AS9100D vs ISO 9001, ITAR and DFARS/CMMC for Defense Precision Machining: Which Qualification Gates Are Mandatory

Is AS9100D a hard gate, or will ISO 9001 alone pass?

Start with the contract, SOW or PO language. AS9100D is built on ISO 9001:2015 and adds aerospace-specific requirements covering product and process safety, configuration management, first article inspection, key characteristics, counterfeit-part prevention and supplier flow-down^{1,8,9,11,17,35}.

A shop holding only ISO 9001 has not been audited against those additions, so the certificate does not cover the aerospace scope your program may invoke^8,15,35. For aerospace program work, ISO 9001 alone is described as insufficient, and prime contractors are reported to require AS9100D from machining suppliers³⁵.

One source states that a CNC supplier without AS9100D cannot supply flight-critical components to a major aerospace OEM¹⁷. AS9100D is also described as the mandatory quality management system for defense aerospace hardware, while ISO 9001 is required independently for suppliers outside the aerospace scope of AS9100^9,21.

That said, no source in this set quotes a specific contract, SOW or PO clause making AS9100 mandatory. And none establishes that AS9100 is legally required in every defense contract regardless of what the contract invokes²².

Treat AS9100D as the expected baseline for aerospace/defense machining scope, and read your own contract documents to confirm whether it is explicitly invoked. If the scope is commercial-only, ISO 9001 may be the applicable standard⁹.

Are the parts or drawings USML-controlled, and does that make ITAR registration a pre-award gate?

ITAR registration with DDTC is described as mandatory for any manufacturer that produces, exports or handles defense articles or technical data covered by the USML. And as required before contract award on most defense programs^2,9.

Registration is mandatory even if the company does not plan to export². For a supplier touching USML-listed hardware or technical data, registration is presented as a filter that excludes non-US companies unless an export licence is obtained²¹.

The mechanism matters more than the certificate. ITAR reaches technical data — blueprints, drawings, software — and defense services, not just hardware shipment².

That means a shop handling your defense drawings must control foreign-national access to them, including foreign employees or partners physically located in the US². Registration alone does not establish that control; the supplier needs a documented data-handling and personnel-access process¹⁵.

Before you send drawings, ask whether the part or technical data is USML-listed and which category applies. No source in this set provides a USML category determination method or a worked example of classifying a machined part.

So that determination is a question for your contracting officer or trade-compliance counsel, not something to infer from a supplier's registration letter.

Do CMMC and DFARS clauses apply to this scope, and which phase is currently in force?

CMMC attaches to programs involving Controlled Unclassified Information. For defense programs with CUI, CMMC compliance is described as a hard program requirement, and a single non-compliant manufacturer can disqualify a bid²⁰.

CMMC Level 2 is described as covering about 110 NIST SP 800-171 controls and typically requiring third-party assessment by C3PAOs for contractors handling CUI^14,21. Self-attestation and third-party assessment are not equivalent²⁰.

DFARS obligations run alongside CMMC. Suppliers must accept and implement applicable DFARS clauses flowed down by the prime, including counterfeit-parts prevention, material traceability and cybersecurity requirements¹⁴.

Where the program is subject to domestic-content restrictions, DFARS-compliant specialty-metals sourcing and melt-origin documentation apply^28,29. Specialty-metals compliance must be sorted before the RFQ, not after the PO, because material sourcing affects lead time and cost in ways that cannot be fixed mid-program¹⁵.

The CMMC phase-in schedule is where the sources disagree, and the disagreement is material to your PO language. One source states Phase 2 begins November 10, 2026, making third-party certification mandatory for many Level 2 contracts¹⁴.

Another states that in July 2026 DoD suspended subsequent phases including the Phase 2 third-party certification requirement pending a program-wide review, with Phase 1 self-assessment remaining in force²². A third source states the CMMC Program final rule became effective December 16, 2024, with contract requirements appearing from Q3 2025²⁰.

The evidence does not resolve which phase is currently effective for your solicitation. Confirm the current phase-in status with your contracting officer before writing CMMC language into the PO.

What to verify on each candidate shop before you accept any certificate claim

The sources converge on a common verification set, and none of these items is established by a supplier's own marketing statement. Run one documented pass per candidate and keep the evidence on file.

• ✓Request the current AS9100 certificate and confirm scope, expiration and registrar; verify the registrar is accredited.
• ✓Verify AS9100D certification through the IAQG OASIS database rather than a website claim.
• ✓Request the current DDTC registration letter with a valid M-code and unexpired registration date.
• ✓Confirm the USML categories on the registration letter match the controlled articles or technical data in your program.
• ✓Ask how the shop handles foreign-national access to controlled data, and request the documented Trade Compliance Program.
• ✓Confirm the supplier's CMMC level and whether it meets the CUI handling requirements of your program.
• ✓Ask whether the shop has executed AS9102-compliant FAIRs and request a sample package.

