AS9100D ITAR Supplier Quality Documentation: A Buyer’s Guide

Key Takeaways

• Defense and space primes now treat AS9100D certification and ITAR registration as baseline entry requirements for production programs.
• Unified documentation across QMS, ITAR and cybersecurity reduces audit exposure and lowers program risk.
• Procurement teams verify AS9100D status in IAQG OASIS, confirm ITAR registration via DDTC and review TCPs, FAI packages and NADCAP accreditations before award.
• AS9100D flow-down clauses, ITAR technical-data controls and CMMC Level 2 expectations must appear on every purchase order to remain enforceable during DCMA and prime audits.
• Complete AS9102 FAI packages with Forms 1, 2 and 3, plus traceability and record retention aligned to contract requirements, are mandatory for production qualification.
• Precision Advanced Manufacturing maintains AS9100D, ISO 9001:2015 and active ITAR registration with full documentation traceability—request your tailored documentation package for program-specific verification records.

Required QMS and ITAR Records: Documentation Matrix

The following matrix shows core record categories, their purpose, minimum retention expectations and primary verification sources. Actual retention periods follow contract language and applicable regulations.

Record category	Primary purpose	Typical minimum retention	Verification source
AS9100D certificate	Confirms accredited aerospace QMS	Current and two prior versions	IAQG OASIS database
ITAR registration	Authorizes defense articles and technical data	Current registration term	DDTC registrant database by CAGE Code
AS9102 FAI package	Verifies first production configuration and process capability	Life of program plus contract period	Supplier FAI file and prime approval records
Inspection and test records	Demonstrate conformity to drawing and specification	Often 10 years under prime flow-down	Internal QMS records and DCMA audit samples
Calibration certificates	Support measurement traceability to national standards	Life of equipment plus defined period	Calibration provider records and NIST traceability
ITAR technical-data transfer records	Document access and export of controlled data	Minimum five years under 22 CFR § 122.5	ITAR compliance files and DDTC reviews
NCR and CAPA records	Show nonconformance control and corrective action	Commonly seven to 10 years	Internal QMS records and prime audits

Step-by-Step Verification Instructions

Procurement and supplier quality teams follow a structured sequence when confirming supplier status before award.

1. Verify AS9100D certification in IAQG OASIS. Request the supplier certificate and cross-check the certificate number, scope and expiration date in the IAQG OASIS database. Suppliers that claim AS9100D compliance without accredited registration require additional customer review.
2. Confirm ITAR registration at DDTC. Obtain the supplier CAGE Code and search the DDTC registrant database. Registration is a legal prerequisite under 22 CFR Part 122 for companies that manufacture defense articles.
3. Request the Technology Control Plan summary. Confirm the TCP covers facility access, IT security segmentation, foreign visitor protocols and ITAR officer designation.
4. Review the AS9102 FAI package. Confirm Forms 1, 2 and 3 are present, signed and traceable to the current drawing revision.
5. Check NADCAP accreditation for special processes. Verify current accreditation at PRI NADCAP for any chemical processing, heat treatment or NDT on the drawing.
6. Audit common triggers. Focus on calibration certificate dates, SCCP procedures and CoCs that omit engineering revision, which appear frequently in DCMA and prime audits per AS9100D auditor guidance.

AS9100D Flow-Down Clauses on Purchase Orders

Flow-down clauses extend regulatory and quality obligations from primes to every supply-chain tier. Prime contractors require that applicable requirements on the purchasing document flow to sub-tier suppliers. Missing flow-down language creates gaps during DCMA audits.

Core flow-down obligations enforced by aerospace primes work together to protect configuration, traceability and access control.

• AS9100D QMS conformance with third-party registration and immediate notification of any change or loss of status
• Right-of-access provisions for buyer, customer and government audit teams
• Record retention periods aligned to contract requirements, with examples such as seven years for NCR and CAPA records
• AS9102 FAI requirements on first production articles
• Counterfeit part avoidance clauses flowed to all lower-tier subcontracts per Lockheed Martin Space Quality Clause QTC6
• Special process processor approvals verified in Exostar or P2P at time of processing
• Prohibition on outsourcing without prior written authorization per AS9100D Clause 8.4.3 flow-down practice
• Notification and approval requirements for any process, product, ownership or location changes

Purchase orders must state each applicable requirement in clear language. Summary references alone do not support strong audit defense.

