structure alone does not show where meaningful exposure exists. Supplier ownership, financial condition, manufacturing constraints, and material origin add the risk context.
- Beginning January 1, 2027, continued use of certain Section 4872 waivers will require accepted mitigation plans and evidence supporting sourcing and qualification efforts.
- Alternative sourcing requires more than finding another supplier. A replacement source may need to meet technical, testing, capacity, quality, schedule, and qualification requirements.
- Greater supply chain transparency will also require clear controls around proprietary engineering and technical data.
What Does Executive Order 14415 Require?
For selected acquisitions, EO 14415 requires four activities that depend on the same product and supplier data: map the critical supply chain, vet the suppliers within it, document mitigation for significant risks and certain continued waivers, and qualify alternatives to foreign sources.
In EO 14415, Securing America’s Defense Supply Chains and Ensuring Domestic Acquisition of Critical Materials, these activities depend on one another. A mitigation decision requires knowing which source creates the exposure. Supplier vetting requires resolving the companies behind components and services. Alternative-source, and alternative material, qualification requires the technical specifications of the affected product. The iBOM provides a structure for connecting those pieces.
Why Tier 1 Supplier & Parts Lists Are Not Enough Under EO 14415
For acquisitions designated by DoW, the critical supply chain can reach through multiple supplier tiers and include materials, components, software, and services essential to the delivered system. The scope is broader than the materials covered by 10 U.S.C. § 4872.
Critical inputs often enter a defense program several tiers below the prime contractor. A direct supplier list may not reveal the processor behind a specialty metal, the source of a chemical input, a software dependency, or the raw-material origin of a component. Multi-tier supply chain mapping is designed to connect those lower-tier dependencies to the product and program that rely on them.
EO 14415 also reaches beyond critical minerals and other materials covered by Section 4872. An acquisition can fall within the proposed mapping scope because of an essential component, software dependency, or service even when it does not contain a Section 4872 material.
That makes product context essential. A supplier record can show who a company buys from. It cannot, by itself, show which part, material, process, or software dependency inside the delivered system creates the exposure.
How an iBOM Connects Defense Supply Chain Risk to the Product
An indentured Bill of Materials creates a hierarchical evidence chain from the delivered system into its components, software, and materials. Adding supplier, ownership, manufacturing, and provenance information lets teams connect a risk finding to the part and program that depend on it.
An iBOM is a structured record of the components, within a product. In the context of EO 14415, that structure can extend across parts, processes, software, and raw materials toward raw-material origin, with additional supplier and lifecycle information attached to those elements.
That hierarchy makes risk findings more specific. A material restriction can be tied to the component containing the material and the programs that rely on it. A foreign ownership concern can be connected to the parts supplied by that company. A manufacturing constraint can be prioritized based on which systems depend on the affected process or source.
The BOM supplies the product structure. Supplier, material, and risk intelligence provide the information needed to assess what that structure depends on.
How a Digital Thread Connects Engineering, Procurement, and Supplier Risk
Product information usually exists across engineering PLM, procurement ERP, and risk systems. A digital thread connects those records so teams can maintain the relationship between the product, its suppliers, and its risk evidence as the product changes.
Engineering may maintain the as-designed configuration (eBOM). Approved-parts records show what can be used. ERP and procurement systems show what was purchased for production (as- built, mBOM) and sustainment (sBOM). Supplier risk and compliance teams may maintain separate ownership, provenance, and risk information. Those records do not always align.
A digital thread connects engineering, product lifecycle management, procurement, supplier, material, ownership, and risk data through a governed model. It can also reveal differences between the as-designed, and as-built product, and as-maintained reducing engineering-change friction, lead time, and improving accuracy of current and projected risk exposure reporting.
For EO 14415, the same connection provides a more durable way to answer evolving national security questions as conditions and geopolitics change. Teams do not have to reconstruct the product and its supplier relationships for every new requirement.
Why Material Origin and Manufacturing Details Matter
A part number identifies an item. It does not identify the upstream materials, processors, manufacturing requirements, or ownership relationships that determine whether the part can continue to be supplied.
