Key Takeaways
- ITAR registration under 22 CFR 122.1 is a legal requirement for any U.S. supplier manufacturing USML items, and it does not replace quality certifications such as AS9100D.
- Procurement teams reduce program risk by verifying active DDTC registration, AS9100D certification and process capability before awarding controlled aerospace work.
- Full traceability from raw material certifications through every operation to final inspection prevents audit findings and airworthiness issues.
- Suppliers that demonstrate scaling capability, cybersecurity controls and documented transition plans help programs move from prototype to full-rate production with less risk.
- Precision Advanced Manufacturing offers AS9100D, ISO 9001:2015 and ITAR-registered capabilities with full traceability; request a quote to qualify the next aerospace program.
Why ITAR Registration Matters for Aerospace and Defense Programs
Aerospace programs stall when suppliers fail compliance checks in the middle of production. A single unqualified shop can halt deliveries, trigger audit findings and expose programs to penalties. The seven-step qualification process below verifies legal compliance and operational capability before any controlled work begins.
22 CFR 122.1 requires any U.S. person who manufactures defense articles, even on a single occasion, to register with the Directorate of Defense Trade Controls (DDTC). Registration applies whether or not any item is exported. For aerospace programs, any machine shop cutting, machining or fabricating parts that appear on the United States Munitions List (USML) must hold active DDTC registration before handling controlled work.
ITAR registration is not a quality certification. It functions as a legal precondition and does not confer export rights. Every controlled transaction still requires separate authorization. The seven steps below define a complete approach to qualifying an ITAR compliant aerospace machining supplier.
Step 1: Verify ITAR Registration and DDTC Status
Active DDTC registration is the threshold criterion for any ITAR machining supplier. A shop without it cannot legally manufacture USML items.
Actions to take:
- Request the supplier CAGE Code and verify active registration at DDTC.state.gov. This confirms legal authority to handle USML items.
- Confirm the registration is current and matches the facility that will perform the work.
- Ask for the DS-2032 Statement of Registration and confirm a senior U.S. person officer signed it to establish accountability.
- Confirm the supplier has designated an Empowered Official and maintains a formal ITAR Compliance Manual that governs daily operations.
Red flags:
- Lapsed registration or records that show a different operating address.
- Inability to produce the DS-2032 or identify the Empowered Official.
- Undisclosed foreign ownership or control on the registration form.
Step 2: Confirm AS9100D and Supporting Quality Certifications
ITAR registration confirms legal authority, and AS9100D confirms that a structured aerospace quality system exists. Major aerospace OEMs treat AS9100D as a minimum qualification standard for Tier 2 precision machining suppliers.
Actions to take:
- Request current AS9100D and ISO 9001:2015 certificates with scope statements and expiration dates.
- Confirm the certifying body is accredited and the scope covers processes relevant to the program.
- Ask whether NADCAP accreditation applies when the program requires special processes such as heat treatment, chemical processing or non-destructive testing.
Red flags:
- Certificates that are lapsed, out of scope or issued by unaccredited bodies.
- Absence of a documented corrective action process or internal audit schedule.
- Missing NADCAP accreditation when special processes appear on the drawing.
Step 3: Check Tolerance, Material and Process Capability
Certification confirms a quality system. Capability assessment confirms the shop can meet specific program requirements at the machine and process level.
Actions to take:
- Provide representative drawings and request a formal capability review against stated tolerances.
- Confirm multi-axis CNC machining, fabrication and finishing capabilities align with program geometry and material requirements.
- Ask for documented process capability data or first article results from comparable work.
- Verify that in-house engineering and CNC programming support exist to improve manufacturability before production begins.
Red flags:
- A supplier that accepts drawings without a formal contract review covering tolerances, materials and flow-down requirements.
- Suppliers that hide print, tolerance or delivery risks during quoting instead of escalating them early.
- No documented setup sheets or tooling strategies for repeat production.