ITAR Technical-Data Controls and TCP Content

ITAR registration under 22 CFR Part 122 functions as a legal prerequisite separate from AS9100D certification. An AS9100D certificate does not satisfy ITAR obligations, and violations can result in civil and criminal penalties as described in ITAR enforcement guidance.

A compliant Technology Control Plan addresses specific control points.

• Physical access controls that restrict ITAR-controlled areas to U.S. persons
• IT security segmentation that prevents foreign national access to controlled technical data
• Export-controlled document marking on blueprints, specifications and manufacturing instructions
• Foreign visitor protocols with documented screening and escort procedures
• Designation of an empowered ITAR compliance officer
• Employee training records that confirm awareness of export control obligations
• Documented procedures for voluntary self-disclosure under 22 CFR 127.12
• Subcontractor oversight that confirms outsourced processes also meet export control requirements

Technical-data transfer records document each disclosure and follow ITAR retention rules. Cloud storage for ITAR-controlled records resides on infrastructure that restricts access to U.S. persons.

CMMC Level 2 Documentation for Defense Suppliers

Suppliers that handle Controlled Unclassified Information on Department of Defense contracts meet CMMC Level 2 requirements that map to the 110 controls in NIST SP 800-171. Most prioritized programs now rely on third-party assessment by a C3PAO-accredited organization, with limited use of self-assessment for non-prioritized acquisitions as described in CMMC guidance.

Key documentation requirements for CMMC Level 2 focus on system description, gaps and evidence.

• A System Security Plan that documents the CUI environment, control implementation status and responsible parties
• A Plan of Action and Milestones for controls not yet fully implemented
• Evidence of access control, incident response, media protection and configuration management practices
• Scores submitted to the DoD Supplier Performance Risk System
• Triennial third-party assessment with annual affirmations between assessments

Primes increasingly request CMMC Level 2 evidence as a condition of supply-chain participation and often verify SPRS scores before award.

AS9102 FAI Traceability and Trigger Events

AS9100D Clause 8.5.1.3 requires production process verification on a representative item from the first production run. AS9102 functions as guidance rather than a formal clause requirement, yet primes often treat it as the standard format.

A complete FAI package contains three forms with distinct traceability roles.

• Form 1 — Part Number Accountability: Identifies the part number, drawing revision and all applicable specifications and standards.
• Form 2 — Product Accountability: Documents material certifications, special process certifications and functional test results traceable to each lot or serial number.
• Form 3 — Characteristic Accountability: Records every dimension, tolerance, surface finish callout and drawing note with actual measured values, with each characteristic ballooned and traceable.

FAI records capture operator identity, workstation, work-instruction revision, components used and photos of critical characteristics. Contract language, customer requirements and regulations define FAI record retention, and AS9102 does not set a universal minimum. Partial FAI packages with missing ballooned drawings, unsigned forms or untraced material certifications create disqualifying audit findings.

How Precision Advanced Manufacturing Supports Program Compliance

Precision Advanced Manufacturing operates under AS9100D and ISO 9001:2015 certified quality management systems and maintains active ITAR registration with the U.S. Department of State Directorate of Defense Trade Controls. Each production program receives an integrated documentation package that aligns with the matrix categories above.

The company quality infrastructure includes structured certifications, traceability and cybersecurity controls.

• AS9100D and ISO 9001:2015 registrations verifiable through the IAQG OASIS database
• Active ITAR registration confirmable via CAGE Code in the DDTC registrant database
• Documented facilities in Michigan and California that operate under defined export-control practices
• Full material and process traceability from raw stock MTR through every operation to the finished part
• Certificates of Conformance with part number, PO number, engineering revision and authorized representative signature
• AS9102 FAI packages with Forms 1, 2 and 3 fully ballooned and traceable to the current drawing revision
• NIST-traceable calibration records for all measurement equipment with documented intervals and as-found and as-left data
• CMMC-aligned cybersecurity controls for programs that involve CUI
• Documented SCCP procedures that cover sourcing, verification and quarantine of suspect material
• Internal audit program with objective evidence of QMS effectiveness and closed corrective actions

Multi-axis CNC machining, precision metal fabrication, specialty welding and integrated finishing services operate under one roof, which reduces sub-tier handoffs and documentation gaps. Programs scale from prototype through full-rate production without supplier changes, preserving the traceability baseline established at FAI.

