Inside Unmanned Systems maps the Pentagon’s new component-level requirements across the NDAA, Blue UAS and Drone Dominance frameworks—showing where platforms can remain legally compliant yet still become ineligible for future military orders.

When Travis Metz, Drone Dominance Program Manager at the Defense Innovation Unit, told the XPONENTIAL keynote audience to treat the recently published supply chain framework as a capital deployment roadmap, he was not speaking loosely. The document—available at dronedominance.mil—is the most detailed public statement yet of what the U.S. defense establishment needs the domestic drone industry to build, and by when. But to understand what it requires and why it matters, it has to be read against the two frameworks that preceded it: the NDAA statutory baseline and the Blue Cleared UAS List. These are not the same thing, and the differences between them are operationally significant.

THREE FRAMEWORKS, THREE DIFFERENT QUESTIONS

The NDAA, the Blue List, and the DDP Supply Chain Framework each do a different kind of work, and collapsing them into a single concept of “compliance” produces a misleading picture of where a company actually stands.

The NDAA provisions answer the question: who and what are prohibited? The statutory framework governing UAS procurement has been built up across multiple cycles. Section 889 of the FY19 NDAA prohibits components from five named Chinese telecommunications entities—Huawei, ZTE, Hikvision, Dahua, and Hytera. Section 848 of the FY20 NDAA, codified at 10 USC 4881, prohibits the Department of Defense from procuring or operating covered UAS manufactured in covered foreign countries or by entities domiciled there. Section 817 of the FY23 NDAA extended those restrictions to cover counter-UAS equipment. The American Security Drone Act, enacted in the FY24 NDAA, broadened the prohibited entity framework by barring procurement from entities on the Federal Acquisition Security Council list and from covered foreign country-domiciled entities. On batteries specifically, Section 1260H of the FY21 NDAA established the Chinese Military Companies list—on which CATL was placed in January 2025, triggering a contracting bar under FY24 NDAA Section 805 effective June 30, 2026—while FY24 NDAA Section 154 separately bars DoD from purchasing CATL batteries effective October 1, 2027. These are entity and component prohibitions. They tell you what you cannot use. They do not tell you how to prove that you are not using it, and they leave a vast middle ground of components that are not explicitly prohibited but that nonetheless create supply chain risk.

The Blue Cleared UAS List answers a different question: has this specific platform been independently verified as compliant, and can it be procured and operated by the military? The Blue List is administered by DCMA’s Unmanned Systems X organization, which took it over from DIU in December 2025. Crucially, the Blue List is not simply NDAA compliance with a certification stamp. It certifies that a platform meets the requirements of Section 848 (FY20 NDAA), Section 817 (FY23 NDAA), and the American Security Drone Act (FY24 NDAA)—and it adds three process requirements that no statute mandates. First, a Foreign Ownership, Control, and Influence assessment conducted by the Defense Counterintelligence and Security Agency, which evaluates the ownership and control structure of the manufacturer—not just the components. Second, a physical hardware teardown by one of six DCMA-recognized assessors, which examines sub-components against the submitted bill of materials and has been finding, in practice, wiped chips of unknown origin, Chinese-sourced components, counterfeit parts, and ground control station elements sourced from China that satisfy line-item checks while failing the underlying intent of the standard. Third, a cyber assessment evaluating passwords, configuration management, and firmware security, which is finding an average of approximately ten vulnerabilities per platform. The Blue List standard is also slightly more stringent than the NDAA on certain component sourcing requirements—by design, since the checklist signed off by the Defense Security Board was written to exceed the statutory minimums. A system can be NDAA-compliant and still fail Blue List certification.

The DDP Supply Chain Framework answers a third question: what must every sub-component of a platform be made from, sourced from, and documented as, in order to participate in the Drone Dominance Program—and on what timeline? This is the most granular and most demanding of the three frameworks. Where the NDAA prohibits specific entities and components and the Blue List verifies platform-level compliance through a process, the DDP framework specifies requirements at the individual component level across thirteen distinct areas—from flight controllers and GNSS modules to motors, batteries, propellers, and payload lethality systems. It does not simply ask whether a component comes from a prohibited entity. It asks where the printed circuit board was fabricated, where the firmware repository is hosted, whether the rare earth feedstock origin can be disclosed, and whether the source code is auditable by the government on request. And it escalates those requirements on a published schedule through August 2027.

The relationship between the three is a nested hierarchy with an important caveat. NDAA compliance is necessary but not sufficient for Blue List certification. Blue List certification is not the same as DDP framework compliance—a platform on the Blue List may not meet DDP phase requirements. The caveat: DCMA has stated publicly that its intent is to eventually codify the DDP framework as the basis for Blue List certification across all Group 3 and below UAS. When that happens, the three tiers collapse into one—and that one will look like the DDP framework, not the current Blue List standard.

THE LOGIC OF THE DDP FRAMEWORK

The DDP framework is organized around thirteen component areas, each with requirements at four levels: Phase 2 minimum (August 2026), Phase 2 preferred (August 2026), Phase 3 minimum (February 2027), and Phase 4 minimum (August 2027). The structure is deliberate: what is “preferred” in one phase becomes the “minimum” in the next. Companies meeting preferred standards now are effectively pre-compliant for the following phase.

The framework’s core concept is “non-covered country” sourcing. Covered countries are primarily China, Russia, North Korea, and Iran. NCC assembly, printed circuit board fabrication, electronic components, irmware repository hosting—these are the categories of requirement that progress from optional to mandatory across the phase structure. The framework identifies where Chinese manufacturing dominance is so concentrated that non-covered-country alternatives do not yet exist at scale, and where the program is betting that sustained buying commitments will cause them to emerge.

