Supplier Survey Questionnaire for Aerospace and Defense Buyers
A supplier survey is the numbered questionnaire a buyer sends a new shop before approving it: who they are and who owns them, what they are certified and accredited for, what they can make and measure, and how they control parts, sub-tiers, export data and cyber risk. Verify each answer against a public record, then score it.
Updated
How to use this questionnaire
Send this survey after the NDA and before the first RFQ, ask for evidence with every answer, and check each answer against a public record before you score it. A self-declared answer with no evidence scores low, no matter how good it sounds.
The questions are numbered 1 to 49 so your team and the supplier can refer to them by number. Each row says what to ask for and why. Delete rows that do not apply to the commodity, and add your own customer flow-downs. The survey decides whether a shop is worth an audit or a trial order; it does not replace an on-site audit for flight hardware, and it does not replace the quality clauses on the purchase order.
Supplier-side readers can use our supplier readiness checklist to prepare. Once a supplier is approved, deliveries are checked with the receiving inspection checklist.
Part A: company identity and registrations
Start with identity, because every later record (certificates, accreditations, export registration, SPRS) is tied to a legal name, an address and an identifier. Mismatches here are the first sign that a certificate belongs to a different site.
| # | Field / clause | What to enter or require | Why it matters / reference |
|---|---|---|---|
| 1 | Legal name and facilities | Legal business name, any DBA, and the physical address of every site that will perform work | Must match SAM.gov, the quality certificate and any accreditation; a certificate for another site does not cover this one |
| 2 | Unique Entity ID (UEI) | UEI as shown in SAM.gov | GSA made the SAM-generated UEI the authoritative entity identifier on April 4, 2022, replacing the DUNS number |
| 3 | CAGE code | CAGE code for each site that will perform work | FAR 52.204-13 (Oct 2018) lists the CAGE code among the data a registered entity enters in SAM |
| 4 | SAM registration status | Active or inactive, and the registration expiration date; check exclusions | FAR 52.204-13 requires the contractor to review and update its SAM registration on an annual basis |
| 5 | NAICS codes and size status | Primary NAICS code and small business status, plus any socioeconomic certifications | Drives subcontracting plan credit; see small business subcontracting |
| 6 | Key contacts | Named contacts for quality, contracts and export compliance, with email | You need a named person for SCARs, notices and export questions, not a sales inbox |
Part B: ownership and foreign ownership
Ask who owns the company, all the way up, and whether foreign persons own or control it. The answers decide whether controlled data can go to the shop at all, and they feed the representations you make to your own customer.
| # | Field / clause | What to enter or require | Why it matters / reference |
|---|---|---|---|
| 7 | Immediate owner | Legal name and CAGE code of the immediate owner, or "none" | Mirrors FAR 52.204-17 (Aug 2020), Ownership or Control of Offeror |
| 8 | Highest-level owner | Legal name and CAGE code of the entity that owns or controls the immediate owner | Same clause; a private equity or foreign parent shows up here |
| 9 | Foreign ownership | Do foreign persons own more than 50 percent of the outstanding voting securities? | ITAR definition at 22 CFR 120.65(a) |
| 10 | Foreign control | Do foreign persons hold 25 percent or more of the voting securities, or otherwise direct policy or operations? | 22 CFR 120.65(b) presumes foreign control at 25 percent unless a U.S. person holds an equal or larger share; DDTC registrants must disclose this under 22 CFR 122.2(b) |
| 11 | Pending changes | Any planned sale, merger, relocation or closure in the next 12 months | Prime clauses put notice periods on these events; see supplier quality clauses |
| 12 | Covered telecom equipment | Does the company use Huawei, ZTE, Hytera, Hikvision or Dahua telecom or video surveillance equipment or services? | FAR 52.204-25 (Nov 2021) flows to all subcontracts and requires a report within one business day of identifying covered equipment |
Part C: quality system and special process approvals
Ask for certificate numbers, not logos, and look each one up. Certificate data for 9100-series registrations sits in the IAQG OASIS database; Nadcap accreditations sit in the eAuditNet Online QML.
