NRO presses primes to map sub-tier supply chain risks
The three-year-old NRO FAR Supplement clause asks contractors to illuminate, not eliminate, supply chain risk, and the agency grades itself a B-minus.
TL;DR
The NRO has been embedding a supply chain risk visibility clause in its FAR supplement for three years, Director for Systems Engineering Darwyn Banks disclosed at an INSA webinar. The clause requires prime contractors and second-tier subs to map their vendors and suppliers, not to eliminate risk, but to illuminate it. Banks gave the program a B-minus, calling the effort a long-term expectation rather than a one-off initiative.
The National Reconnaissance Office has been quietly rolling out a supply chain risk visibility clause in its FAR supplement for three years, and it's now talking about the results publicly. The self-grade from Darwyn Banks, NRO's director for systems engineering: B or B-minus. That's an honest assessment, and it reflects the agency's pragmatic approach, it isn't trying to eliminate supply chain risk, just to see it clearly.
The NRO clause asks prime contractors and second-tier subs "to do a better job of knowing who their vendors and suppliers are." That's a direct shot at the privity-of-contract problem that has bedeviled federal supply chain security for years: the government contracts with the prime, the prime contracts with subs, and by the third or fourth tier nobody knows who's building what. Banks is clear that illumination, not elimination, is the goal. "I'm not saying we're going to get these risks out of the food chain," he said during an Intelligence and National Security Alliance webinar. "We just need to know where they are so that we can manage them appropriately."
The NRO supplements the contract clause with in-house business intelligence capabilities ("supply chain illumination and supply chain due diligence") that program offices can use when evaluating subcontractor management plans during the RFP process. This gives the government a second channel of visibility into the proprietary supply base, parallel to what primes report. It's a sensible architecture, and it's one that other agencies (including the White House, which is currently reviewing how agencies report on cyber supply chain security risks) may watch closely.
For the compliance director or security engineer at an NRO prime, none of this lands as a surprise Monday morning. The clause has been appearing in new contracts since 2023. What's new is the public signal: NRO leadership is telling industry, on the record, that supply chain illumination is a long-term expectation, not a pilot. Banks's framing ("we're not asking for anything that industry doesn't already do") suggests the agency sees its role as facilitating conversations rather than imposing new reporting burdens. That could change as the White House review concludes, but for now, the message is: know your suppliers, and be ready to talk about them.
Published ·Updated ·Deep Fathom