Compliance self-audit

Score yourself first

Why it matters: In Drone Dominance Phase I, drones that weren't Blue-listed were rejected, and an industry-wide shortage of NDAA-compliant parts slowed deliveries. Fix gaps before a buyer finds them.¹¹

Green: done, with evidence on file · Amber: in progress or unsure · Red: not started or a known gap

A · REGISTRATION

SAM, UEI and CAGE

Active System for Award Management (SAM) registration, Unique Entity ID (UEI) and CAGE code: standard for any award. Set up WAWF/PIEE invoicing when the award requires it. Drone NAICS 336411 (1,500-employee size standard); PSC 1550.^31,34

B · PARTS AND DRONE LAWS

NDAA Sec. 848 and Sec. 817

No Defense Department buys of drones, or drones with critical parts, from China, Russia, Iran or North Korea. Covered parts: flight controllers, radios, data links, cameras, gimbals, ground control, operating software, network and data storage. Check: every covered part traced to its maker and country.^52,53

American Security Drone Act (ASDA)

Procurement ban since enactment; bans on operating covered drones and spending federal funds on them since Dec 22, 2025, including for contractors. FAR 52.240-1 carries this into contracts and subcontracts. Narrow exemptions (for example DoD, DHS, State and Justice for testing, training, counterterrorism or national security work) and case-by-case waivers that need OMB approval. Check: rely on one only if your contract says so.^54,55,85

Parts sourcing beyond the law

Drone Dominance supply-chain framework, a program rule: motors and battery packs assembled outside covered countries (Phase II on). Phase III adds a magnet sourcing plan and flight-controller boards made outside covered countries.^11,14

B · PARTS AND DRONE LAWS (CONTINUED)

Blue List readiness

Open a packet in the Blue List portal and contract a Recognized Assessor, who reviews supply chain, ownership and NDAA compliance. Green UAS Cleared is a recognized pathway to Blue, but does not replace Blue where a notice requires it. GSA and Drone Dominance deliveries require Blue.^15,17,18,47

FCC Covered List

Since Dec 22, 2025, foreign-produced drones and critical parts can't get new FCC authorizations. Exempt until Jan 1, 2028: Blue-listed items and Buy American domestic end products. Items with a DoW or DHS Conditional Approval stay exempt while the company follows its onshoring plan. The FCC's July 21, 2026 public notice controls over one stale FAQ line that says 2027. Drones sold only to the government generally don't need FCC authorization.^56,57,86

C · TRADE

Export controls

Classify each item. U.S. Munitions List Category VIII(a) covers drones specially designed to carry a defense article, armed drones and target drones (State Department rules, ITAR). Military drones not on that list fall under Commerce rules (EAR) as ECCN 9A610; commercial drones as ECCN 9A012. Since Aug 13, 2026, commercial drones under 3 hours endurance are controlled for anti-terrorism reasons only. Unsure? Ask for a formal ruling.^68,69,87

Section 232 drone tariffs

Proclamation 11055: since Sep 3, 2026, 100% on listed drones over 25 kg, thermal drones, docking stations and critical parts; 25% on listed drones 25 kg or less; listed components go to 25% on Feb 9, 2027. Caps: 15% for Japan, Korea, Taiwan, Switzerland, Liechtenstein and the EU, 10% for the UK, if substantially all critical parts come from those countries or the U.S. Companies on the Blue List, Blue Framework or FCC Conditional Approval list on Sep 2, 2026 got a 180-day delay (to Feb 9, 2027) for those products. Approved U.S. onshoring plans can import duty-free.^58,59

D · CYBER AND SECURITY

DFARS 7012 and NIST SP 800-171

Protect Controlled Unclassified Information (CUI) and report cyber incidents within 72 hours. Still fully in force.^63,60

CMMC

Cybersecurity Maturity Model Certification. Phase 1 (Level 1 and Level 2 self-assessments posted in SPRS) in force since Nov 10, 2025. Phase II third-party assessments suspended Jul 13, 2026; self-assessments remain. False Claims Act risk on your SPRS score is higher, not lower.^60,61,62

Facility clearance

You can't sponsor yourself. The sponsor must be a government contracting activity or a cleared contractor. Some events are U.S.-citizens-only.⁶⁵

Foreign ownership (FOCI)

Foreign investors can trigger Defense Counterintelligence and Security Agency (DCSA) mitigation. SBIR now screens foreign ties and rejects proposals that present security risks.^66,43

E · OPERATIONS, CYBER REVIEW AND STATUS

FAA flight rules

Civil flights (demos, homeland and state customers) follow FAA Part 107. Flying beyond visual line of sight (BVLOS) needs a waiver or exemption today. Part 108, the BVLOS rule, is still proposed: published Aug 7, 2025, comments reopened Jan 28, 2026, and no final rule in the Federal Register as of Oct 19, 2026. Trade press reports the final rule has been under White House review since Jul 10, 2026.^67,90

Section 889 telecom and video ban

You can't provide equipment that uses covered telecom or video gear (Huawei, ZTE, Hytera, Hikvision, Dahua and their affiliates) as a substantial or essential component. Agencies also can't contract with a company that uses such gear anywhere, even outside the contract. Limited exceptions, such as backhaul and roaming. Found some during a contract? Report within one business day (Defense: dibnet.dod.mil). Flows down to subcontracts.⁶⁴

Green UAS cyber review

AUVSI's Green UAS Cleared reviews product and device security plus supply-chain risk management. DIU has recognized it as an authorized pathway to Blue UAS Cleared since Jul 16, 2025. Green UAS Certified adds corporate cyber hygiene and remote operations and connectivity.¹⁸

Small-business status

You self-certify size in SAM against your NAICS code's size standard: 1,500 employees for aircraft manufacturing (336411). The Small Business Administration (SBA) certifies the 8(a), HUBZone, women-owned and veteran-owned (including service-disabled) programs. Set-asides only help if you hold the status the notice names.⁹¹