How to Qualify a New Aerospace Supplier, Step by Step
Qualify a new aerospace supplier in two halves. First run the desk checks: SAM.gov exclusions, CAGE, the certificate in OASIS, Nadcap in PRI's QML, ITAR registration, restricted party screening, and NIST SP 800-171 and CMMC status. Then prove capability with a survey or audit, a first article and probation before adding it to your approved supplier list with a defined scope.
Updated
The steps, in the order a buyer runs them
Qualify a new aerospace supplier in two halves: first the desk checks that can disqualify a company in an afternoon (federal status, identifiers, certificates, export and cyber status), then the slower evidence that it can actually make your part (survey or audit, first article and a probation period). Only then add it to your approved supplier list with a defined scope.
| Step | Check | Where you verify it | Keep in the file |
|---|---|---|---|
| 1 | Scope and risk tier | Your own requirements | Intended scope, risk rating |
| 2 | Entity status and exclusions | SAM.gov | Dated search result, disclosure |
| 3 | CAGE code for the right location | SAM.gov or cage.dla.mil | CAGE, legal name, address, owner CAGE |
| 4 | AS9100, AS9110 or AS9120 certificate | IAQG OASIS | Certificate, scope, sites, expiry |
| 5 | Nadcap accreditation | PRI eAuditNet online QML | Commodity, scope, expiry per site |
| 6 | ITAR registration | Supplier evidence; DDTC rules | Registration status and expiry, US person controls |
| 7 | Restricted party screening | Consolidated Screening List | Dated screening result |
| 8 | NIST SP 800-171 score and CMMC status | Supplier evidence from SPRS | Score date, CMMC level, UID, affirmation |
| 9 | Survey and audit | Questionnaire, on-site or remote visit | Survey, findings, closures |
| 10 | First article | AS9102 report on the first order | Accepted FAI |
| 11 | Probation | Receiving and delivery data | Conditional approval terms |
| 12 | Approval with scope | Your approved supplier list | ASL entry |
| 13 | Periodic re-evaluation | Scorecard and expirations | Review record |
Date every check. Registrations, certificates and scores expire, and an auditor will ask what you saw and when.
Step 1: Define the scope and the risk before you look
Decide what you are approving the supplier for before you start, because the scope sets which checks apply. A shop that will machine aluminum brackets for ground equipment needs a different review from one that will heat treat flight structure or handle controlled technical data.
Write down the product or process family, whether the work is flight or non-flight, whether it involves special processes, whether ITAR or EAR data will be shared, whether the contract carries DFARS cybersecurity clauses, and what volume and dollar value you expect. Assign a risk tier from that. High-risk scopes get an on-site audit and a longer probation; low-risk scopes may be approved on a desk review and a clean first order.
Have a part like this?Send it in under a minute. A person replies within 1 business day.Step 2: SAM.gov entity status and exclusions
Search the supplier in SAM.gov and confirm two things: the entity record you are looking at is the right legal entity and location, and it has no active exclusion.
The exclusion check is a contract requirement on most federal work. FAR 9.405-2(b) prohibits contractors from entering into any subcontract in excess of $45,000, other than one for a commercially available off-the-shelf item, with a party that is debarred, suspended, proposed for debarment or voluntarily excluded, unless there is a compelling reason. The clause at FAR 52.209-6 requires the contractor to get a written disclosure from each proposed subcontractor above that threshold stating whether it or its principals are excluded, and to notify the contracting officer in writing before subcontracting with an excluded party. The clause flows down to subcontracts other than those for commercial products or services.
While you are in SAM, note the registration status and expiration, and review the annual representations. One worth reading on any supplier of equipment or services is FAR 52.204-26, where an offeror represents whether it provides or uses covered telecommunications equipment or services as defined in FAR 52.204-25. Save a dated copy of the search results; a screenshot taken the day you approved the supplier is the evidence.
Step 3: CAGE code for the location you are buying from
Record the CAGE code for the specific plant that will make your parts, not just the company name, because CAGE codes are assigned by location.
FAR 4.1802 requires offerors to provide the CAGE code assigned to the offeror's location, and, if owned or controlled by another entity, the CAGE code and legal name of that entity. FAR 4.1803 tells contracting officers that active SAM registrations have had their CAGE codes verified, and that entities not required to register in SAM can be validated with the search at cage.dla.mil. Buyers can use the same two routes.
