Aerospace and Defense Supplier FAQ

It is the set of documents that ships with aerospace parts to prove they meet the purchase order. A typical package includes a certificate of conformance, material certifications such as mill certs, certifications from any outside special processors, inspection records and, when the PO calls for it, a first article inspection report. Buyers check the package at receiving inspection, and a missing or mismatched document can hold up acceptance even when the parts are perfect.

A certificate of conformance, or C of C, is the supplier's written statement that the parts shipped meet the purchase order and drawing requirements. It usually lists the part number, revision, quantity, PO number and applicable specifications. An authorized person at the supplier, often in quality, signs it. Because it is a formal statement, signing a C of C for parts that do not conform is a serious matter, so treat it as more than a form.

AS9100 includes all of ISO 9001 and adds requirements specific to aviation, space and defense, such as configuration management, product safety, counterfeit part prevention, first article inspection and tighter control of external providers. A shop certified to ISO 9001 already has much of the structure. Moving to AS9100 means adding those aerospace requirements and passing an audit by a certification body accredited for the aerospace scheme.

Most will look you up in the IAQG OASIS database, which lists organizations certified under the IAQG scheme along with certificate scope and status. Certification bodies treat OASIS as the reference, so an organization missing from it may not be treated as certified. Check your own listing once a year to make sure your scope, address and status are correct, because buyers will see exactly what OASIS shows.

A CAGE code is a five-character identifier for companies doing business with the federal government, used heavily in defense purchasing, and you can look codes up at cage.dla.mil. You do not apply for it on its own. The Defense Logistics Agency assigns it as part of your SAM.gov registration, which also issues your Unique Entity ID. SAM.gov registration is free and must be renewed every 365 days to stay active.

Under 22 CFR 122.3, new registrants pay a Tier 1 fee of $3,000 per year. Renewing registrants who received five or fewer favorable determinations on license applications in the review period pay $4,000 under Tier 2. Above five, Tier 3 is $4,000 plus $1,100 for each favorable determination over five. See the ITAR registration page for who has to register.

Controlled Unclassified Information is government information that requires safeguarding but is not classified. In defense subcontracting it often arrives as drawings, specifications or technical data marked as CUI by the government or the prime. If your purchase order includes DFARS 252.204-7012 or the drawings carry CUI markings, assume you are handling CUI and ask your buyer to confirm. CUI brings NIST SP 800-171 and CMMC Level 2 into play.

The DFARS rule implementing CMMC took effect on November 10, 2025, starting a four-phase rollout. Phase 1 focuses mainly on self-assessments. Phase 2, which would have added Level 2 third-party certification on November 10, 2026, was suspended on July 13, 2026 pending a task force review, so check the DoD CIO CMMC page for the current status of applicable solicitations and contracts. All applicable contracts are scheduled to include CMMC requirements by November 10, 2028. Your buyer can still flow requirements down earlier.

The Supplier Performance Risk System is a Department of Defense system where contractors post cybersecurity assessment results, among other supplier data. Under DFARS 252.204-7019, a contractor handling CUI needs a current NIST SP 800-171 assessment score in SPRS, generally no more than three years old unless the solicitation asks for a more recent one. CMMC self-assessment results and affirmations are also posted there.

Often, but not always. Many primes require Nadcap accreditation for special processes such as heat treating, chemical processing and NDT, while others accept their own process approval for some work. Nadcap is administered by the Performance Review Institute and uses one industry-agreed audit reviewed by task groups of primes, government and suppliers. Check each buyer's quality clauses before you assume either way.

A flow-down is a requirement your customer passes to you, and that you in turn must pass to your own suppliers. It can be a quality clause, a cybersecurity clause such as DFARS 252.204-7012, export control restrictions, or customer-specific requirements. AS9100 requires buyers to communicate requirements to external providers and expects them to reach sub-tier suppliers. If you outsource plating, the plater usually inherits the relevant requirements.

Not without an export authorization. Under 22 CFR 120.50, releasing technical data to a foreign person inside the United States is a deemed export, even inside your own building. Most small shops handle this by limiting ITAR jobs and drawings to US persons and controlling who can see screens, prints and files. If you need non-US employees on controlled work, talk to an export control attorney about licensing before they touch the data.

Large federal prime contractors on contracts above the FAR threshold must submit small business subcontracting plans with goals for small, veteran-owned, service-disabled veteran-owned, HUBZone, small disadvantaged and women-owned small businesses. The threshold rose from $750,000 to $900,000 on October 1, 2025, and $2 million for construction. Primes report progress against those goals, so a qualified small supplier can help them meet commitments.

Every supplier signs a flow-down NDA before seeing customer data, and suppliers do not learn the end customer unless that customer approves. ITAR, EAR and CUI data never moves through the website. Controlled data moves only by secure transfer, and only to US persons. That keeps your shop clear of data you should not be receiving and gives buyers confidence in the chain.

No. Aerospace Sourcing is a new sourcing service and does not promise any volume of RFQs or guaranteed work. We review every supplier signup and contact the supplier when a buyer's request fits their capabilities. The more accurately you describe your equipment, processes, materials and certifications, the easier it is for us to recognize a fit.

Yes. At signup you can choose to receive RFQs as a supplier, sell certified surplus material, list spare test lab or cleanroom capacity, win subcontracts from primes as a small business, ask for help getting ready for CMMC, or request early access to quality paperwork software for first article inspection, certificates of conformance and traceability. Signing up is free.