How to Select AS9100 ITAR Aerospace CNC Machining Suppliers

Last updated: August 6, 2026

Key takeaways for AS9100D ITAR supplier selection

• AS9100D ITAR supplier qualification requires verification of active certifications through primary sources like the IAQG OASIS and DDTC databases, not just certificate copies.
• Documentation packages with complete FAI forms, material traceability records and control plans signal process discipline and compliance readiness.
• Scalability assessment must use objective data on spindle utilization, machine redundancy, ERP or MRP systems and pilot runs to confirm production capacity beyond prototype quantities.
• Cybersecurity obligations under NIST SP 800-171 remain in effect despite the 2026 CMMC Phase 2 suspension, so suppliers handling CUI must maintain documented SSPs, SPRS scores and POA&Ms.
• Precision Advanced Manufacturing delivers aerospace CNC machining from prototype through full-rate production under a single AS9100D and ITAR-certified quality system, and request a quote to align program requirements with available capacity.

Eight-step AS9100D ITAR supplier qualification checklist

AS9100D ITAR supplier qualification confirms that a CNC machining supplier holds current aerospace quality certification, maintains ITAR registration, produces complete documentation and operates with the cybersecurity posture and scalable capacity required for regulated defense and aerospace programs.

This eight-step checklist gives procurement and supplier quality teams a structured framework for evaluating aerospace CNC machining suppliers for AS9100 ITAR programs.

1. Verify certifications
2. Request documentation packages
3. Assess prototype-to-production scalability
4. Confirm CMMC or NIST 800-171 posture
5. Evaluate material and process expertise
6. Review on-time delivery and quality metrics
7. Plan for mid-program supplier transitions
8. Engage a qualified partner

Confirm AS9100D and ITAR certifications

Certification verification serves as the first gate in any supplier qualification process, and active status must be confirmed through primary sources.

Inputs and decision criteria:

• Request the supplier AS9100D certificate and cross-reference it in the IAQG OASIS database, confirming certification scope, issuing body, issue and expiry dates and applicable sites.
• AS9100D certificates remain valid for three years and require annual surveillance audits in years one and two plus a full recertification audit in year three, so request evidence of ongoing compliance including internal audit results and corrective-action closure data.
• Verify ITAR registration by requesting the supplier CAGE Code and confirming it appears in the DDTC registrant database at DDTC.state.gov.

Red flags:

• Certificate scope that excludes the specific product or service being sourced.
• No evidence of surveillance audits between recertification cycles.
• An unregistered supplier receiving ITAR-controlled technical data creates legal exposure for the prime contractor through flow-down obligations.

Review FAI and traceability documentation packages

Documentation quality signals process discipline, so teams should review FAI packages, material traceability records and control plans before awarding work.

Inputs and decision criteria:

• AS9102 Rev C Form 1 must include part number, configuration or revision, FAI status, serial or lot identification and preparer or approver signatures.
• Form 2 must document materials used with specification and lot or heat numbers, special processes, functional tests and references to certifications and NADCAP approvals.
• Form 3 must record each ballooned characteristic with a unique identifier, the design requirement, actual measured results, acceptance status and links to measurement method or inspection equipment.
• Material traceability records must capture raw material heat or lot numbers, certificates of conformance, special material attributes, supplier identifiers and receiving inspection results tied to work orders.

Red flags:

• FAI packages missing ballooned characteristic mappings or actual measured values.
• Material certifications not traceable to specific heat or lot numbers.
• ITAR-controlled FAI data without role-based access controls and documented need-to-know restrictions.

Assess prototype-to-production scalability with data

Documentation packages confirm process discipline, but they do not show whether those processes can scale from prototype to full-rate production.

A supplier that performs well on prototype quantities may lack the process stability, capacity and quality infrastructure needed for sustained production, so scalability must be verified with objective data.

Scalability assessment starts with confirmation that required tolerances are achievable under real production conditions rather than prototype assumptions.

This tolerance verification depends on adequate capacity, so evaluation should consider spindle utilization maintained with buffer capacity, a verified equipment list and use of ERP or MRP systems for real-time scheduling.

Capacity alone does not protect delivery without redundancy, so production-scalable shops maintain multiple identical machines so a job can move to a backup without a new setup if one asset fails.