Check that the CAGE address matches the address on the quality certificate and the address that will ship your parts. A supplier with several plants may hold AS9100 at one site and quote you from another. The owner CAGE also tells you who ultimately controls the company, which feeds the export control and foreign ownership questions below.
Step 4: Verify the quality certificate in OASIS
Do not accept a PDF certificate on its own: look the supplier up in the IAQG OASIS database and confirm the standard, the site, the scope and the expiry match what you were sent.
OASIS is the IAQG database of organizations certified to the aerospace quality management system standards under IAQG rules: AS9100 for design and manufacturing, AS9110 for maintenance organizations and AS9120 for distributors. The requirements for publishing certificate and audit data in OASIS sit in AS9104/1. Certificate data is public to registered users; audit details are visible only to users the certified organization grants access to. For high-risk scopes, ask the supplier to grant your company access to its audit results so you can read nonconformities and closures, not just the certificate.
Check that the certificate standard matches the work. A distributor certified to AS9120 is appropriate for buying parts; it is not evidence of manufacturing control. If the supplier is not in OASIS, or the record does not match the certificate, treat it as unverified and contact the certification body named on the certificate.
Step 5: Check Nadcap accreditation in the PRI QML
If the supplier will perform special processes for you, verify each process and each site in the Qualified Manufacturers List on PRI's eAuditNet, not from a logo on a website.
Lockheed Martin's supplier quality guide to eAuditNet (December 2017) describes the method: register for an eAuditNet account, open the online QML, search the supplier by name and confirm the address to select the right location, open the commodity, then use "Show scopes" to find the specific audit checklist or specification you need. The same guide gives two cautions worth copying into your procedure. A company that only registered on eAuditNet can appear in the search, so no level of pending accreditation should be assumed from a listing. And a "No records were found" message means the selected location has no active accreditations.
Accreditation is granted per commodity, per scope and per site, with an expiration date. Record all three. A heat treater accredited for aluminum may not hold the scope for steel, and an accreditation at the supplier's main plant does not cover a second building across town. The Nadcap accreditation guide explains the program from the supplier side.
Step 6: Ask the ITAR registration questions
If the part or its technical data is a defense article under the ITAR, ask whether the supplier is registered with DDTC, get evidence of current registration, and confirm how it restricts controlled data to authorized persons.
Under 22 CFR 122.1(a), any person who engages in the United States in the business of manufacturing or exporting defense articles, or furnishing defense services, must register, and one occasion of manufacturing is enough to be engaged in the business. A manufacturer that does not export must still register. Limited exemptions exist, including fabrication solely for experimental or scientific purposes. Registration is renewed each year with a fee under 122.3, and under 122.4 a registrant must notify DDTC within five days of certain events, including changes in ownership or control. Registrants also certify whether they are foreign owned or foreign controlled.
Questions to put on the survey:
- Are you registered with DDTC, and what is the current expiration date? Provide your registration evidence.
- Are you foreign owned or controlled, and has ownership changed in the last year?
- Who will have access to our technical data, and how do you restrict it to US persons or licensed persons?
- Will any of the work or data go to a sub-tier supplier, and how do you flow down export control?
Our side of this is described on controlled programs; the supplier-side guide is ITAR registration.
Step 7: Screen against the Consolidated Screening List
Run the supplier, its owners and any foreign sub-tier or ship-to names through the Consolidated Screening List before you share data or place an order.
The CSL, published by the International Trade Administration, combines restricted party lists from three departments: Commerce's Bureau of Industry and Security (including the Denied Persons List, Entity List, Unverified List and Military End User List), State (including the AECA Debarred List and nonproliferation sanctions) and Treasury's Office of Foreign Assets Control (including the Specially Designated Nationals List). Its fuzzy name search returns near matches, which helps with transliterated names.
The CSL is an aid, not the official source. If a result looks like a match, do further due diligence and check the official list of the agency that published it before proceeding, because a match can mean a prohibition, a license requirement or an end-use review. Keep the dated result even when it is clean.
Step 8: NIST SP 800-171 score and CMMC status
If the work involves controlled unclassified information on a DoD contract, confirm the supplier has a current NIST SP 800-171 assessment in SPRS and the CMMC status your contract requires, and check the current CMMC phase before you rely on any summary, including this one.