Step 4: Confirm Traceability and Documentation Systems
Aerospace programs depend on an unbroken traceability chain from raw stock Material Test Reports through every operation to the final certificate of conformance. Documentation gaps often drive audit findings and airworthiness directives.
Actions to take:
- Confirm the supplier maintains raw material certifications with heat and lot numbers tied to each job.
- Verify job travelers capture operator identification, machine allocation, in-process inspection records and revision control at every stage.
- Request a sample AS9102 First Article Inspection Report using Forms 1, 2 and 3 with actual measured values recorded for every drawing characteristic.
- Confirm outside-process documentation such as anodizing, plating and heat treat is traceable to each specific job.
- Verify record retention meets the five-year minimum required under 22 CFR 122.5 for ITAR-related records.
Red flags:
- Traceability records stored only at the general supplier level instead of tied to individual jobs.
- FAIRs that record nominal values instead of actual measured values.
- No documented nonconformance handling or root cause analysis process.
Precision Advanced Manufacturing operates under AS9100D, ISO 9001:2015 and ITAR-registered quality systems with full traceability across materials and processes on every job. Request a quote to review program documentation requirements.
Step 5: Verify Scaling Capability from Prototype to Production
Volume growth exposes weaknesses in CNC suppliers. Prototype success does not confirm readiness for sustained production.
Actions to take:
- Ask whether the supplier supports multi-shift production and confirm available capacity against program volume requirements.
- Verify that setups are documented and repeatable by multiple operators, not dependent on individual machinists.
- Confirm the supplier has transitioned comparable programs from prototype to full-rate production without a supplier change.
- Assess scheduling transparency and confirm quoted lead times reflect actual capacity.
Red flags:
- No documented production setup sheets or tool life management records.
- Capacity commitments that do not align with shift schedules or machine utilization data.
- A supplier with only prototype history and no sustained aerospace production record.
Step 6: Review Cybersecurity, CAGE and Access Controls
ITAR compliance extends into physical security, digital security and access control. Registrants must screen employees and visitors, maintain visitor logs, restrict access and verify nationality before granting access to controlled areas or data.
Actions to take:
- Confirm the supplier maintains a written Technology Control Plan that covers physical security, digital access and foreign-person screening protocols.
- Verify visitor logs for controlled areas are maintained and reviewed.
- Assess cybersecurity posture against NIST SP 800-171 requirements when the program involves Controlled Unclassified Information.
- Confirm the CAGE Code is current and matches the registered facility performing the work.
- Ask whether the supplier is pursuing or holds CMMC Level 2 certification when CUI handling is required, since C3PAO-assessed certification is required for CUI on defense aerospace programs.
Red flags:
- No Technology Control Plan or informal access controls that rely on verbal agreements instead of documented procedures.
- Foreign persons with uncontrolled access to ITAR-controlled drawings or technical data.
- No System Security Plan or Plan of Action and Milestones for NIST SP 800-171 controls.
Step 7: Plan Supplier Transition and Score Final Risk
Supplier transitions during a program introduce compliance and schedule risk. A structured transition plan and objective risk score reduce both.
Actions to take:
- Require complete documentation transfer including drawings, material certifications, process records and open nonconformances from the outgoing supplier.
- Plan a pilot build or validation run before full-rate production transfer to confirm that new supplier outputs match qualified part history.
- Score the supplier against each checklist step using an objective rating of verified, conditional or disqualifying before awarding work.
- Confirm the supplier can provide engineering support during transition to resolve manufacturability questions without program interruption.
Red flags:
- A supplier unwilling to perform a pilot build before full-rate transfer.
- Gaps in documentation transfer that break the traceability chain for parts already in service.
- No defined escalation path for nonconformances discovered during the transition period.
Tracking Supplier Performance After Qualification
Qualification establishes a baseline. Ongoing performance measurement protects programs from supplier drift and emerging risk.
Objective indicators to track:
- First-pass yield rate, measured as the percentage of parts accepted without rework or rejection at incoming inspection.
- On-time delivery performance measured against purchase order due dates, not ship dates.
- FAIR acceptance rate, measured as the percentage of first article inspection reports accepted without major findings on the first submission.
