Key Takeaways
- AS9100 Rev D certification is mandatory as it ensures quality controls, traceability, and counterfeit parts prevention for defense components.
- ITAR compliance and NIST SP 800-171 are legal requirements that protect sensitive technical data and ensure your supplier can legally manufacture military parts.
- NADCAP accreditation validates special processes like heat treating and welding, proving your supplier meets the highest industry standards beyond basic certifications.
You’re about to sign a contract with a military CNC machining supplier. The quote looks competitive. The lead times seem reasonable. The sales rep sounds confident.
But here’s what matters more than any of that: Do they have the right certifications?
In defense manufacturing, certifications aren’t bureaucratic checkboxes. They’re the difference between a supplier who can deliver mission-critical components and one who will cost you time, money, and compliance headaches.
Here’s what your supplier needs to have in place before you sign.
AS9100 Rev D: The Quality Standard for Military CNC
If your supplier doesn’t have AS9100 Rev D, walk away.
AS9100 is the aerospace and defense industry’s quality management standard. It includes product safety controls, counterfeit parts prevention, risk management protocols, and full traceability.
This matters because defense components operate in extreme conditions. A part that fails at altitude or in combat doesn’t get a second chance.
According to the Americas Aerospace Quality Group, 96% of AS9100-certified companies have fewer than 500 employees. This certification is essential at every level of the supply chain.
The FAA, DoD, and NASA all endorse AS9100. When you see this certification, you know the supplier meets standards recognized by every major regulatory body.
What AS9100 Rev D Covers for Precision Machining
The latest revision addresses specific challenges in defense supply chains. These controls ensure that precision machining operations meet the highest standards:
- Product safety: Enhanced focus on preventing failures in critical applications
- Counterfeit parts prevention: Stricter controls on material sourcing and verification
- Human factors in risk management: Recognition that people, not just processes, affect quality
- Leadership accountability: Top management must demonstrate commitment to quality and customer focus
These updates came in response to repeated delivery of non-conforming products despite previous certifications. AS9100 Rev D closes those gaps.
ITAR Compliance
If your supplier manufactures defense articles or handles technical data on the United States Munitions List (USML), they must be ITAR compliant. Period.
ITAR (International Traffic in Arms Regulations) isn’t optional. It’s a legal requirement that governs who can access, manufacture, or export defense-related materials and information.
The consequences of non-compliance are severe. In 2024, Raytheon paid over $950 million to resolve investigations that included ITAR violations. Civil penalties can reach $1.27 million per incident. Criminal fines go up to $1 million with potential imprisonment.
Your supplier needs DDTC (Directorate of Defense Trade Controls) registration. Registration is mandatory the moment they manufacture defense articles or handle USML technical data, even without any export activity.
What ITAR Means for Your Partnership
An ITAR-compliant supplier has implemented controls to ensure:
- Only U.S. persons access technical data and defense articles
- Proper handling and storage of controlled information
- Export controls are followed for any international transactions
- Employee screening and training programs are in place
Without ITAR compliance, your supplier can’t legally work on your project. And if they claim they can, you’re both at risk.
NIST SP 800-171
Your 3D files, blueprints, and technical specifications are valuable targets for hackers and foreign adversaries.
NIST SP 800-171 provides 110 security controls designed to protect Controlled Unclassified Information (CUI). Defense contractors are required to implement these controls. The Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) program now mandates third-party assessments.
The self-assessment era is over.
According to industry data, approximately 8% of commercial contractors reported at least one data breach, with many experiencing multiple breaches. Small and medium-sized businesses are targeted because they typically allocate smaller budgets to cybersecurity.
Your supplier needs documented evidence of NIST 800-171 compliance. Ask for their System Security Plan (SSP) and Plan of Action and Milestones (POA&M). If they can’t produce these documents, your technical data is at risk.
NADCAP
If your supplier handles heat treating, welding, chemical processing, or non-destructive testing in-house, they need NADCAP accreditation.
NADCAP (National Aerospace and Defense Contractors Accreditation Program) is mandatory for suppliers to Airbus, Boeing, Honeywell, and Rolls-Royce. The program offers 26 critical process accreditations, and the audits are far more rigorous than AS9100.
Here’s what makes NADCAP different: Subject matter experts conduct the audits using industry-agreed checklists. Special process task groups made up of industry members review audit packages and vote on approval. This peer-review approach ensures that accredited suppliers truly meet the highest standards.
NADCAP requires AS9100 certification as a prerequisite. You can’t get NADCAP without it.
