The Question at Hand
When the Department of Homeland Security (DHS) issues an exclusion order under the Federal Acquisition Supply Chain Security Act of 2018, it's not just banning a vendor. It's highlighting a gap in your supply chain risk assessment. The recent order targeting DeepSeek and its products raises a critical question: should your organization proactively identify and remove risky supply chain components, or wait for explicit government direction?
This is not theoretical. The Federal Acquisition Security Council's rule extends exclusion orders to prime contractors and subcontractors. A 2023 Federal Acquisition Regulation update mandates compliance with these orders. If you're waiting for DHS to identify risks, you're already behind.
The Case for Proactive Supply Chain Risk Assessment
Proactively managing supply chain security aligns with your contract obligations. DFARS 252.204-7012 requires implementing NIST SP 800-171 controls. SR-2 (Supply Chain Risk Management Plan) and SR-3 (Supply Chain Controls and Processes) require identifying and managing risks before they become incidents. Reacting only to federal orders doesn't meet the "implement" standard.
Proactive assessment also offers operational flexibility. DHS orders allow a 60-day window for exception requests, assuming you've already identified affected systems and developed remediation plans. Starting from scratch when an order is issued wastes valuable time.
The technical reality supports this approach. The order covers "third-party products and services developed using DeepSeek implementations," necessitating visibility into your entire AI toolchain. You can't inventory this in 60 days. If you're unsure which tools incorporate DeepSeek's models, you can't confidently respond to an exclusion order.
State-level actions reinforce the need to stay ahead of federal mandates. Texas banned DeepSeek from state-issued devices in January 2025, followed by New York and Virginia. If you serve both federal and state customers, waiting for federal orders means non-compliance with state requirements.
The Case for Following Explicit Government Guidance
The counterargument is practical: premature action can be costly and misguided. Supply chain risk assessment isn't free. Auditing software components, evaluating geopolitical risks, and maintaining threat intelligence require resources. If you remove products based on your own risk assessment and the government never issues an order, you've spent resources on a non-priority risk.
There's also legal clarity. The Federal Acquisition Supply Chain Security Act grants specific authorities to DHS, the defense secretary, and the director of national intelligence. Exclusion orders come with defined scope and legal justification. If you independently decide a vendor is risky and remove their products, you're making a procurement decision without federal legal cover. If this disrupts a contract or incurs unexpected costs, you bear the responsibility.
The exception process is crucial. DHS approves or denies exception requests through the Cybersecurity and Infrastructure Security Agency. This formal path allows contractors to continue using covered technology during a transition period. If you've already removed the technology, you've lost that option.
Some practitioners highlight the appeal mechanism. The 2018 law allows companies 60 days to challenge an exclusion order in the U.S. Court of Appeals for the District of Columbia Circuit. If you've removed a vendor's products and the order is overturned, you've caused unnecessary disruption.
Where Practitioners Actually Land
Most defense contractors and federal IT teams don't choose one approach exclusively. They maintain ongoing supply chain risk monitoring but wait for explicit regulatory direction before taking removal action.
This balanced approach involves continuous Software Bill of Materials tracking, vendor risk scoring, and architecture decisions that avoid deep dependencies on foreign technology providers. When an order is issued, these teams can respond quickly because they already know their environment.
The 60-day exception window becomes an operational buffer, not a discovery period. You're using those days to coordinate with customers and validate replacement solutions, not to determine if you're affected.
The DHS order's language about "multiple threat vectors" and warnings about potential malware suggests future orders will target technologies with both security risks and intelligence exposure concerns. Your supply chain risk framework must evaluate technical vulnerabilities and foreign adversary access to your data.
Our Take
You can't wait for federal orders to drive your supply chain risk program, but you shouldn't remove vendors without clear risk justification. The right approach is to maintain the capability to respond to an exclusion order swiftly while letting the government's formal authorities define what gets removed.
Build your NIST SP 800-171 SR controls for real-time supply chain visibility. Know which products use foreign-developed AI models. Track data flows with third-party services. Document your risk assessment methodology to explain vendor selections to auditors and customers.
But for actual removal decisions, let the Federal Acquisition Security Council do its job. The government has intelligence sources and legal authorities you don't. When DHS identifies a technology as a risk, that's not an assessment you could make independently.
Contractors who struggle with these orders treat supply chain risk management as a checklist item instead of an operational capability. If your first response to an exclusion order is panic about inventorying affected systems, you've already failed the NIST SP 800-171 requirement to implement supply chain controls. Fix that gap now, and the next order becomes a coordination exercise, not a crisis.