These structural indicators should be validated through a meaningful pilot run that demonstrates acceptable yield, cycle time and dimensional stability at a quantity representative of production before scaling.

Red flags:

• Spindle utilization with no documented buffer capacity.
• Heavy reliance on subcontracting that compromises material traceability.
• No ERP or MRP system for production scheduling and order tracking.
• Inability to provide process capability data for the tolerance bands required by the program.

Precision Advanced Manufacturing supports programs from prototype through multi-shift, full-rate production under a single certified quality system, which reduces the supplier fragmentation that creates traceability and schedule risk. Request a quote to discuss aerospace CNC machining program requirements.

Confirm CMMC and NIST 800-171 cybersecurity posture

Cybersecurity posture now functions as a standard qualification criterion for defense CNC machining suppliers, and recent regulatory changes affect how teams should evaluate compliance.

Inputs and decision criteria:

• On July 13, 2026, the Department of War suspended CMMC Phase 2 implementation, which had required third-party assessments for contractors handling CUI.
• The suspension does not remove obligations under DFARS 252.204-7012, so suppliers must still implement NIST SP 800-171 controls for covered defense information.
• Prime contractors remain responsible for flowing down NIST SP 800-171 requirements to lower-tier suppliers, including CNC machining subcontractors handling CUI.
• Request the supplier current SPRS score, SSP documentation and Plans of Action and Milestones for any open control gaps.

Red flags:

• No documented SSP or inability to produce a current SPRS score.
• Knowingly misrepresenting CMMC Level 2 compliance remains subject to False Claims Act liability regardless of the Phase 2 suspension.
• No documented access controls for ITAR-controlled technical data or CUI.

Evaluate aerospace material and process expertise

Beyond compliance posture, aerospace programs often require exotic alloys and special processes that standard machine shops cannot execute consistently, so material and process expertise must be verified with documented evidence.

Inputs and decision criteria:

• Confirm experience with the specific alloys required by the program, because titanium Ti-6Al-4V low thermal conductivity concentrates heat at the cutting tool, accelerates wear and induces dimensional drift that compounds over production runs without validated processes.
• FAI packages and control plans must document special process qualifications including NADCAP approvals and expiry dates, process parameters and calibration status of process monitoring instruments.
• Verify that 5-axis simultaneous machining capability is available for complex structural and propulsion components, because a supplier without proven 5-axis simultaneous experience cannot produce this class of parts to spec.

Red flags:

• No NADCAP-approved special process certifications for required treatments.
• Inability to provide process parameter records for heat treatment, welding or plating.
• No temperature-controlled inspection environment, even though NIST dimensional metrology guidance requires measurements to be taken at a 20°C reference temperature.

Review on-time delivery and quality performance metrics

Historical performance data provides the strongest predictor of future execution, so teams should request objective metrics instead of relying on qualitative assurances.

Inputs and decision criteria:

• Request 12-month on-time delivery rates and first-pass yield data for programs of comparable complexity.
• Quality assurance systems required for scaling aerospace CNC work include nonconformance management, root cause and corrective action processes and complete inspection documentation.
• Confirm that QC capacity matches production throughput, because inspection equipment such as CMMs or laser scanners must keep pace with production without creating bottlenecks.

Red flags:

• Inability or unwillingness to provide historical delivery and quality data.
• Corrective action records that show recurring nonconformances on the same characteristics.
• No documented nonconformance management system or root cause analysis process.

Plan for mid-program supplier transitions

Even suppliers with strong current metrics may not sustain performance across a multi-year program, so qualification processes should anticipate the possibility of mid-program supplier transitions.

Mid-program supplier transitions carry significant technical and compliance risk, and a structured re-verification process protects program continuity and prevents traceability breaks.

Inputs and decision criteria:

• Transferring production between suppliers typically requires repeating first article inspections, validation testing, assembly qualification and process verification because every new supplier introduces manufacturing variability.
• A transition plan should verify the supplier AS9100 registration scope, last surveillance audit date, process capability data for required tolerances, material traceability from mill certification to shipped part and on-time delivery history over the past 12 months.
• Require pilot builds or validation runs before full-rate transfer to confirm dimensional stability, yield and documentation completeness under the new supplier processes.
• Frequent supplier changes expand ITAR and CMMC compliance exposure through inconsistent documentation, weak traceability and delayed certifications.