DFARS 252.204-7020(g) bars a contractor from awarding a subcontract subject to NIST SP 800-171 under DFARS 252.204-7012 unless the subcontractor has completed, within the last 3 years, at least a Basic assessment for its covered systems. SPRS summary scores are visible to DoD personnel and to the contractor's own authorized representatives, so as a buyer you usually ask the supplier for evidence: the score, the assessment date and the system it covers.
CMMC is now in contracts. The 32 CFR Part 170 program rule took effect December 16, 2024, and the DFARS rule took effect November 10, 2025, which started Phase 1. Under 32 CFR 170.3(e), Phase 2 begins one calendar year after Phase 1, and DoD states it intends to add Level 2 (C3PAO) status as a condition of award for applicable contracts from that point. On July 13, 2026 DoD suspended the move to Phase 2, so third-party Level 2 status is not yet a general condition of award. Confirm the current status on the DoD CIO site and in your contract clause before treating it as a requirement. DFARS 252.204-7021 requires the prime to flow down the correct CMMC level and to ensure subcontractors complete an affirmation of continuous compliance before subcontract award. Ask the supplier for its CMMC status (for example Final Level 2 (Self) or Final Level 2 (C3PAO)), the CMMC unique identifier recorded in SPRS, and the date of the latest affirmation. Phase timing and requirements can change, so confirm the current status on the DoD CIO CMMC pages and in the clause on your contract.
The CMMC guide for small shops explains what suppliers go through to get there.
Step 9: Survey, then audit on site or remotely
Send a written survey first, then decide from the answers and the risk tier whether you need to see the operation in person.
The supplier survey questionnaire gives a copy-ready set of questions. When you audit, follow one of your own part types through the shop instead of reviewing the quality manual in a conference room: contract review, material receiving and cert review, traveler and process control, special process sources, calibration of the gauges that will measure your characteristics, nonconforming material control, FAI practice, record retention, and how controlled data is stored. A remote audit with a live video walk-through and document sharing can work for lower-risk scopes; special processes and flight-critical work justify the trip.
Record findings with due dates and do not approve until the findings that matter for your scope are closed. The corrective action page covers how to judge a supplier's root cause.
Steps 10 and 11: First article, then probation
Make the first order the real test: require a full AS9102 first article and run the supplier under conditional status until it has a delivery and quality record.
The first article proves the supplier's process can make your part to every characteristic on the drawing and the PO; see first article inspection. During probation, common conditions are 100 percent receiving inspection or source inspection, a cap on order value or quantity, no subcontracting without approval, and a review after a set number of lots. Write the exit criteria down at the start, such as a number of consecutive accepted lots and on-time deliveries, so the supplier knows what full approval takes.
Step 12: Add the supplier to the ASL with a defined scope
Enter the supplier on your approved supplier list with its approval status and the exact scope, because AS9100 requires both.
AS9100 clause 8.4.1.1 requires the organization to maintain a register of its external providers that includes approval status, such as approved, conditional or disapproved, and the scope of the approval, such as product type or process family. A useful entry also records the site and CAGE, the certificates and accreditations with their expiry dates, any restrictions, and the date of the next review. The supplier-side view of the same process is on how shops get on an approved supplier list.
Step 13: Re-evaluate on a schedule and on triggers
Approval is not permanent: re-check expiring credentials on their dates, review performance on a fixed cycle, and re-qualify when something material changes.
ISO 9001 clause 8.4.1, which AS9100 builds on, requires criteria for the evaluation, selection, monitoring of performance and re-evaluation of external providers. In practice that means three things:
- Calendar checks. Track the expiry of the AS9100 certificate, each Nadcap accreditation, DDTC registration, SAM registration, the NIST SP 800-171 assessment date and the CMMC affirmation date. Rerun exclusion and CSL screening on a fixed cycle.
- Performance review. On-time delivery, receiving rejects, escapes and corrective action response; see supplier scorecards.
- Trigger events. A change of ownership, a move to a new site, a lost certificate, a serious escape or a new process family should prompt a new review, and often a new first article.
What to put on the PO or RFQ for a new supplier
- The supplier's legal name, CAGE code and the site that will perform the work.
- The quality system requirement (AS9100, AS9110 or AS9120) and that the certificate must be maintained in OASIS.
- Required special process accreditations by commodity, and a ban on changing processors without approval.
- Export control statement: whether the item or data is ITAR or EAR controlled and the US person or license requirements.
- DFARS cybersecurity clauses that apply, including the required CMMC level, when CUI or FCI is involved.