Next-Steps Checklist for Procurement and Quality Teams

Procurement and supplier quality teams can follow this sequence to move from qualification to production with a stable supplier base.

1. Confirm AS9100D certification in IAQG OASIS and ITAR registration at DDTC using the supplier CAGE Code.
2. Request the Technology Control Plan summary and confirm it addresses all TCP elements listed above.
3. Review the AS9102 FAI package for completeness, including Forms 1, 2 and 3 with ballooned drawings and current revision traceability.
4. Verify NADCAP accreditation for any special processes specified on the drawing.
5. Confirm CMMC Level 2 assessment status and SPRS score for any CUI-bearing program.
6. Audit PO flow-down language to confirm all applicable AS9100D, ITAR and prime-specific clauses are explicitly stated.
7. Establish record retention requirements in the contract based on the governing regulation. QMS records often require a minimum 10-year retention under aerospace prime flow-down. ITAR transaction records require five years under 22 CFR § 122.5. Government contracts subject to FAR and DFARS may extend retention to 10 years, and the longest period governs.
8. Request a tailored documentation package from Precision Advanced Manufacturing to confirm every line item is covered before program launch.

Frequently Asked Questions

What is the difference between AS9100D certification and ITAR registration, and does one satisfy the other?

AS9100D is a quality management system standard from the International Aerospace Quality Group that builds on ISO 9001:2015 with aerospace-specific requirements such as configuration management, risk management, FAI and counterfeit part prevention. ITAR registration functions as a legal requirement administered by the U.S. Department of State, while AS9100D certification remains a voluntary quality standard. The earlier section on technical-data controls covers specific TCP elements and regulatory citations. Programs that involve USML-controlled drawings, specifications or manufacturing data require both credentials, verified separately through IAQG OASIS and the DDTC registrant database.

How long must AS9100D and ITAR records be retained?

Retention periods vary by record type and governing regulation. AS9100D quality records such as FAI packages, inspection records, calibration certificates, NCRs and CAPA records are often retained for a minimum of 10 years under aerospace prime flow-down, with FAI records kept for the life of the program plus the contract period. ITAR transaction records, including export licenses, technical-data transfer records and visitor logs, require a minimum five-year retention from the transaction date under 22 CFR § 122.5. Government contracts subject to FAR Subpart 4.7 may impose retention periods up to 10 years for production quality records. When multiple requirements apply to the same record, the longest period governs, and many compliance teams adopt seven to 10 years for ITAR records to cover overlapping obligations.

What does a complete AS9102 FAI package require, and when is a new FAI triggered?

A complete AS9102 FAI package contains three forms. Form 1 covers part number accountability, including the part number, drawing revision and applicable specifications. Form 2 covers product accountability, documenting material certifications, special process certifications and functional test results traceable to specific lots or serial numbers. Form 3 covers characteristic accountability, recording every dimension, tolerance, surface finish callout and drawing note with actual measured values, with each characteristic ballooned and traceable to the measurement record.

New FAI activity occurs on the first production article of a new part number, after a design change that affects form, fit or function, after a manufacturing process change, after a lapse in production or when a supplier change occurs. Partial packages with missing ballooned drawings, unsigned forms or untraced material certifications create disqualifying findings during prime and DCMA audits.

What flow-down clauses must appear on purchase orders issued to AS9100D and ITAR suppliers?

Purchase orders issued to AS9100D and ITAR suppliers must state all applicable requirements to support audit enforcement. Required flow-down elements include AS9100D QMS conformance with third-party registration and notification obligations, right-of-access provisions for buyer, customer and government audit teams, record retention periods aligned to contract requirements, AS9102 FAI requirements on first production articles, counterfeit part avoidance clauses extended to all lower-tier subcontracts, special process processor approval requirements and prohibition on outsourcing without prior written authorization. ITAR flow-down confirms that sub-tier suppliers are also ITAR registered when they receive or handle USML-controlled technical data. Primes such as Lockheed Martin Space require the full substance of each quality clause to appear in lower-tier purchase orders, not only a summary reference.