How to Become an Aerospace and Defense Supplier
To sell parts or services into aerospace and defense you need a quality system a buyer can audit, the right federal registrations, export control and cybersecurity controls that match the work, and a place on at least one buyer's approved supplier list. This guide lays out each piece in the order most small shops tackle them.
The short version
Most shops break into aerospace in this order: build or tighten the quality system, register in SAM.gov, sort out export control and cybersecurity, then earn a spot on an approved supplier list one buyer at a time. Certification helps, but a buyer approves you, not a certificate.
The work itself rarely changes much. A bracket for a launch pad fixture is still a bracket. What changes is the paper around it: traceable material, a first article report, a certificate of conformance, records that survive an audit, and controls on who sees the drawing. Shops that already hold tight tolerances often find the paperwork, not the machining, is the real barrier.
Each step below links to a deeper page. If you want a single list to work from, start with the supplier readiness checklist.
Step 1: Decide where you fit in the supply chain
Pick the tier and the type of work first, because it decides which certifications and registrations you actually need.
Very few small shops sell straight to a prime contractor on day one. More often the first aerospace purchase order comes from a tier 1 or tier 2 supplier that needs overflow machining, a fixture, a harness, or a finishing step. Ground support equipment, tooling and test fixtures are common entry points because they are often less heavily specified than flight hardware, though that depends on the buyer and the drawing.
Ask yourself three questions:
- Flight or ground? Flight hardware usually carries the heaviest flow-downs. Ground support equipment, tooling and facility work can be a gentler start.
- Defense, civil space, or commercial? Defense work brings ITAR and CMMC into play more often. Commercial space and civil aviation lean harder on AS9100 and customer-specific quality clauses.
- Parts or process? If you plate, heat treat, inspect or clean parts rather than make them, buyers will ask about special process approvals and often Nadcap.
Trade-specific pages cover what buyers ask of CNC machine shops, sheet metal, welding and GSE fabrication shops, process houses, electronics and wire harness shops and test labs and cleanrooms.
Step 2: Build a quality system a buyer can audit
A documented quality management system is the price of entry, and for most aerospace buyers that means AS9100 or a credible path toward it.
AS9100 is the aerospace quality management standard published through the International Aerospace Quality Group (IAQG). It takes ISO 9001 and adds requirements that matter in this industry: configuration management, product safety, counterfeit part prevention, first article inspection, and tight control of the suppliers you use. Certification is done by an accredited certification body, and a valid certificate shows up in the IAQG OASIS database. Buyers check OASIS, so a certificate that is not listed there will raise questions.
The standard is due for a revision. The IAQG has said new and revised documents will carry an "IA" prefix, so the next edition is expected as IA9100 rather than AS9100E. Certification bodies have reported a transition period of roughly 12 months once it is published, with details still subject to IAQG confirmation. If you are starting now, build to the current revision and ask your registrar how they will handle the change.
Not every buyer requires a certificate. Some will approve an ISO 9001 shop, or an uncertified shop, for lower-risk work after a source inspection or a survey. What they all want to see:
- Material and lot traceability from mill cert to finished part
- First article inspection to AS9102 when the purchase order calls for it
- Calibrated inspection equipment with records
- Control of nonconforming product, so a bad part never ships quietly
- A way to pass customer requirements down to your own subcontractors
For what certification costs a small shop and how long it usually takes, see AS9100 certification cost and timeline.
Step 3: Register with the federal government
If you want any chance at federal prime contracts or defense subcontracts, register your business in SAM.gov. It is free, and it produces the two identifiers buyers will ask for: a Unique Entity ID (UEI) and a CAGE code.
- SAM.gov registration. There is no charge to register or to keep a registration active. Watch out for companies that email offers to register you for a fee. Help is free through the Federal Service Desk at fsd.gov.
- UEI. A 12-character identifier SAM.gov assigns when your entity passes validation. It replaced the DUNS number in April 2022.
- CAGE code. Assigned by the Defense Logistics Agency as part of SAM.gov processing. You do not apply for it separately.
- Renewal. Registrations must be renewed every 365 days. Federal guidance suggests starting 45 to 60 days before expiration, and an inactive registration blocks awards and payments.
Your legal name and address in SAM.gov have to match IRS records exactly. Mismatches are a common cause of delays. Plan for at least ten business days after submission before the registration goes active.
While you are in SAM.gov, fill out the small business profile carefully, with accurate NAICS codes and a plain description of your capabilities. Primes and contracting officers search that data through the SBA's Small Business Search tool. If you qualify for a socioeconomic program such as WOSB, SDVOSB, HUBZone or 8(a), that status can make you more attractive to primes with subcontracting goals. The small business subcontracting guide explains how those programs and goals work.
Step 4: Export controls and ITAR registration
If you manufacture defense articles in the United States, the ITAR generally requires you to register with the State Department's Directorate of Defense Trade Controls (DDTC), even if you never export anything.