Red flags:

• New supplier cannot produce process capability data for the tolerance bands required by the program.
• No documented process for maintaining material traceability through the transition.
• Switching suppliers strips away accumulated machining data, tooling knowledge and problem-solving experience built with established technicians, so confirm that the incoming supplier maintains comparable documented process history.

Precision Advanced Manufacturing provides complete documentation, material traceability and engineering support to manage supplier transitions with minimal program disruption. Request a quote to discuss transition planning for an active aerospace or defense program.

Frequently asked questions on AS9100D ITAR suppliers

Does AS9100D certification alone qualify a supplier for ITAR-controlled defense programs

AS9100D certification and ITAR registration function as separate requirements that address different obligations.

AS9100D governs the quality management system, including traceability, FAI, nonconformance handling and process control.

ITAR registration, maintained through the Directorate of Defense Trade Controls, governs who may access, manufacture or export defense articles and technical data.

A supplier must hold both to participate in ITAR-controlled programs, and buyers should verify each independently through the IAQG OASIS database and the DDTC registrant database rather than assuming one implies the other.

What is the practical risk of switching aerospace CNC machining suppliers mid-program

Mid-program transitions require repeating first article inspections, process validation and material traceability verification because every new supplier introduces manufacturing variability.

Tooling and fixtures often must be recreated or modified to align with new equipment and workflows, which introduces dimensional variation and longer lead times.

Accumulated process knowledge, including tooling behavior, material response data and problem-solving history, is lost with each transition.

Compliance exposure also increases when documentation, certifications and traceability records do not transfer completely, so selecting a supplier capable of supporting the full program lifecycle from prototype through full-rate production reduces this risk.

What cybersecurity documentation should buyers request from defense CNC machining suppliers in 2026

As noted in the CMMC posture section, the July 2026 Phase 2 suspension paused third-party assessments but did not remove NIST SP 800-171 obligations for suppliers handling CUI.

Buyers should request the supplier cybersecurity documentation, including SSPs, current SPRS scores and Plans of Action and Milestones for any open gaps.

Prime contractors retain flow-down responsibility for these requirements to lower-tier suppliers, so suppliers unable to produce current documentation represent a compliance risk for program eligibility.

How can procurement teams assess whether a CNC supplier can scale from prototype to full-rate production

Scalability assessment depends on objective process data rather than capacity claims, so teams should request Cpk data that shows required tolerances are achievable at production quantities, not just prototype runs.

Spindle utilization data, ERP or MRP scheduling systems, machine redundancy and QC throughput capacity all indicate production readiness.

A pilot run at a quantity representative of production should confirm yield, cycle time and dimensional stability before full-rate commitment, because suppliers that cannot provide this data present scalability risk that will surface during production ramp.

What documentation should a supplier provide to support FAI requirements under AS9102 Rev C

A complete FAI package under AS9102 Rev C includes three primary forms that work together to document part accountability, product details and measured characteristics.

Form 1 documents part number accountability including configuration, FAI status, serial or lot identification and preparer and approver signatures.

Form 2 documents product accountability including materials with specification and lot or heat numbers, special processes with references to certifications and NADCAP approvals and functional test results.

Form 3 records each ballooned characteristic with a unique identifier, the design requirement, actual measured results, acceptance status and the measurement method used.

Supporting evidence includes material certifications, special process records, calibration status of inspection equipment and certificates of conformance, and all records must maintain traceable linkage to the specific drawing or model revision used during production.

Engage Precision Advanced Manufacturing for AS9100 ITAR programs

Precision Advanced Manufacturing operates as a U.S.-based, AS9100D and ISO 9001:2015 certified, ITAR-registered CNC machining and fabrication provider serving commercial aerospace, military and defense, space and satellite and UAV programs.

Facilities in California and Texas support prototype through multi-shift full-rate production with integrated multi-axis CNC machining, precision fabrication, specialty welding, secondary finishing and engineering support under a single certified quality system.

Complete traceability, full FAI documentation and certified quality processes come standard on every program, and supplier transitions receive support through pilot builds, material traceability continuity and engineering documentation that protect program schedules.

Procurement, program and supplier quality teams working on AS9100 ITAR programs can engage Precision Advanced Manufacturing aerospace specialists for a tailored program review, and request a quote to begin the qualification process.