Exposure may sit in an alloy, coating, casting, chemical input, or technical specification several steps upstream from the company supplying the finished component. A supplier that appears domestic may still rely on a foreign-controlled processor or a constrained manufacturing capability elsewhere in the value-chain.
Exiger multi-tier supply chain mapping connects technical product evidence to materials, specifications, manufacturing processes, raw-material origin, supplier concentration, and potential alternatives.
EO 14415 also calls for supplier vetting across financial risk; foreign ownership, control, or influence (FOCI) risk; and manufacturing and supply risk.
That analysis depends on correctly identifying the entity behind the component or dependency. Each critical part, software dependency, material, or service needs to be matched to the appropriate legal entity and ownership structure before risk screening can be applied reliably. Otherwise, a risk result can be attached to the wrong supplier.
What Changes for Section 4872 Waivers on January 1, 2027?
Beginning January 1, 2027, routine waivers under Section 4872(c)(1) are directed to cease, subject to the order’s exceptions. Continued waivers will require an accepted mitigation plan supported by evidence of sourcing and qualification efforts.
The mitigation plan must identify the noncompliant source, document efforts to locate compliant supply or demonstrate its unavailability, define remediation actions, and establish a timeline. The underlying statute is available in 10 U.S.C. § 4872.
A contractor may know of a potential domestic or allied source but still need engineering work, testing, certification, tooling, or capacity before that supplier is qualified to manufacturer the part and support the program. The status of that qualification work becomes relevant to the waiver and mitigation record.
Why Alternative-Source Qualification Goes Beyond Supplier Discovery
Supplier discovery identifies possible replacements. Qualification determines whether one of those sources can meet the program requirement(s).
An alternate supplier will need to satisfy the affected part’s technical requirements, testing standards, manufacturing capacity, quality expectations, schedule, and funding constraints. Technical data availability aids in narrowing the options to suppliers with matching, or adjacent, capabilities.
Alternative-source analysis therefore includes identifying potential suppliers, materials, designs, and manufacturing methods, then gathering the evidence needed to determine whether the alternative is viable.
A supplier appearing in a search result is not the same as an approved, qualified source capable of supporting production.
How EO 14415 Connects Risk Reporting, Corrective Action, and Closure
EO 14415 connects supplier vetting to a defined reporting and remediation process. For covered acquisitions, the proposed requirements include risk notification, corrective action, mitigation tracking, and closeout.
The order calls for significant-risk notices within 15 days after required vetting and corrective-action plans within 45 days, followed by mitigation tracking through closure and retention of the closeout record.
Teams therefore need to preserve the relationship between the finding, the affected product or supplier, supporting evidence, the owner of the action, the proposed mitigation, its status, and evidence that the issue was addressed.
This is also why an iBOM should not be treated as a static reporting artifact. The underlying product, supplier, and risk information can, and is expected to, change while mitigation and qualification work is underway.
How Can Contractors Protect Proprietary Data While Increasing Supply Chain Transparency?
Deeper supply chain evidence can include proprietary engineering and technical data. DoW and industry will need mechanisms that provide the required risk information without distributing sensitive underlying data more broadly than necessary.
DoW still has to resolve important questions around data rights, access, classification, certification, and support-contractor use. Those protections belong in the design of the process.
A workable data-sharing model should distinguish between underlying proprietary information and the findings government needs to evaluate risk, mitigation, or qualification. Role-based access, defined data boundaries, and controlled sharing can help preserve that distinction.
Collecting more data is of limited use if contractors cannot share it with confidence or government teams cannot use it consistently.
What Can Defense Contractors Do Before Final EO 14415 Regulations?
DoW has not finalized every aspect of coverage, data requirements, governance, or enforcement. Contractors can still identify gaps in the product, supplier, and qualification data that any credible implementation of EO 14415 is likely to depend on.
That work can include:
→ Inventorying and normalizing existing BOM, software Bill of Materials (SBOM), part, drawing, supplier, and material data.
→ Reconciling the as-designed, approved, and as-purchased product.