Separate machining capability from compliance paperwork

ITAR registration matters, but it does not replace machining capability²⁴. A registered shop still has to produce the part correctly.

And the sources tell buyers to assess tolerances, dimensional accuracy, complex geometries, advanced fixturing, repeatability and experience with demanding materials such as aluminum, stainless steel, titanium, specialty alloys and engineered plastics separately from ITAR or quality-system status²⁴.

A titanium bracket for a defense or aerospace application may require more than basic CNC capacity — experienced technicians, material knowledge, inspection planning, controlled documentation and disciplined process control²⁴. A machine shop can have strong milling and turning capabilities and still not be appropriate for ITAR-controlled work if it lacks the data-handling controls²⁴.

When you evaluate capability, ask the shop to demonstrate it on a part like yours rather than quoting a tolerance figure from a website.

Vendor-tier sources publish figures such as ±0.0127 mm true position for flight-critical hole positions and ±0.005 mm for bearing bores¹¹, but these are individual supplier claims, not acceptance standards you can rely on.

Use them as prompts for what to ask a shop to demonstrate on a demonstration order, not as the specification for your drawing.

Which qualification route applies: full prime ASL/QML entry or the lighter prototype path?

On US DoD programs, the prime contractor's Approved Supplier List or Qualified Manufacturer List defines which suppliers can be used for specific components. And new supplier qualification requires a formal engineering review and quality audit before any purchase orders can be placed¹⁶.

That gate sits above the certification checks: a shop can hold AS9100D and ITAR registration and still be unusable on a specific work package until the prime approves it. For development and prototype programs not yet subject to ASL restrictions, rapid onboarding through ITAR registration verification, an AS9100D certificate check via IAQG OASIS.

And a limited capability demonstration order is described as the typical path¹⁶. If your program is at that stage, the lighter route lets you evaluate capability and compliance together before committing to a full qualification audit.

One consequence of AS9100D that affects your sub-tier risk: certified organizations must flow quality requirements — key characteristics, traceability, right of access for customer and regulatory inspection — down through their own sub-tier suppliers⁸. ISO 9001 has general supplier evaluation requirements but no equivalent aerospace-specific flow-down⁸.

If your chosen shop subcontracts a special process, the prime's quality requirements typically flow down to those subcontractors. And a shop that cannot show its approved supplier list or subcontractor qualification records has a gap that will show up in your parts³⁵.

How the compliance gates and material requirements move cost and lead time

Aerospace and defense work is reported to carry premiums over general machining for mission-critical components because of traceability, quality systems and exotic materials⁴. One source reports US 5-axis CNC hourly rates of $75-300/hr in 2026 depending on tier, complexity and certifications such as AS9100D/ITAR, with aerospace and defense work carrying 20-50% premiums⁴.

The same source reports cost adders of 30-100% for exotic materials and 15-40% for tight tolerances^{4 9} (supplier-reported figure). These are one source's reported ranges, not industry benchmarks, and they do not include NRE, tooling, MOQ or volume pricing.

Lead time is affected by the same drivers. One supplier reports 5-10 business day lead times for prototype defense components with a full documentation package including CMTR, hardness certificate, CMM report, surface finish measurement, AS9100D Certificate of Conformance and AS9102 five-form FAI²³.

That is a supplier-specific claim for prototype quantities, not a production lead time. Because specialty-metals compliance and material origin cannot be fixed mid-program, resolve those questions before the RFQ¹⁵.

When you compare quotes, ask each shop to state separately what portion of the price reflects compliance documentation, what reflects material origin, and what reflects machining time, so the comparison is like-for-like.

Where the sources disagree on CMMC phase-in timing

The sources conflict on whether the CMMC Phase 2 third-party certification milestone is currently in force. The evidence does not resolve which phase applies to your solicitation, so verify with your contracting officer rather than relying on any published schedule.

What the sources do not establish

• No source quotes the actual contract, SOW or PO clause language that makes AS9100 mandatory, so you cannot rely on this article to tell you whether your specific contract invokes it — read your own contract documents.
• SAM.gov registration is not addressed by any source in this set.
• DCMA government source inspection and DD254 security classification requirements are not addressed by any source in this set.
• No source provides NRE, tooling cost, MOQ, volume unit pricing or defense surge capacity data, so total program cost cannot be estimated from these sources.
• No source provides a USML category determination method or a worked example of classifying a machined part — that determination is a question for your contracting officer or trade-compliance counsel.
• No source states the current effective CMMC requirement level for a specific solicitation, and sources conflict on phase-in timing.
• No source establishes required NDT methods or acceptance criteria for a given part type.
• No source addresses foreign ownership, control or influence (FOCI) mitigation mechanisms beyond noting that lower-tier FOCI assessment is a question to ask.