Trusted Systems, Counterfeit Prevention & SCRM Compliance. Unified compliance infrastructure for the overlapping frameworks governing defense supply chain security. Manage NIST SP 800-161, DoDI 5200.44 criticality analysis, DFARS counterfeit prevention, Section 889 prohibited sources, and FOCI requirements through a single integrated workflow.
Supply chain risk management in defense acquisition requires simultaneous compliance with frameworks that evolved independently and now overlap significantly.
These frameworks share objectives but use different terminology, require different documentation, and impose different assessment criteria. Information that should flow between these efforts remains siloed.
Supplier assessments address all applicable frameworks simultaneously. Risk scores aggregate across compliance dimensions. Documentation generated for one requirement satisfies overlapping obligations in others.
NIST Special Publication 800-161 Revision 1 provides the authoritative C-SCRM framework. The Supply Chain Risk control family in NIST 800-53 Rev 5 includes eleven controls: SR-1 through SR-11.
Governance including policies, risk appetite, and organizational accountability
Thalorin maps organizational practices to NIST 800-161 requirements across all three tiers, generating C-SCRM plans and tracking control implementation status in enterprise risk dashboards.
Criticality levels determine the intensity of supplier risk assessment. Programs must conduct functional decomposition tracing missions to ICT components.
Total mission failure
Significant mission compromise
Limited mission impact
For Level I and Level II critical components, the Defense Intelligence Agency provides classified threat analysis informing both supplier vetting and security controls.
Industry estimates suggest 15 percent of DoD spare parts are counterfeit, with reported incidents continuing to increase.
FAR 52.246-26 requires reporting counterfeit parts to GIDEP within 60 days of discovery.
DFARS mandates counterfeit prevention systems for contractors subject to Cost Accounting Standards, specifying twelve system criteria.
Thalorin automates counterfeit prevention compliance with GIDEP monitoring, quarantine workflows, and incident reporting automation.
Section 889 prohibits contracting with entities using equipment or services from covered telecommunications companies and their subsidiaries and affiliates.
Direct procurement of covered telecommunications equipment
Any entity using covered equipment anywhere in business operations
Part B's broad scope creates significant compliance challenges. Contractors must verify covered equipment does not exist anywhere in their enterprise, regardless of nexus to government work.
Includes all subsidiaries and affiliates. Thalorin maintains current prohibited entity databases with subsidiary identification and remediation tracking.
FOCI requirements expanded dramatically under Section 847 of the FY2020 NDAA, extending reviews to unclassified contracts exceeding $5 million.
Limited foreign involvement
Intensity: LowModerate foreign ownership
Intensity: MediumSubstantial foreign ownership
Intensity: HighForeign government involvement
Intensity: HighestDCSA adjudicates FOCI determinations and approves mitigation instruments. Thalorin tracks FOCI status across the supplier base and monitors ownership changes that could trigger concerns.
The Supplier Performance Risk System serves as DoD's authoritative source for supplier information. Contracting officers query SPRS before contract awards to verify eligibility and assess risk.
SPRS scores directly impact contract competitiveness. Suppliers with low assessment scores or poor delivery performance face increased scrutiny and potential exclusion.
Assessment scores directly impact contract competitiveness
Delivery performance rates tracked across contracts
Quality indicators and corrective action status
Certification tracking as enforcement begins
Thalorin integrates with SPRS to maintain current supplier risk profiles, track score trends, and validate assessment data before upload.
Supply chain risk does not stop at Tier 1 suppliers. Critical vulnerabilities often exist in sub-tier suppliers where prime contractors have limited visibility.
Industry estimates suggest most organizations have visibility into fewer than 50 percent of their sub-tier suppliers.
Thalorin aggregates supplier information across program boundaries to build enterprise supply chain visibility. Risk indicators at any tier propagate to affected programs.
Three-tier C-SCRM implementation with control mapping
Functional decomposition and DIA coordination tracking
DFARS compliance with GIDEP monitoring
Prohibited entity database with validation
Ownership monitoring and mitigation tracking
Assessment score tracking and validation
Aggregated metrics across compliance dimensions
Sub-tier visibility with risk propagation
Counterfeit discovery and breach coordination
Evidence packages for all SCRM requirements
GIDEP counterfeit reporting deadline
FOCI review threshold for unclassified contracts
DMEA accredited trusted suppliers
NIST 800-53 Rev 5 SR control family
See how Thalorin consolidates NIST 800-161, DFARS counterfeit prevention, Section 889, and FOCI compliance into a single workflow tailored to your supplier base.