The rule is in 22 CFR 122.1. It covers anyone in the US in the business of manufacturing, exporting, or temporarily importing defense articles, or furnishing defense services, and it says plainly that a manufacturer who does not export must still register. Registration is annual. Under the current fee schedule in 22 CFR 122.3, a new registrant pays a Tier 1 fee of $3,000 per year. Renewing registrants who received authorizations pay more under Tier 2 and Tier 3.
Whether a particular job makes you a manufacturer of defense articles is a legal question that depends on the item and its classification. Many build-to-print shops that make parts from a customer's ITAR-controlled drawings choose to register, and some buyers require it before they will release a technical data package. If you are unsure, get a qualified export control opinion rather than guessing.
Registration is only part of it. ITAR technical data can only go to US persons unless an export authorization covers it, which affects who in your shop can see a drawing, where files are stored, and which email or cloud services you use. Work under the Export Administration Regulations (EAR) has its own rules. The ITAR registration page walks through who needs to register, the fee tiers and the timeline.
Step 5: Cybersecurity and CMMC
If you will handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on a Department of Defense contract or subcontract, expect a CMMC requirement in the solicitation or flowed down in your purchase order.
CMMC has three levels. Level 1 covers FCI and requires an annual self-assessment against the 15 basic safeguarding requirements in FAR 52.204-21. Level 2 covers CUI and maps to the 110 security requirements in NIST SP 800-171 Revision 2, verified either by self-assessment or by a certified third-party assessment organization (C3PAO) every three years, depending on the contract. Level 3 adds 24 requirements from NIST SP 800-172 and a government-led assessment.
The DFARS rule that puts CMMC into contracts took effect on November 10, 2025, starting a four-phase rollout. Phase 2, which would add Level 2 third-party certification as a condition of award, was scheduled for November 10, 2026 but was suspended on July 13, 2026 pending a CMMC Reform Task Force review. NIST SP 800-171 and SPRS self-assessments still apply. Assessment results and affirmations are posted in the Supplier Performance Risk System (SPRS), and DFARS 252.204-7019 already requires a current NIST SP 800-171 assessment score in SPRS for covered systems.
For a small shop, the practical question is which level your work actually needs, and whether you can keep CUI in a small, well-defined part of your network. See CMMC levels, costs and timeline for small shops.
Step 6: Special processes and Nadcap
If you perform special processes such as heat treating, chemical processing, NDT, welding or coatings, many aerospace primes will require Nadcap accreditation, or at least a customer-specific process approval, before they accept your work.
Nadcap is administered by the Performance Review Institute (PRI). Before Nadcap, each prime audited each supplier's processes on its own. Nadcap replaced that with one industry-agreed audit, reviewed by task groups made up of prime contractors, government representatives and suppliers. Accreditation is granted once all nonconformances are closed.
Not every buyer requires it, and not every process is in scope. Read the purchase order quality clauses and the prime's own supplier requirements before you commit. The Nadcap accreditation guide covers who needs it, how the audit works and what to budget.
Step 7: Get on approved supplier lists
An approved supplier list is the buyer's own record of who it may purchase from and for what. Getting on one is the real finish line, and it happens buyer by buyer.
AS9100 requires certified companies to keep a register of their external providers, with an approval status and a scope of approval, for example a product type or a process family. That means the buyer is not just approving your company. It is approving you for specific work. A shop approved for machined brackets is not automatically approved to anodize them.
The usual path is a supplier registration or questionnaire, a review of your quality system and certificates, sometimes a site survey, then a first order that is watched closely. After that, your delivery and quality record decides whether you stay on the list and how much work you see. The approved supplier list guide goes step by step.
Step 8: Find the work
Aerospace work comes through four main channels, and most small suppliers use more than one.
- Direct relationships. Supplier portals at primes and larger tier suppliers, trade shows, and plain old phone calls to buyers. Slow to build, valuable once built.
- Subcontracting programs. Large federal prime contractors above certain contract values must submit small business subcontracting plans. The FAR threshold for those plans rose from $750,000 to $900,000 on October 1, 2025 ($2 million for construction). The SBA's SubNet site lists subcontracting notices that primes have posted.
- Online manufacturing marketplaces. Platforms that take customer orders and pass them to a network of shops. They can fill capacity, though price and terms are set by the platform.
- Sourcing partners. Firms that take a buyer's request, match it to qualified suppliers and manage the paperwork. Aerospace Sourcing works this way.
The comparison of selling direct, marketplaces and sourcing partners lays out the tradeoffs fairly. Two other channels are easy to overlook: certified surplus material sitting on your racks, covered in selling surplus aerospace material, and idle test chambers or cleanroom time, covered on the test labs page.
