Critical components should be identified, justified, and documented on a risk-based basis.
Critical Component Definition and Qualification Scope
Criticality is function-based, not determined by a fixed count of qualified suppliers. Components whose failure could result in a hazardous situation must be used according to their specified ratings and included in the risk-management process [S4]. The same component can therefore be critical in one design and non-critical in another.
A plastic enclosure can be critical when it provides solid insulation or supports required creepage distances and air clearances, but decorative use removes that basis.
For defense-linked programs, upstream evidence may extend beyond the prime contractor to tier 1 and sub-tier manufacturers, raw-material origin, ownership, manufacturing capability, capacity, concentration, and foreign dependencies [S3].
One Source Can Qualify, but One Name Is Not Enough
A qualified source is a uniquely identified and technically acceptable supplier, not merely a vendor appearing on an approved-vendor list.
Qualification requires more than a purchase order and a certificate. Components serving as means of protection must be assessed under their conditions of use and may require testing under IEC 60601-1 or an appropriate component standard [S4].
Three linked records should exist before the source is accepted: the approved part and manufacturer identity, the applicable rating or specification, and objective evidence demonstrating conformity.
Two Sources Are the Practical Resilience Target
The decision criteria are interruption exposure, qualification burden, technical interchangeability, and evidence completeness. Suppliers exposed to defense supply-chain requirements should consider alternatives and organize evidence concerning products, suppliers, materials, ownership, and manufacturing [S3]. [S4]
Alternative sourcing is not complete when a second supplier is identified. Tooling, technical data, testing, capacity, quality approval, and qualification determine whether that supplier can actually support production [S3].
Critical Components by Failure Consequence
The proper scope includes mechanical, thermal, structural, and electrical elements, not only electrical parts [S2]. Medical-device examples include isolation barriers such as optocouplers and transformers, fuses and protective circuits, safety-function sensors, watchdog integrated circuits, and components with a direct patient-protection role [S4].
Failure consequence drives the qualification depth. A mains fuse or isolation barrier requires ratings, test evidence, and inspection controls matched to its protective function. A decorative enclosure needs component-family approval but not the same failure-mode evidence. A motor serving only a non-safety function may require specification conformity and supplier controls, while a motor driving a life-support function may also require reliability, fault-response, and operating-condition evidence.
Safety-relevant components should be identified by considering whether their characteristics relevant to safety are known and whether their failure could result in a hazardous situation [S4]. This functional test is more defensible than assigning criticality by component category alone.
Qualification Evidence and Supplier-Control Requirements
Documented evidence must cover the component itself, its manufacture, and its role in the finished system. A manufacturer should verify that the part behaves according to specification and that the specification itself is correct, because a properly manufactured part can still be unsuitable for its assigned function [S4].
For supplier-controlled items, incoming inspection can target subcomponents or externally sourced content. Quality agreements can require end-of-line testing, while supplier audits establish audit frequency and evaluation criteria. Dependency controls can include contractual obligations, guaranteed supply terms, defined quality levels, delivery commitments, and qualified alternatives [S4].
Traceability remains essential throughout these controls. California regulation Title 17, Section 95670 requires critical components to be clearly identified in documentation submitted to the California Air Resources Board to confirm that the components belong to a critical process [S6]. In defense supply chains, the required data may move upward from prime contractors to tier 1 suppliers and component manufacturers, so records must be structured for retrieval rather than storage [S3].
Limits, Failure Modes, and Suitable Users
A fixed numerical mandate is unsuitable for all critical components. The 1-source minimum reflects the need for controlled accountability; it does not remove the operational need for continuity. Overlapping source claims without separate qualification can create false redundancy, while excessive source multiplication increases incoming-inspection burdens, change-control complexity, and requalification work. [S1]
Critical-source governance is for manufacturers, regulated-product engineers, quality teams, and procurement personnel who must connect design records, risk controls, test evidence, and supplier performance. It is not a substitute for incoming inspection, production acceptance testing, or the assessment of counterfeit and materially nonconforming parts.
Supply-chain requirements also vary by sector. ISO 14971 and IEC 60601-1 support medical-device risk and safety assessment [S4], while Executive Order 14415 can extend mapping and evidence requests to commercial or dual-use suppliers when their products enter selected national-defense supply chains [S3]. Dual-use status alone does not establish coverage under that order [S3].
How to Set the Source Count
[S2]