Counterfeit Prevention What Makes a Good Control Plan

Counterfeit Prevention What Makes a Good Control Plan? LOCKHEED MARTIN PROPRIETARY INFORMATION

What is the Purpose of a Control Plan? • The primary purpose of a counterfeit prevention control plan is to: ü Describe processes for preventing counterfeit products from entering the supply chain or products ü Describes WHAT is done ü Reference procedures describing HOW it is done • A method to assure that all critical elements of a prevention program are incorporated and complete • Allow a customer to review what the suppliers processes are without disclosing proprietary information • Can be used to guide an auditor during a counterfeit prevention survey or surveillance activity What Makes a Good Counterfeit Prevention Control Plan 2

Industry Standards Control Plan Requirements • Control plans were first required with the publication of industry counterfeit mitigation standards Ø AS 5553 for electronic parts Ø AS 6174 for all other materials • From AS 5553 C: 3. 1 Counterfeit EEE Parts Control Plan The organization shall develop and implement a risk-based counterfeit EEE parts control plan that documents its processes used for risk identification, mitigation, detection, avoidance, disposition, and reporting of suspected counterfeit or counterfeit EEE parts and/or assemblies containing such EEE parts. The control plan shall include the processes described in 3. 1. 1 through 3. 2. • From AS 6174 A 3. 1 Materiel Authenticity Assurance Plan The organization shall develop and implement a materiel authenticity assurance plan that documents: (a) its processes used for assuring that only authentic and conforming materiel is procured from legally authorized sources, and (b) its planning to be used for risk mitigation, disposition, and reporting in the event any counterfeit materiel is encountered in its supply chains. The control plan shall include the processes described in 3. 1. 1 through 3. 1. 7. What Makes a Good Counterfeit Prevention Control Plan 3

MFC Purchase Order Note Requirement Text Note MFC-PR-003 is auto flowed on all PO’s. • Counterfeit Prevention Processes: • Seller shall develop and implement a counterfeit product control plan using AS 5553 for electronic parts and AS 6174 for all other material. • The plan shall be available for the Buyer review upon request. • The Seller's counterfeit avoidance and detection systems are subject to Buyer and/or Buyer's customer audit and approval. What Makes a Good Counterfeit Prevention Control Plan 4

Control Plan Organization It is recommended that: • The control plan align with the customers specification requirements Ø Ø AS 5553 AS 6174 DFARS 252. 246 -7007 Other • Allows the user to easily correlate the requirement to the process • Allows the user to quickly see if all requirements have been addressed What Makes a Good Counterfeit Prevention Control Plan 5

Control Plan Elements • DFARS 252. 246 -7007 System Criteria 1. Training 2. Inspection and test 3. Processes to abolish 4. Traceability 5. Procurement controls 6. Reporting and quarantining 7. Identification and evaluation of suspect counterfeit 8. Systems to detect and avoid (e. g. AS 5553) 9. Flow-down 10. Process to keep informed 11. Process for screening GIDEP report 12. Control of obsolete electronic parts What Makes a Good Counterfeit Prevention Control Plan The preferred approach is alignment with the DFARS criteria. If this does not align well with your products then one of the other two standards can be used. 6

Control Plan Elements AS 5553 Requirements AS 6174 Requirements 1. Counterfeit EEE Parts Control Plan 2. Personnel Training 3. EEE Parts Availability 4. Purchasing Process 5. Purchasing Information 6. Verification of Purchased EEE Parts 7. Investigation 8. Material Traceability and Control 9. Reporting 10. Auditing 1. 2. 3. 4. 5. 6. 7. 8. What Makes a Good Counterfeit Prevention Control Plan Materiel Authenticity Assurance Plan Authentic and Conforming Materiel Availability Purchasing Information Verification of Purchased Product In-Process Investigation Materiel Control Reporting 7

Minimum Control Plan Elements Topic AS 5553 AS 6174 DFARS 7007 Training X X Obsolescence X X X Purchasing Process X X X Purchasing Information X X X Verification of Purchased Product X X X Investigation X X X Material Traceability and Control X X X Reporting X X X Audit X Note – this is not all the topics in the DFARS but is sufficient for the plan What Makes a Good Counterfeit Prevention Control Plan 8

Suggested Table of Contents 1. Purpose 2. Applicability 3. Referenced Documents i. Industry ii. Government iii. Company 4. Definitions 5. Implementation i. Plan ii. Training iii. Etc. From AS 5553 6. Revision Record Sections/Subparagraphs added as appropriate What Makes a Good Counterfeit Prevention Control Plan 9

