Software Vendor Sanctions and Ownership Screening

Before a defense contractor installs software, it should know who is behind it. Sanctions and ownership screening is the first step of a software review because a vendor-level problem can disqualify a product no matter how it behaves technically. It is also the cheapest step, which makes it the right place to fail fast.

This article is general information, not legal advice. Which clauses and restrictions apply to you depends on your contracts, so confirm your obligations with your contracts or compliance team.

What to screen

Screen the vendor, not only the product. That includes the legal entity that publishes the software, its parent and ultimate owners where they can be identified, and resellers or OEM partners in the chain. A product with a clean name can come from an entity that is owned or controlled by someone you cannot do business with.

Lists and clauses to check

Several public sources are commonly used. The list is not exhaustive and the obligations that attach to each depend on the contract.

• SAM.gov exclusions. The System for Award Management holds exclusion records, and FAR 9.404 has agencies avoid awarding contracts to, or consenting to subcontracts with, parties that have an active exclusion. Search the vendor at SAM.gov.
• Consolidated Screening List. The U.S. International Trade Administration publishes a list that consolidates export screening lists from the Departments of Commerce, State and the Treasury, including the Commerce Entity List and the Treasury Specially Designated Nationals List. It is available at trade.gov.
• Section 1260H list. The Department of Defense publishes a list of Chinese military companies under Section 1260H of the National Defense Authorization Act for Fiscal Year 2021, and says it will update the list as appropriate. Check the current version at the time of review.
• FAR 52.204-23. This clause implements Section 1634 of the National Defense Authorization Act for Fiscal Year 2018. It prohibits a contractor from providing, or using in developing contract deliverables, any hardware, software or service developed or provided, in whole or in part, by a Kaspersky Lab covered entity: Kaspersky Lab, its successors, entities under common control with it and entities it majority-owns. See FAR 52.204-23.
• FAR 52.204-25. This clause, titled Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment, covers equipment from Huawei and ZTE and, for specified national security purposes, video surveillance and telecommunications equipment from Hytera, Hikvision and Dahua, together with related services and affiliates. It matters for software review when the software is part of, or runs, such equipment or services. See FAR 52.204-25.

Lists change. Record the date of every check and the version or date of the list consulted, and re-check on a schedule and whenever the vendor's ownership changes.

Looking at ownership and control

Restricted-party lists catch named entities. Ownership review catches structures. Ask who owns the vendor, whether a foreign government or a restricted party holds a significant stake or influence, where the company is incorporated, where its development teams work and where its servers and update infrastructure sit. Cleared contractors know this as foreign ownership, control or influence, and the same questions are useful for any software vendor even when no formal framework requires them.

Public sources such as corporate registries, annual filings, press releases and the vendor's own legal notices answer most of these questions. Where the answer is unclear, treat the uncertainty as a finding and record it.

Data flows are part of the picture

A vendor's jurisdiction matters most when the software sends data to it. If the product sends telemetry, crash reports or documents to vendor-controlled servers, the location and ownership of those servers is directly relevant. Sandbox observation of network destinations, described in our sandbox analysis guide, shows where the software actually connects.

Outcomes and documentation

Use clear outcomes. A vendor that appears on a prohibiting list or is covered by a prohibiting clause should be rejected. A vendor with unresolved ownership questions or foreign development with limited visibility may justify rejection or conditions, depending on your risk tolerance and your compliance advice. A vendor that clears the checks proceeds to technical analysis.

For every request, record the vendor's legal name, the lists and clauses checked with dates, the ownership findings and the outcome. These records belong in the evidence pack for the approved entry, described in the approved software list guide, and they feed the broader third-party software risk assessment.

Where DigVel fits

Phase 1 of DigVel's service is an OSINT screening of the vendor covering sanctions, prohibited-source and ownership questions, with a go or no-go result before any sandbox time is spent. Read the methodology or see the service. Interpretation of legal obligations remains with your counsel or compliance advisor.