how-to
How to Conduct Defense Supply Chain Due Diligence
Table of Contents
- What Defense Supply Chain Due Diligence Actually Requires
- Build Your Defense Supplier Due Diligence Checklist Before You Source
- Run a Defense Supplier Risk Assessment That Scores What Matters
- Use a Defense Supplier Onboarding Questionnaire to Verify and Document
- Defense Supplier Screening and Monitoring: Sanctions, Ownership and Sub-Tiers
- Remediation, Escalation and the Evidence File
- Conclusion
- Frequently Asked Questions
Last Updated: October 19, 2026
What Defense Supply Chain Due Diligence Actually Requires
Defense supply chain due diligence is the structured process of checking, documenting and continuously monitoring every supplier in a defense procurement chain before and after a contract is signed.
The stakes are higher than in commercial sourcing. A single unvetted sub-tier supplier can expose a prime contractor to export control breaches, sanctions findings and reputational damage that takes years to repair.
So what does the process actually require? Four things, in order:
- A written checklist that defines what "acceptable" looks like
- A scored risk assessment that ranks suppliers by exposure
- A verification questionnaire that produces evidence, not promises
- A monitoring routine that catches changes after onboarding
Most teams skip straight to the questionnaire. That is the wrong starting point. Without a checklist and a scoring model, the questionnaire collects data nobody can act on.
Regulators across allied markets increasingly expect documented, repeatable diligence rather than ad hoc checks.
The rest of this guide shows how to build each piece.
Build Your Defense Supplier Due Diligence Checklist Before You Source
Start the defense supplier due diligence checklist before any request for quotation goes out. The checklist defines the minimum standard a supplier must meet to enter the pipeline at all.
A workable checklist covers six areas:
- Legal identity and ownership: registration documents, ultimate beneficial owners, corporate structure
- Export control status: licenses held, classification history, prior violations
- Sanctions and debarment: screening against applicable lists, refreshed at each stage
- Ethics and anti-bribery: code of conduct sign-off, training records, grievance channels
Two mistakes show up again and again. First, teams build a checklist so long that no supplier can complete it, so the process grinds to a halt. Second, they build one so thin it misses ownership chains, which is where most sanctions problems hide.
Write the checklist as a scored document, not a yes/no form. Each item should produce a rating that feeds directly into the risk assessment in the next step.
Run a Defense Supplier Risk Assessment That Scores What Matters
The defense supplier risk assessment converts checklist answers into a ranked list. Rank suppliers by exposure, not alphabetically, so limited diligence resources go where the risk is.
A transparent scoring model you can defend to an auditor
Use a 1-to-5 scale for each factor, where 1 is low exposure and 5 is severe exposure. Multiply by a fixed weight, sum the weighted scores, and compare against thresholds.
| Factor | What drives the score | Weight |
|---|---|---|
| Ownership and jurisdiction clarity | Opaque beneficial ownership, high-risk jurisdiction, recent ownership change | 25% |
| Export control and controlled technology exposure | Classification level handled, license coverage, technical data access | 25% |
| Security posture | Facility clearance status, information security certification, physical controls, incident history | 20% |
| Criticality and substitutability | Single-source dependency, lead time to qualify an alternative, mission-critical role | 15% |
| Evidence quality and integrity | Completeness of attachments, consistency of declarations, adverse media, grievance history | 15% |
Weighted score = sum of (factor score × weight). Set thresholds in the procedure, for example: 1.0-2.0 low (light review, re-score annually), 2.1-3.5 medium (full questionnaire, re-score every six months), 3.6-5.0 high (full verification plus security audit before approval, re-score quarterly).
Worked example
A subsystem supplier scores 4 on ownership (complex offshore holding chain), 3 on export control (handles controlled technical data under a valid license), 2 on security (certified, no incidents), 4 on criticality (sole qualified source), and 3 on evidence (declarations complete but one attachment missing). Weighted score = (4×0.25) + (3×0.25) + (2×0.20) + (4×0.15) + (3×0.15) = 1.00 + 0.75 + 0.40 + 0.60 + 0.45 = 3.20.