THE CRITICAL CHOKEPOINTS: MOTORS, BATTERIES, AND FLIGHT BRAINS

Three component areas carry the heaviest industrial policy weight in the document because they represent the areas of deepest Chinese supply chain dominance.

Motors are the most acute near-term problem. The document notes that more than 85 percent of magnet manufacturing was concentrated in China pre-2020, and the situation has not materially improved. The Phase 2 minimum (August 2026) requires NCC motor assembly and specialty metals compliant with 10 USC 4863. Phase 2 preferred adds a DFARS-compliant magnet sourcing plan—meaning the company must document a path to non-Chinese magnets even if it has not yet achieved it. Phase 3 minimum requires NCC motor assembly, magnet production, and winding, with disclosed rare earth feedstock origin. The rare earth dimension matters because China controls the dominant share of global rare earth processing even for feedstocks mined elsewhere; disclosure of origin is a prerequisite for verification of compliance.

Batteries present a problem structure where the DDP framework runs meaningfully ahead of the statutory curve. The statutory battery restrictions—the FY24 NDAA Section 805 direct contracting bar effective June 30, 2026, and the FY24 NDAA Section 154 direct CATL battery procurement ban effective October 1, 2027—set a floor that the DDP framework exceeds at every phase. Phase 2 minimum (August 2026) already requires NCC pack assembly and exclusion of Section 1260H-listed entities including CATL. Phase 2 preferred adds NCC battery management system assembly and PCB, with firmware source code repositories not hosted in covered countries. Phase 3 minimum (February 2027) requires NCC cells meeting Section 842 of the FY26 NDAA—eight months before the statute’s own CATL battery ban takes effect. Companies that wait for the statutory deadlines to drive their battery supply chain decisions will arrive at every DDP phase out of compliance.

Flight controllers—including processor, IMU, sensors, and PCB—are where the framework’s cyber requirements intersect most directly with the supply chain requirements. The wiped chips, counterfeit parts, and firmware vulnerabilities that DCMA’s teardown process has been surfacing are largely a flight controller and communications stack problem. The DDP framework’s Phase 2 minimum requires NCC assembly, ASDA-compliant sourcing, and no Section 889 components. Phase 2 preferred adds NCC PCB fabrication and the requirement that firmware source code repositories not be hosted in or administered from covered countries—directly addressing the firmware manipulation vulnerabilities DCMA’s cyber assessors have documented. Phase 4 minimum elevates this to require that firmware repositories be hosted and controlled by a U.S. entity and be auditable on request.

THE GROUND CONTROL STATION PROBLEM

Component Area 11—the ground control system, including hardware, software, hand controller, PCB, and encryption modules—maps directly onto one of the most concrete findings from DCMA’s Blue List teardown work: GCS hardware and goggles arriving from China, technically satisfying line-item checks while failing the underlying intent of the standard.

This is a case study in why the three-tier distinction matters. A GCS sourced from China may clear the NDAA bar if the specific manufacturer is not on a prohibited entity list. It may survive initial Blue List review if the line-item compliance check does not catch the origin of the goggles subset. But under the DDP framework’s Phase 2 minimum, the same GCS fails: NCC assembly is required, no Section 889 components, electronics from original component manufacturers or authorized distributors only. Phase 3 minimum requires that all GCS software repositories be hosted and controlled by a U.S. entity auditable on request—a standard the NDAA does not currently mandate.

GNSS, COMMUNICATIONS, AND THE SEMICONDUCTOR LAYER

The GNSS module (Component Area 3) intersects with the broader semiconductor policy landscape. Section 5949 of the FY23 NDAA restricts procurement of electronic products containing semiconductors from specific covered entities—including SMIC, ChangXin Memory Technologies, and Yangtze Memory Technologies—with a proposed implementing FAR rule published February 17, 2026, and a statutory effective date of December 23, 2027. Section 853 of the FY25 NDAA separately prohibits DoD from procuring semiconductor products and services from companies that knowingly supply them to Huawei and its affiliates. The DDP framework’s Phase 2 preferred standard for GNSS requires NCC PCB fabrication and firmware repositories not hosted in covered countries, with Phase 3 minimum requiring NCC receiver modules—requirements the program is driving ahead of the broader statutory timeline. The communications and data link stack (Component Area 2) follows similar progression logic, with encryption module sourcing added at Phase 3—NCC sources for any COMSEC-grade communications hardware, with comms firmware repositories hosted and controlled by U.S. entities auditable on request.

WHAT COMPANIES SHOULD ACTUALLY DO WITH THIS

For companies currently on the Blue List, the key question is whether their platform meets DDP Phase 2 minimums—not just Blue List standards—because DCMA has signaled that the DDP framework is the destination toward which Blue List certification is moving. DCMA has committed to publishing transition timelines in advance, but Phase 2 minimum standards take effect August 2026. That is not a distant deadline, and battery supply chain remediation in particular has lead times that make waiting for the August trigger date a losing strategy.

For companies not yet on the Blue List and considering entry, the more useful engineering target is DDP Phase 2 preferred, not Blue List minimum. A system that clears Phase 2 DDP preferred is likely to clear Blue List certification and is pre-positioned for Phase 3 eligibility. A system engineered only to clear the current Blue List standard may find itself on the list but ineligible for the program that represents $1.1 billion in advanced market commitment.

For investors, the framework’s component-level gap analysis is the most explicit public document available describing where domestic production capacity does not yet exist. Rare earth magnet processing outside China, NCC drone motor winding, non-CATL lithium-ion cell manufacturing at competitive volume, NCC GNSS receiver modules with relevant performance specifications—these are not abstract supply chain concepts. They are dated procurement commitments: meet this standard by this phase, and there are purchase orders behind it. The program is not waiting for the law to catch up. The companies and investors that move on the DDP timeline, not the statutory timeline, are the ones the program is designed to reward.