Why This Matters for Your Project
Special processes are difficult to verify through inspection alone. Heat treating affects internal material properties you can’t see. Understanding welding vs. fabrication is critical—welding creates joints whose strength depends on technique and parameters, while fabrication encompasses the broader assembly process. Non-destructive testing requires expert interpretation.
NADCAP accreditation means your supplier has proven their capability to industry experts, not just internal auditors.
Administrative Requirements: SAM, JCP, and CAGE Codes
These aren’t quality certifications, but they’re mandatory for doing business with the U.S. government.
SAM Registration (System for Award Management): Your supplier must be registered in the SAM database to be eligible for federal contracts. This registration verifies their business information and compliance status.
Joint Certification Program (JCP): Confirms your supplier is authorized to access technical data controlled by the U.S. and Canada. If your project involves cross-border collaboration, JCP registration is essential.
CAGE Code (Commercial and Government Entity Code): A five-character identifier assigned by the DoD. Your supplier needs this code to be recognized in government procurement systems.
These registrations take time to obtain. If your supplier doesn’t have them, expect delays before work can begin.
AS9102 and NIMS
Certifications prove compliance with standards. Technical competence proves your supplier can make parts correctly. For complex parts requiring 5 axis milling or specialized processes like brass milling, verification becomes even more critical.
AS9102 First Article Inspection (FAI)
Before full production begins, your supplier should provide a detailed FAI report. This document verifies that the first produced part meets all drawing specifications, dimensions, and material requirements.
An FAI report is proof of capability. It shows the supplier understands your requirements, has the right equipment, and can produce parts within tolerance.
Ask to see FAI reports from similar projects. If your supplier can’t provide them, they may lack experience with your type of work.
NIMS Certifications
The National Institute for Metalworking Skills (NIMS) certifies CNC operators and technicians in specific competencies: manual machining, setup, programming, and operation.
NIMS certifications indicate that the people running the machines know what they’re doing. This matters when you’re paying for precision and can’t afford scrap or rework.
Your Pre-Contract Checklist
Before you sign with any CNC machining supplier for military work, verify they have:
Essential Quality and Regulatory:
- AS9100 Rev D certification (current and valid)
- ITAR compliance and DDTC registration
- NIST SP 800-171 compliance documentation
Special Process Accreditation (if applicable):
- NADCAP accreditation for relevant processes
Administrative Requirements:
- SAM registration (active status)
- JCP registration (if needed for your project)
- Valid CAGE Code
Technical Competence:
- AS9102 FAI reports from similar projects
- NIMS certifications for key personnel
What to Ask Your Supplier
Don’t just take their word for it. Request documentation:
- “Can you provide your current AS9100 Rev D certificate and the most recent audit report?”
- “What’s your DDTC registration number, and when does it expire?”
- “Can you share your System Security Plan summary showing NIST 800-171 compliance?”
- “Which NADCAP accreditations do you hold, and can I see the audit results?”
- “Can you provide an example FAI report from a similar project?”
A qualified supplier will have these documents ready. If they hesitate, stall, or can’t produce them, that’s your answer.
The Cost of Choosing Wrong
Choosing a supplier without proper certifications creates problems you can’t easily fix:
- Compliance violations that put your own contracts at risk. If your supplier isn’t ITAR compliant and handles controlled data, you’re liable too.
- Quality failures that require expensive rework or scrap. Without AS9100 controls, you have no assurance of consistent quality.
- Data breaches that compromise your intellectual property and competitive advantage. Without NIST 800-171 compliance, your technical data is vulnerable.
- Program delays while you find a new supplier and restart production. Switching suppliers mid-program is costly and time-consuming.
The cheapest quote often becomes the most expensive mistake.
How NAMF Maintains Certification Standards
At New Age Metal Fabricating, we hold certifications that matter for defense and aerospace work. As NADCAP approved suppliers with NAVSEA, we demonstrate our commitment to quality and compliance.
Since 1979, we’ve built our reputation on precision manufacturing for mission-critical applications. Our dual facilities provide redundancy and scalability, with full in-house capabilities for precision fabricating, dip brazing, and CNC machining.
We maintain these certifications because they represent the baseline for serving clients whose components operate in extreme conditions. When you work with NAMF, you get documentation, traceability, and proven capability from a supplier who understands what’s at stake.
Partner with a Certified Defense Supplier
NAMF holds NADCAP, NAVSEA, and ISO certifications with full in-house capabilities for your military CNC projects. Explore our precision manufacturing capabilities and start your project with confidence.