Prioritize, don't just rank
A ranked list is not a priority list. Apply two overrides on top of the score:
- Criticality override: any supplier scored 4 or 5 on criticality and substitutability goes to enhanced review regardless of total score, because a disruption there stops a program.
- Integrity override: any supplier with a confirmed sanctions match, false declaration, or unresolved adverse media finding is treated as high risk until cleared, whatever the arithmetic says.
Record the factor scores, the weights, the arithmetic and the assessor's name in the file. When an auditor asks why a supplier was approved, the answer should be a reproducible calculation, not a recollection.
Keep the scoring model in writing and apply it the same way every time. Inconsistent scoring is the first thing an auditor will question.
Use a Defense Supplier Onboarding Questionnaire to Verify and Document
The defense supplier onboarding questionnaire exists to produce evidence. Every question should map to a checklist item and generate a document you can file.
Structure the questionnaire in four blocks:
- Corporate and ownership: registration extracts, group structure chart, beneficial ownership declaration
- Compliance: export control licenses, sanctions screening results, anti-bribery policy, code of conduct signature
- Security: certifications held, facility clearance details, incident history
- Operations: capacity statement, key subcontractors, quality management certification
Require attachments. A supplier that ticks "we have an anti-bribery policy" without attaching it has told you nothing.
Set a clear rule on subcontractors. Undeclared sub-tiers are the most common source of supply chain surprises.
DIAGRAM8 applies this same evidence-first discipline to cross-border engagements, running onboarding under ISO 9001, ISO 27001 and ISO 37001 certified governance so that supplier records hold up to institutional scrutiny.
Defense Supplier Screening and Monitoring: Sanctions, Ownership and Sub-Tiers
Defense supplier screening and monitoring is the ongoing routine that keeps the file current after onboarding. Screening is a point-in-time check; monitoring is the schedule that repeats it. The defense-specific twist is that the risk usually sits below the first tier, so the routine has to reach sub-suppliers.
Map the tiers before you screen them
You cannot monitor what you have not mapped. For each approved supplier, build a tier map that records:
- Tier 1: the contracting entity, its beneficial owners, and the facility or facilities performing the work.
- Tier 2: named subcontractors and component makers, with the part or service each provides and whether controlled technical data reaches them.
- Tier 3 and below: critical upstream dependencies, especially sole-source component makers and any entity handling controlled technology or classified material.
Ask Tier 1 to declare its Tier 2 and critical Tier 3 suppliers at onboarding and at every scope change. Where a supplier will not disclose below Tier 2, record that as an evidence gap and factor it into the risk score rather than accepting a blank.
Screen the entity, the owners and the chain
Sanctions screening deserves special attention. Lists change without notice, and a supplier cleared last quarter may appear on a list this quarter. Screen three things every cycle:
- The contracting entity.
- Its beneficial owners and any corporate parents.
- The declared sub-tier entities that handle controlled technology or classified work.
Record the list version, the screening date, the tool or source used, and the reviewer. A screening result without that metadata is not evidence.
Build the monitoring calendar around three triggers
- Time-based: re-screen sanctions and ownership at fixed intervals, tighter for high-risk suppliers. A workable default is quarterly for high-risk, six-monthly for medium, and annually for low-risk, with the interval written into the procedure.
- Event-based: re-check when a supplier changes ownership, wins a new contract, appears in adverse media, or a sanctions list is updated in a way that touches its jurisdiction or sector.
- Contract-based: re-verify at each renewal, option exercise or scope change, and whenever a new sub-tier is introduced.