What to do first, and what it costs
Do the free items first, then spend money only on the requirements your target buyers actually flow down.
| Item | Who needs it | Government fee |
|---|---|---|
| SAM.gov registration, UEI, CAGE | Anyone pursuing federal prime or many defense subcontracts | None |
| SBA small business profile | Small businesses that want primes to find them | None |
| ITAR registration with DDTC | US manufacturers, exporters or temporary importers of defense articles, and providers of defense services | $3,000 per year for new registrants (Tier 1) |
| CMMC Level 1 or Level 2 self-assessment | DoD contractors and subcontractors handling FCI or CUI, as the contract specifies | No government fee, but internal effort and IT cost |
| AS9100 certification | Required or preferred by many aerospace buyers | Paid to a certification body, not the government |
| Nadcap accreditation | Special process suppliers whose buyers require it | Paid to PRI |
Certification and assessment costs vary with shop size, scope and how much of the system already exists. The cost pages for AS9100, CMMC and Nadcap give sourced ranges rather than guesses. Common questions are collected on the supplier FAQ.
If you are in Florida or on the Space Coast
Florida has a large aerospace and defense buying base, and Brevard County sits next to the launch sites. The Florida supplier page covers statewide resources, and the Space Coast page covers Brevard County specifically. There are also local pages for Melbourne, Titusville and Orlando, where the simulation and training cluster is concentrated.
Join the Aerospace Sourcing supplier network
Aerospace Sourcing is, for aerospace and defense buyers on Florida's Space Coast. Buyers send us requests for custom parts, ground support equipment, obsolete parts, certified surplus material, test lab time and small-business subcontractors. We match each job to qualified suppliers, flow down the requirements, track the job, check the paperwork and deliver with a cert package. We do not run machines ourselves, so the work goes to shops like yours.
Every supplier signs a flow-down NDA before seeing customer data, and you only learn the end customer if that customer approves. ITAR, EAR and CUI data never moves through the website. It moves by secure transfer, to US persons only.
Joining is free. You can sign up to receive RFQs, sell certified surplus, list spare test lab or cleanroom capacity, win subcontracts as a small business, get help preparing for CMMC, or get early access to quality paperwork software for FAI, C of C and traceability. We review every signup and contact you when work fits your shop. We do not promise a set volume of RFQs, but a complete profile is how we know to call you.
Questions
Do I need AS9100 before I can get any aerospace work?
Not always. Many buyers require AS9100 for flight hardware, but some will approve an ISO 9001 shop or an uncertified shop for lower-risk work such as tooling, fixtures or ground support equipment after a survey or source inspection. What every buyer expects is traceability, inspection records and control of nonconforming parts. Certification makes approval easier and opens more doors, so most shops that plan to stay in aerospace pursue it.
How much does SAM.gov registration cost?
Nothing. There is no charge to register in SAM.gov or to keep a registration active, and the UEI and CAGE code come with it. Ignore emails that offer to register you for a fee. Free help is available from the Federal Service Desk at fsd.gov. The registration must be renewed every 365 days, and federal guidance suggests starting the renewal 45 to 60 days early.
Do I need ITAR registration if I never export?
Possibly. Under 22 CFR 122.1, anyone in the US in the business of manufacturing defense articles must register with DDTC, and the regulation states that a manufacturer who does not export must still register. Whether your specific work counts as manufacturing defense articles depends on what you make and how it is classified, so get a qualified export control opinion if you are unsure.
Which CMMC level applies to a small machine shop?
It depends on the information you receive. If you only handle Federal Contract Information, Level 1 applies, with an annual self-assessment against 15 requirements. If you receive Controlled Unclassified Information, such as many defense drawings, Level 2 applies, covering the 110 requirements of NIST SP 800-171. The contract or purchase order specifies the level and whether a self-assessment or third-party assessment is required.
How long does it take to become an approved aerospace supplier?
There is no fixed timeline. SAM.gov registration takes at least ten business days to go active. AS9100 certification, if you need it, usually takes months of preparation plus the audit. Approval on a buyer's list depends on that buyer's survey process and your first orders. Shops that already have strong traceability and inspection records move fastest.
Is it free to join Aerospace Sourcing as a supplier?
Yes. Signing up at /suppliers/ is free. We review every signup and contact suppliers when a job fits their capabilities. We do not promise a set number of RFQs. Every supplier signs a flow-down NDA before seeing customer data, and controlled data moves only by secure transfer to US persons.
Related
Sources
- GSA SAM.gov Quick Start Guide: Registering a New Entity
- SAM.gov
- 22 CFR 122.1, Registration requirements (Cornell LII)
- 22 CFR 122.3, Registration fees (Cornell LII)
- Federal Register, ITAR registration fee rule, December 10, 2024
- DoD CIO, About CMMC
- 48 CFR 252.204-7019, NIST SP 800-171 DoD Assessment Requirements (Cornell LII)
- Federal Register, FAR inflation adjustment of acquisition-related thresholds (2025)
- IAQG OASIS database
- Amtivo, Aerospace standard revision (IA9100)
- SwRI PIMS and Progress AS9100D compliance matrix (clause 8.4.1.1)
- Boeing Suppliers, Nadcap FAQ
- SBA SubNet subcontracting network
Free to
join.
We contact you when work fits your shop.
Join the supplier network