The Defense Department has laid out a four-pillar certification regime that contractors would need to clear before winning a waiver to source printed circuit boards from China, Russia, Iran, or North Korea, according to an advance notice of proposed rulemaking published July 2, 2026 under DFARS Case 2022-D011.
Background
Congress banned DoD acquisition of "covered printed circuit boards" from the four named countries through Section 841 of the fiscal 2021 NDAA (10 U.S.C. 2533d) and Section 851 of the fiscal 2022 NDAA (renumbered 10 U.S.C. 4873). The July 2 notice, filed under Docket DARS-2026-0298 and RIN 0750-AL62, spells out how the Pentagon intends to police the ban at the level of individual boards and components, rather than relying on a supplier's self-certification alone.
The notice ties the printed-circuit-board ban to a second, older mandate — Section 224 of the fiscal 2020 NDAA, which directs DoD to build a trusted supply chain for microelectronics. DoD's proposed approach folds both statutes into a single "tiered trust architecture" keyed to the geographic point of fabrication for bare or partially manufactured boards, rather than the location of final assembly or the nationality of the prime contractor.
That distinction matters because a board can pass through several countries before reaching a U.S. integrator: substrate fabrication, layer lamination, drilling, plating, and final assembly can each happen in a different facility. By anchoring the ban to the fabrication step for bare and partially manufactured boards, DoD targets the point in the process where a covered nation could most plausibly insert a compromised layer, rather than policing every downstream handling step.
The advance-notice format DoD chose here means the framework described below is not yet binding text. It previews the direction DoD intends to take in a subsequent proposed rule, offered so industry can flag implementation problems — such as unrealistic certification timelines or capacity constraints among Trusted Assemblers — before the requirements are locked in.
Key Details
DoD's centerpiece is what the notice calls an "Independent Hardware Assurance Framework," built on four certification pillars a contractor must satisfy to obtain a waiver for sourcing a board from a covered nation.
First, enterprise-level supply chain certification under ISO/IEC 20243, the Open Trusted Technology Provider Standard, which DoD estimates takes three to eleven months to obtain. Second, machine-level manufacturing traceability certified to IPC-1782 Level 3 or 4, covering that same three-to-eleven-month estimate. Third, facility-level certification under IPC-1791 as a Trusted Assembler or Trusted Fabricator — the longest pole in the process at an estimated eight to sixteen months — which requires routing any board sourced from a covered nation through a certified domestic or allied facility for blind hardware testing before it can be integrated into a weapon system or IT platform. Fourth, treatment of unclassified digital design data — Gerber files, netlists, and schematics — as Controlled Unclassified Information, with the cybersecurity safeguards that designation carries.
DoD is asking industry to weigh in on how long a phase-in period should run, floating 12-, 18-, or 24-month options, an acknowledgment that the IPC-1791 timeline alone could consume most of a shorter window. A complete waiver package must include a verification report from the Trusted Assembler, a market-availability justification showing no non-covered-nation source exists, full component traceability, and a written transition plan describing how the contractor will eliminate covered-nation sourcing over time. DoD Hardware Assurance Labs — potentially drawing on the National Security Agency, Department of Energy national laboratories, federally funded research and development centers, and university-affiliated research centers — would independently validate those reports, a check the notice singles out as necessary when the Trusted Assembler is affiliated with the contractor seeking the waiver.
The retention and flow-down obligations are broad. Contractors would have to keep verification imagery and traceability logs for ten years or the operational lifespan of the system, whichever is longer, and push the same certification and traceability requirements down through every subcontract tier — including subcontracts for commercial and off-the-shelf items, a category the government normally treats with a lighter compliance touch. Comments on the advance notice are due August 31, 2026, submitted through regulations.gov under DFARS Case 2022-D011 or by email to [email protected]; the listed point of contact is Kelsey Bramschreiber.
What It Means for Contractors
Any contractor with printed circuit boards fabricated in China, Russia, Iran, or North Korea anywhere in its supply chain — including at lower subcontract tiers supplying commercial parts — now has a concrete list of what a waiver will cost to obtain. The IPC-1791 Trusted Assembler certification is the pacing item: at eight to sixteen months, it could consume most or all of even the longest of the three phase-in periods DoD is weighing, which means the phase-in period DoD ultimately chooses will determine whether waiver-dependent programs face a compliance gap for contractors starting the process today.
Contractors that already hold ISO/IEC 20243 certification have a head start on one of the four pillars, but the notice makes clear that certification alone will not substitute for facility-level traceability or blind testing at a Trusted Assembler. Firms that both design boards and operate their own assembly or fabrication capability should expect extra scrutiny — the notice explicitly flags affiliated Trusted Assemblers as a trigger for independent validation by a DoD Hardware Assurance Lab rather than acceptance of the contractor's own report.
The ten-year retention requirement and the mandate to flow certification obligations down to commercial and COTS subcontracts will land hardest on primes with deep, multi-tier supply chains that have not historically tracked fabrication location below the board-house level. Program offices relying on components with unclear geographic provenance should begin sourcing audits now rather than waiting for a final rule, since the market-availability justification required for any waiver depends on documenting that no non-covered-nation alternative exists — a case that gets harder to make the longer a contractor waits to map its supply base. Contractors with a stake in the outcome have until August 31, 2026, to shape the final phase-in timeline and waiver criteria before they become binding.