- The FAR exclusion disclosure where FAR 52.209-6 applies.
- Full AS9102 first article on the first order, and any source inspection during probation.
- Right of access for you, your customer and government representatives.
- No subcontracting without written approval, with flow down of all requirements to approved sub-tiers.
- Notification requirements for changes in ownership, site, certification status or process.
The clause wording that goes behind these items is covered in supplier quality clauses.
Source through suppliers that are already checked
If you need a part made but cannot spare the weeks to qualify a new shop, send the drawing and your quality requirements. We match the job to qualified suppliers, flow down your requirements including certifications, special process approvals, export control and FAI, check the certificate package before shipment, and a person replies within one business day. We sign a mutual NDA before files, and controlled data never moves through the website; see confidentiality.
Send the job. A person replies within 1 business day.
Part, quantity and date are enough to start. Drawings and the mutual NDA follow by reply, and controlled programs never send technical data through this site.
We have it.
Reference . A person replies within 1 business day. Watch for our email from [email protected].
Questions
How long does it take to qualify a new aerospace supplier?
The desk checks in SAM.gov, OASIS, the Nadcap QML and the Consolidated Screening List can be done in a day if the supplier responds quickly. The survey, any audit, corrective action closure, first article and probation take much longer, often spanning several orders. Risk sets the pace: a low-risk ground support scope can be approved on a desk review and one clean order, while flight hardware with special processes usually needs an on-site audit.
Can I see a supplier's SPRS score myself?
Usually not directly. Under DFARS 252.204-7020, SPRS summary scores are available to DoD personnel and to the contractor's own authorized representatives. As a buyer you normally ask the supplier for evidence of its score, the assessment date and the systems covered, and for CMMC, its status, CMMC unique identifier and latest affirmation date. Keep that evidence in the supplier file.
Is an AS9120 distributor certificate enough for a machined part supplier?
No. AS9120 is the aerospace quality standard for distributors, which buy, store and resell parts. It shows control of traceability and handling, not of manufacturing processes. A company that machines or fabricates your part should hold AS9100 for that site and scope, or meet whatever alternative your quality requirements accept. Check the standard and scope in OASIS, not just the logo.
What does it mean if a supplier shows in eAuditNet but has no records?
It means the selected location has no active Nadcap accreditation. Lockheed Martin's eAuditNet guide notes that a company can appear simply because it registered an account, so a listing implies no level of pending accreditation. Ask the supplier for its accreditation scope and dates, and confirm each one in the online QML for the exact site that will process your parts.
Does a supplier that never exports need ITAR registration?
Generally yes, if it manufactures defense articles. 22 CFR 122.1(a) says a manufacturer who does not engage in exporting must nevertheless register, and one occasion of manufacturing a defense article is enough. Limited exemptions exist, such as fabrication solely for experimental or scientific purposes. Ask for evidence of current registration and how the supplier controls access to technical data.
How often should approved suppliers be re-evaluated?
Set a fixed cycle in your procedure, often annually, and track expiring credentials on their own dates. ISO 9001 clause 8.4.1, on which AS9100 builds, requires criteria for re-evaluation of external providers, but leaves the interval to you. Also re-evaluate on triggers such as a change of ownership or site, a lost certificate, a serious quality escape or a new process family.
Related
Sources
- FAR 9.405-2, Restrictions on subcontracting (acquisition.gov)
- FAR 52.209-6, Protecting the Government's Interest When Subcontracting With Contractors Debarred, Suspended, Proposed for Debarment, or Voluntarily Excluded
- FAR 4.1802, CAGE code policy (acquisition.gov)
- PJR, OASIS overview for certified organizations (PDF)
- Lockheed Martin MFC, Nadcap approvals: how to register and use eAuditNet (December 2017, PDF)
- 22 CFR 122.1, Registration requirements (Cornell LII)
- International Trade Administration, Consolidated Screening List
- 48 CFR 252.204-7020, NIST SP 800-171 DoD Assessment Requirements (Cornell LII)
- DFARS 252.204-7021, Contractor Compliance With the CMMC Level Requirements (acquisition.gov)
- 32 CFR 170.3, CMMC applicability and implementation phases (Cornell LII)
- Federal Register, DFARS Case 2019-D041 final rule, effective November 10, 2025
- Auditor Training Online, ISO 9001 clause 8.4 control of external providers
Ready to
source it?
A person replies within 1 business day. NDA first.
Request a quote