“Purpose” Section Example The purpose of this plan is to describe processes for the prevention, risk mitigation, detection, control, communications, and reporting of suspect counterfeit, or confirmed counterfeit parts. Commodities affected include electrical, electronic, and electromechanical parts (EEE) and hardware, mechanical, and raw material. This plan standardizes practices to: 1. Develop risk management plans for to prevent the procurement of suspect counterfeit or counterfeit parts 2. Maximize availability of authentic parts by procuring parts from authorized sources 3. Develop and provide adequate testing and inspection to determine suspect part status 4. Establish receiving, inspection, containment and communication requirements of suspect commodities to prevent counterfeit or fraudulent parts from entering the supply chain. Descriptions contained in this plan are intended to supplement the requirements of a higherlevel quality standard (e. g. , AS 9100, ISO 9000) and describe the implementation of counterfeit processes detailed in the Quality Management System documents. They are not intended to stand alone, supersede, or cancel requirements found in other quality management system documents, requirements imposed by contracting authorities, or applicable laws and regulations unless an authorized exemption/variance has been obtained. What Makes a Good Counterfeit Prevention Control Plan 10

Implementation Section What Makes a Good Counterfeit Prevention Control Plan 11

Training Requirement • Relevant personnel, including those involved with program management, projects, procurement, quality assurance, inspection, receiving, manufacturing and engineering activities shall be trained as appropriate to their function, in the awareness, avoidance, detection, mitigation and disposition of suspect or confirmed counterfeit parts. Topics • Appropriate personnel are identified for training and periodic training given • Training addresses awareness, avoidance, detection, mitigation and disposition of suspect or confirmed counterfeit EEE parts relevant to the responsibilities and authorities for the activities of the personnel • Training records maintenance of training records • Training updated periodically addressing changes in counterfeit information and trends • Reference QMS implementation procedures What Makes a Good Counterfeit Prevention Control Plan 12

Obsolescence Requirement • Control of obsolete electronic parts in order to maximize the availability and use of authentic, originally designed, and qualified electronic parts throughout the product’s life cycle. Topics • • Processes are managed Obsolete part issues are mitigated Design part selection process does not choose parts that are about to become obsolete Reference QMS implementation procedures What Makes a Good Counterfeit Prevention Control Plan 13

Purchasing Process Requirement: • The purchasing process should assure that 1. 2. 3. 4. Parts are procured from authorized sources such as the OCM/OEM or their authorized distributors Objective evidence is maintained that the sources are authorized Use industry information, such as GIDEP, ERAI or others, to avoid purchasing from unreliable sources or the purchase of suspect/confirmed counterfeit parts Require a documented risk assessment and risk mitigation process when procuring form other than authorized sources Topics • • • Describe the process for validating authorized sources and what those sources are When other than authorized sources are used, describe how they are assessed and screened to avoid the purchase or use of suspect or confirmed Describe the process to develop a risk assessment/mitigation plan Define the minimum inspection and test requirements used when procuring from other than authorized sources. Reference QMS implementation procedures What Makes a Good Counterfeit Prevention Control Plan 14

Purchasing Information • Requirement • Have documented process that defines contract/purchase order requirement flow down to minimize the risk of being provided counterfeit parts. This includes: 1. 2. • Flow down of applicable counterfeit avoidance and detection requirements to applicable contractors and their supply chain; Flow down a requirement for authorized distributors to disclose if they are not authorized for the parts they are supplying. Topics • • Purchase order review and flow down of appropriate, recognized industry counterfeit prevention standards Reference QMS implementation procedures What Makes a Good Counterfeit Prevention Control Plan 15

Verification of Purchased Product • Requirements: • • The inspection and testing of parts, including criteria for acceptance and rejection. Documented process that verify that risk mitigation is performed and meets acceptance criteria • Topics: • • Identify inspection, testing, and authentication processes and procedures Make documentation of inspection, testing, and authentication available upon request Have risk mitigation plans been executed as required Reference QMS implementation procedures What Makes a Good Counterfeit Prevention Control Plan 16

Investigation • Requirements: • • Methodologies to identify suspect counterfeit work and to rapidly determine if a suspect counterfeit work is, in fact, counterfeit. The documented processes for the investigation shall address the detection, verification, resolution, and control of in-process (post acceptance) and in-service suspected counterfeit or counterfeit work. • Topics: • • • Identify processes (commonly non-conforming product processes) to trigger investigations that would determine whether suspect or confirmed counterfeit work were found. Make investigation documentation available upon request Reference QMS implementation procedures What Makes a Good Counterfeit Prevention Control Plan 17

Materiel Control and Traceability • Requirement: • Risk-based processes that enable tracking of procured work back to an authorized source or mitigated risk prior to acceptance • • • Note: Authorized source/distributor records enable traceability/tracking to the manufacturer (e. g. , OCM/OEM). Enable tracking of procured work back to an mitigated risk plan prior to acceptance when it is required. Permanently render as unusable all suspected counterfeit or counterfeit EEE parts dispositioned for scrap, including the internal elements • Topics: • • Identify processes that the organization maintains to ensure traceability back to the source during the procurement and receiving process Identity processes that provides traceability that identifies parts and/or assemblies to the product(s) affected when suspect or confirmed parts are discovered prior to or after customer acceptance? Describe how the organization ensures suspect or confirmed counterfeit work is physically identified, segregated from known good parts, and placed in quarantine to preclude their use or re-entry into the supply chain Reference QMS implementation procedures What Makes a Good Counterfeit Prevention Control Plan 18