- Corrective action response time and closure rate for nonconformances.
- Audit findings trend across successive supplier audits.
Supply pressure environments increase the risk of unapproved or non-compliant parts entering the aerospace supply chain, so active supplier monitoring functions as a core program risk management practice.
Frequently Asked Questions
How long does ITAR registration take and what are the annual costs?
DDTC registration processing typically takes 30 to 60 days after a complete DS-2032 submission through the DECCS portal, with possible extensions when foreign ownership or USML classification questions arise. The base annual registration fee is $3,000 for new registrants and most renewing manufacturers at the Tier 1 level. First-year total compliance costs cover the registration fee, USML classification review, Empowered Official training, compliance program documentation, recordkeeping setup and an internal audit. Year-two costs often decrease once foundational infrastructure is in place. Suppliers should also budget for ongoing obligations including annual risk assessments, employee training and record retention systems covering at least five years of ITAR-related activity.
Is AS9100D required in addition to ITAR for aerospace work?
ITAR registration and AS9100D certification address different requirements and both are typically mandatory for aerospace and defense machining programs. ITAR registration is a legal requirement under 22 CFR 122.1 for any U.S. person manufacturing USML items. AS9100D is a quality management system standard that major aerospace OEMs, including Boeing, Airbus, Lockheed Martin and Pratt & Whitney, require as a minimum qualification criterion for Tier 2 precision machining suppliers. A machine shop that holds ITAR registration but lacks AS9100D certification will not meet the quality system requirements of most aerospace production contracts. Programs involving special processes such as heat treatment or non-destructive testing may also require NADCAP accreditation in addition to both.
What traceability records must an ITAR registered aerospace machine shop maintain?
An ITAR registered aerospace machine shop must maintain two overlapping sets of records. For ITAR compliance, records covering export licenses, technical data transfers, visitor logs for foreign persons and related activities must meet the retention requirements established in Step 4. For AS9100D quality compliance, traceability records must capture raw material certifications with heat and lot numbers, job travelers documenting every operation, in-process and final inspection data, operator identification, machine allocation, revision control and shipment records, all tied to individual jobs rather than retained only at the general supplier level. First Article Inspection Reports must record actual measured values for every drawing characteristic. Outside-process documentation for operations such as anodizing, plating and heat treatment must also be traceable to each specific job.
How should buyers handle mid-program supplier changes while preserving compliance?
Mid-program supplier transitions require a structured handoff to preserve traceability and avoid compliance gaps. Buyers should require complete documentation transfer from the outgoing supplier, including all material certifications, process records, inspection history and open nonconformances. The incoming supplier should perform a pilot build or validation run before full-rate production transfer to confirm that process outputs match the qualified part baseline. Engineering support during the transition period helps resolve manufacturability questions without interrupting the program schedule. Buyers should also verify that the incoming supplier ITAR registration, AS9100D certification and cybersecurity posture are confirmed before any controlled technical data is transferred. Precision Advanced Manufacturing provides complete documentation, material traceability and engineering support to make supplier transitions straightforward, beginning with pilot builds that reduce program risk.
Lower Program Risk with a Qualified ITAR Aerospace Machine Shop
The seven-step checklist above gives procurement, program and supplier quality teams an objective framework for qualifying an ITAR compliant aerospace machining supplier. Each step, from verifying active DDTC registration to scoring transition risk, addresses a documented source of program delay, compliance failure or cost overrun.
Precision Advanced Manufacturing holds AS9100D and ISO 9001:2015 registrations and is ITAR registered across two specialized facilities in California and Texas. The company delivers advanced multi-axis CNC machining, precision metal fabrication, specialty welding and integrated finishing under certified quality systems with full traceability on every job. Operations support prototype development through multi-shift, full-rate production so programs can scale without a supplier change or a break in the compliance record.
Procurement teams that need a supplier meeting every criterion on this checklist can rely on Precision Advanced Manufacturing as a qualified partner. Request a quote to begin the evaluation.
