Commercially available information: use the amended ODNI framework in supplier research

A commercial data supplier selling to a US intelligence customer faces several different questions at once. What information is being offered? Where did it originate? What rights can the supplier grant? What authority does the customer have to access and use it? A positive answer to one question does not settle the others.

The public policy record helps explain why an interested analyst may need colleagues from several functions involved in a purchase. It also reveals which factual product information a vendor can prepare before those discussions begin. The relevant starting point is the Intelligence Community memorandum published with a February 2025 technical amendment, rather than the earlier May 2024 framework alone.

Establish which document the customer is using

The amended memorandum expressly replaces the May 2024 framework. The underlying memorandum was signed on 17 December 2024; the published file includes the subsequent technical amendment. Its provisions concern Intelligence Community elements' access to, collection and processing of commercially available information.

The May document remains a useful historical source. It set out the concern that commercially aggregated information can carry substantial privacy and civil-liberties implications, and established a common approach to governance. A research note that cites it should identify its place in that sequence.

The later memorandum also sits alongside agency-specific requirements and implementing guidance. It is not a universal permission for every government customer to purchase every commercial dataset. The customer must determine the rules and authority that apply to its particular activity.

For a vendor, document versioning is therefore part of accurate account research. A slide copied from an older sales presentation may omit a superseding source. Keeping the exact document identity with a customer opportunity avoids treating a general policy summary as the final acquisition requirement.

Describe the actual information being sold

A product label such as “commercial intelligence” can hide materially different offerings. One service may index public corporate filings. Another may combine a company's original research with licensed third-party datasets. A third may sell access to a software environment while the customer supplies the information.

Those distinctions affect the evidence the customer needs. A supplier of a filing index can describe the public records covered, update frequency, historical coverage and transformations applied. A reseller also needs to make its own role and source relationships clear. A platform vendor should identify which information it provides itself and which information merely passes through its software.

The memorandum distinguishes commercially available information generally from a defined sensitive category. It includes exclusions from that category for specified published material and public records, while retaining the application of other relevant laws and policies. A supplier should not turn those exclusions into a blanket assertion that any database with some public content is exempt.

BDI's interpretation is straightforward: describe the contents before arguing about the category. Clear product facts give the customer's reviewers a usable basis for their decision. Broad assurances about being publicly available provide much less help when the offering combines several types of information.

Several customer functions may assess the same purchase

The framework describes participation by privacy and civil-liberties officials, oversight staff, legal counsel, information officers and other relevant functions, as appropriate. For sensitive commercially available information, the assessment spans mission need, authority, sensitivity, risks, source integrity and safeguards.

That structure explains why the analytical champion and the purchasing decision may be separated by substantive work. An analyst can identify a useful product without being responsible for every approval involved in acquiring it. The supplier should understand which questions require factual answers from the company and which decisions belong to the customer.

A practical product description can support several reviewers at once. The same account of source origins may help an analyst judge reliability, a commercial team understand licence scope and an information officer understand the proposed handling arrangement. The description should remain consistent across those conversations.

This does not mean creating a generic claim of compliance for all agencies. It means reducing ambiguity about what is being proposed. A customer-specific decision still depends on its own requirements, applicable authority and assessment of the actual information and intended use.

Provenance is more than a list of providers

The memorandum's attention to source quality and integrity makes provenance a commercial issue. The customer needs to understand how information was generated or aggregated and whether the resulting product contains material limitations, biases or inferences.

For a company-research product, a useful distinction might be between a figure reported in a company's annual filing and an estimate created by the supplier. Both can appear in one interface, but presenting them identically makes the evidence harder to evaluate. This is a hypothetical product example, not a prescribed government interface.

The same issue arises when source material changes. A corrected filing, revised publication or replaced dataset can affect an earlier analytical conclusion. A provider able to explain which version supported a result gives the customer more useful evidence than a source link that always resolves to the newest page.

Our analysis of OSINT provenance and analytical standards examines these product choices in more detail. The core distinction is between permission to use information and confidence in a conclusion drawn from it. A licence supplies no guarantee that an inference is accurate or complete.

The proposed system arrangement matters

The framework addresses information retained or processed in Intelligence Community and contractor systems, as well as access involving commercial vendor repositories. Its treatment of sensitive information includes system authorisation and privacy controls, with attention to the risks associated with vendor architecture and access.

For a commercial team, this makes delivery architecture part of the offer. A hosted research service, an exported dataset and an analytical report create different arrangements. Describing them simply as a subscription obscures where the information resides, who supports it and what the customer receives.

Product managers can make that distinction visible without claiming that a particular architecture satisfies an agency's requirements. A proposal can identify the supplied components, supported delivery methods and administrative responsibilities. The customer can then assess the arrangement in its institutional context.

This is especially relevant when a product changes during a sales process. Adding a new external data source or moving a function into a different service can change the facts on which the customer is evaluating the offer. Accurate change communication is more useful than treating the original demonstration as a permanent description of the product.

Rights and lifecycle expectations shape adoption

The memorandum includes documentation and review across the information lifecycle, including the source, intended uses, handling arrangements and applicable licence restrictions. It also anticipates reassessment of whether sensitive information should be retained and whether safeguards remain appropriate.

These provisions connect the initial sale to ongoing service responsibilities. A subscription renewal, a change in source access or the end of a service can affect what the customer expects to retain. The commercial discussion should distinguish continued access to the vendor's application from whatever rights apply to previously delivered material.

The August 2026 GAO commercial-space-data audit offers an adjacent example of adoption friction. It found concerns involving licensing and continued access among the organisations it examined. Our coverage of those findings explains why a government purchase and confident use by prospective users are different milestones.

The OSINT strategy for 2024–2026 adds a further commercial context: coordinated acquisition and sharing are explicit objectives. A provider pursuing that market should be able to explain its information and rights at an institutional level, beyond a demonstration for a single user.

The amended framework is therefore useful supplier research because it reveals the questions behind the transaction. Commercial availability describes the input. The customer's authority, the agreement's scope and the quality of the resulting analysis each require their own evidence.