Push requirements down the chain contractually
Multi-tier visibility is where most programs fall short. First-tier suppliers are well documented. Second and third tiers often are not, yet that is where component substitution and undisclosed ownership changes happen. Require first-tier suppliers to pass the ownership, sanctions and security requirements down the chain in their subcontracts, and audit that flow. A practical mechanism is a flow-down clause that obliges the Tier 1 to notify you of any new sub-tier handling controlled data before work starts, backed by a right to audit the sub-tier records.
Add the defense-specific technology check
For defense-specific risks, add a technology transfer check each cycle. Confirm which sub-tiers handle controlled technical data, verify their handling arrangements match the classification level, and check that any required export authorization covers the actual destination and end user. A sub-tier in a new jurisdiction is a trigger to re-run that check, not a footnote.
Monitoring is only as good as the tier map behind it. If the file cannot name the sub-tiers handling controlled technology, the screening routine is checking the easy part of the chain and missing the part that carries the real defense risk.
Remediation, Escalation and the Evidence File
Remediation is the process of fixing what diligence finds, and the evidence file is the record that proves it was fixed. Neither works without the other.
When an assessment flags an issue, classify it:
- Critical: sanctions hit, false ownership declaration, missing export license. Suspend engagement and escalate to legal immediately.
- Major: expired certification, incomplete sub-tier disclosure. Set a corrective action with a deadline and hold new orders until closed.
- Minor: documentation gaps, outdated policy versions. Log it and collect the missing item at the next review.
Every finding needs an owner, a deadline and a closure date. A finding without a closure date is an open risk, and auditors read it that way.
The evidence file is the product of the whole process. If a regulator or a prime's audit team asked tomorrow why a supplier was approved, the file should answer in minutes: checklist score, assessment result, questionnaire attachments, screening dates, findings and closure records.
Store the file so it can be retrieved by supplier, by contract and by date. That structure is what turns a pile of documents into audit-grade execution.
Conclusion
The hard part of defense supply chain due diligence is not any single step. It is keeping the checklist, scoring, verification and monitoring connected as the supplier base grows and contracts move across borders.
DIAGRAM8 runs this discipline as an institutional commerce platform, with an authorised agency model built for regulated defense-sector work.
Request a formal introduction to DIAGRAM8 and put a diligence process in place that holds.
Frequently Asked Questions
What documents should a defense supplier provide during due diligence?
Expect company registration and ownership records, export control licences and registrations, ISO 9001, ISO 27001 and ISO 37001 certificates where held, an anti-bribery policy, a signed supplier code of conduct, financial statements, end-user declarations and facility security documentation. For sub-tier suppliers, request the same records for any party that touches controlled technology or controlled parts. Keep every document dated and versioned in a single evidence file, because an incomplete record is the most common finding in a defense supply chain audit.
How do you assess risk in a defense supplier?
Score each supplier across dimensions such as sanctions and ownership exposure, export control and technology transfer risk, and security controls at the facility. Weight the scores by how much the supplier contributes to a controlled programme, then rank suppliers into tiers. A defense supplier risk assessment should be repeated when ownership changes, when a new sub-tier is introduced, or when the supplier moves into a higher-risk market, not only on a fixed annual cycle.
How often should defense suppliers be reviewed?
Tier-one suppliers on controlled programmes warrant a full review annually, with sanctions and ownership screening repeated quarterly. Lower-tier suppliers can move to an 18 to 24 month cycle. Trigger-based reviews matter more than the calendar: a change of control, a new facility, a sanctions listing, a whistleblower report or an audit finding should reopen the file immediately. Document the review date and the reviewer so the monitoring record stands up to scrutiny.
What are common red flags in defense procurement?
Watch for owners or beneficial controllers who are hard to verify, reluctance to sign a supplier code of conduct, unexplained changes to bank details, sub-tier suppliers in high-risk markets that appear only after award, and documentation that arrives incomplete or inconsistently dated. Requests to route delivery through an intermediary, or pressure to shorten the onboarding questionnaire, are also warning signs. Any of these should pause the award and trigger an escalation to your compliance function before the contract is signed.