→ Connecting critical parts and materials to the suppliers and subtiers behind them.
→ Matching those dependencies to the correct legal entities and ownership structures.
→ Defining who can access proprietary product and supplier information.
→ Identifying foreign-source, material, capacity, sole-source, and concentration exposures.
→ Maintaining evidence for mitigation, corrective action, and alternative-source qualification.
Much of this work can begin with information contractors already own. It can improve sourcing, cost, schedule, and qualification decisions before DoW finalizes an iBOM template.
EO 14415 Makes Product-Level Traceability Central to Defense Supply Chain Risk
Defense supply chain risk has often been assessed through suppliers first: identify the company, evaluate its risk, and determine where it sits in the network. EO 14415 pushes the analysis closer to the product.
Teams may need to trace from the delivered system into its parts, software, and materials, then outward to suppliers, ownership, manufacturing processes, and origin. When a problem appears, they also need to understand which systems depend on it, what remediation is underway, and whether another source can meet the requirement.
An iBOM gives that information a product structure. A digital thread keeps the structure connected to the engineering, sourcing, and supplier data that change throughout the product lifecycle.
Product-level supply chain intelligence then supports four connected questions: What is inside the system? Where does it come from? What can disrupt it? What can replace the dependency if necessary?
How Exiger Helps
Exiger helps defense contractors assemble and assess the evidence EO 14415 is expected to require across iBOMs, multi-tier supplier vetting, mitigation and alternative-source qualification. A knowledge graph with more than 400 million part attributes links parts, manufacturers, suppliers, materials and specifications, helping identify the specific part, material, process, supplier, ownership relationship or software dependency behind an exposure. Exiger can distinguish customer-provided, Exiger-sourced, inferred, validated and missing information so teams can focus collection and remediation on the gaps most consequential to a selected program.
For source qualification, the specifications, form-fit-function analysis, manufacturing history and government procurement records help identify credible alternatives and the barriers that may prevent them from supporting the requirement. Exiger also prioritizes sole-source, capacity, obsolescence and subtier constraints so contractors can focus qualification effort where the risk to production is greatest. Beginning this work before final regulations are issued provides more time to address data gaps and qualification backlogs before program designations, flowdowns and reporting requirements take effect.
Table of Contents
Get in Touch
Learn how you can build a more resilient supply chain.
Frequently Asked Questions
Executive Order 14415, signed July 20, 2026, directs the Department of War to strengthen supply chain mapping and supplier vetting for selected national security acquisitions, tighten certain Section 4872 waivers, and accelerate alternative-source qualification.
For acquisitions designated by the Secretary and covered by future regulations, contractors at multiple tiers may need to provide an iBOM, vet suppliers, report significant risks, document corrective actions and mitigation, and qualify alternatives to unreliable foreign suppliers.
No. The mapping requirements can encompass goods, materials, systems, software, and services essential to a selected acquisition. An acquisition may fall within scope even without a material covered by Section 4872.
An indentured Bill of Materials is a hierarchical record connecting an end item to its components, parts, software, and materials and, in the EO 14415 context, toward raw-material origin and additional lifecycle information.
A digital thread connects product, engineering, procurement, supplier, material, and risk information. That lets contractors maintain relationships between the delivered system and its underlying dependencies instead of producing disconnected data extracts for each request.
The proposed regulations are directed to cover financial risk; foreign ownership, control, or influence; and manufacturing and supply risk. Relevant manufacturing and supply considerations include capacity constraints, delays, obsolescence, sole-source dependence, concentration, and limited surge capacity.
Routine waivers under 10 U.S.C. § 4872(c)(1) are directed to cease, subject to the order’s exceptions. Continued waivers require an accepted mitigation plan with source identification, sourcing evidence, removal steps, and a defined timeline.
Final regulations will determine specific coverage, data formats, and enforcement requirements. Contractors can proactively improve BOM quality, connect engineering and procurement records, resolve supplier entities, investigate material and subtier exposure, define data protections, and address qualification backlogs using information they already maintain.