| # | Field / clause | What to enter or require | Why it matters / reference |
|---|---|---|---|
| 13 | Quality system standard | AS9100, AS9120 (distributors) or ISO 9001, with certificate number, certification body and expiry | Verify in IAQG OASIS; certificate data is the public tier, audit results are the private tier |
| 14 | Certificate scope and sites | The scope statement and every site listed on the certificate | A scope of "machining" does not cover welding or assembly the shop also quotes |
| 15 | OASIS Tier 2 access | Will the supplier grant you access to its Tier 2 audit data? | AS9104/1 section 18.1 says organizations shall provide Tier 2 access to their aviation, space and defense customers on request unless they justify a refusal, as quoted in a supplier's published letter dated March 3, 2026 |
| 16 | Special processes in house | Each process (heat treat, chemical processing, NDT, welding, coatings) with the specification and revision it is run to | Special processes cannot be fully verified by later inspection; see heat treatment and surface finishing |
| 17 | Nadcap accreditation | Nadcap commodity, audit checklist, and expiration date for each accredited process | Verify in eAuditNet Online QML by supplier and site; a Lockheed Martin guide (December 2017) notes that a company appearing in eAuditNet is not evidence of accreditation |
| 18 | Outside special process sources | Who performs subcontracted special processes and how the supplier confirms the source is approved for your customer | Primes restrict processors by specification; see Nadcap accreditation |
| 19 | Customer approvals and status | Which aerospace customers list the supplier, for what scope, and any probation or restricted status | Ask for evidence such as an approval letter; scope matters more than the customer name |
| 20 | Escapes and open corrective actions | Quality escapes and open SCARs in the last 12 months, with status | Shows whether the corrective action system works; see corrective action and SCARs |
Part D: equipment, capacity, calibration and inspection
Ask what the shop can make and, separately, what it can measure. A shop that can hold a tolerance it cannot measure will ship parts it cannot prove.
| # | Field / clause | What to enter or require | Why it matters / reference |
|---|---|---|---|
| 21 | Major equipment list | Machine or process type, axes, work envelope and quantity, as a list rather than a brochure | Match to your part size and features; see machine classes |
| 22 | Capacity | Shifts worked, current load, and the largest order of this type completed in the last year | Separates real capacity from optimism; plan against it with the need-date planner |
| 23 | Calibration system | Recall system, interval method, and the out-of-tolerance procedure that traces back to product measured with a bad gage | The recall step is what protects shipped product |
| 24 | Calibration sources | Name of each calibration provider and whether it is accredited to ISO/IEC 17025 for the measurements performed, or which standard it calibrates to | ISO/IEC 17025:2017 is the accreditation standard for calibration labs; NCSL International lists ANSI/NCSL Z540.3-2006 as withdrawn as an active standard in October 2020 and superseded by ISO/IEC 17025:2017, yet some contracts still cite it, so confirm which one your contract requires |
| 25 | Inspection equipment | CMM make and size, measurement software, surface finish, hardness, thread and optical equipment | Must resolve your tightest tolerance; see inspection and metrology |
| 26 | First article capability | Sample AS9102 report (redacted) with a ballooned drawing | See AS9102 first article inspection |
| 27 | Inspector and NDT qualification | How inspectors are trained; NDT personnel certification standard where NDT is in house | NDT is commonly qualified to NAS 410; see nondestructive testing |
| 28 | Record retention | Retention period and format for travelers, certs and inspection data | Must meet or exceed what your contract requires; see records and change control |
Part E: counterfeit prevention and sub-tier control
Ask how the supplier buys, not just how it builds. Most counterfeit and traceability failures enter through the supplier's own purchasing.
| # | Field / clause | What to enter or require | Why it matters / reference |
|---|---|---|---|
| 29 | Counterfeit prevention plan | Written plan, with the standard it follows: SAE AS5553 for EEE parts, AS6174 for other materiel | Attach the plan; a policy sentence is not a plan |
| 30 | Electronic part sources | Whether EEE parts come only from the original manufacturer or its authorized suppliers, and what happens when they cannot | DFARS 252.246-7008 (Jan 2023) sets that order and requires the contractor to notify the contracting officer when it buys from other sources |
| 31 | Traceability evidence | Example of the paperwork chain from original manufacturer to delivery | The same clause requires processes to trace electronic parts from the original manufacturer to government acceptance |
| 32 | Suspect counterfeit handling | Quarantine, reporting and GIDEP participation | DFARS 252.246-7007 bars returning counterfeit or suspect counterfeit electronic parts to the seller; see counterfeit parts avoidance |
| 33 | Sub-tier selection | How sub-tier suppliers are approved and monitored, and whether they must hold AS9100, AS9120 or ISO 9001 | You inherit your supplier's supplier |
| 34 | Flow-down | Confirmation that your quality clauses, right of access and special requirements go onto every sub-tier PO | Clauses that stop at tier one are a common audit finding |
| 35 | Specialty metals | Ability to certify compliance with DFARS specialty metals requirements and give melt country | See DFARS specialty metals |
Part F: export control and cybersecurity
Ask what controlled data the shop can legally and technically handle before you send any. Do not send ITAR or CUI drawings with the survey; see controlled programs for how we move controlled data.
| # | Field / clause | What to enter or require | Why it matters / reference |
|---|---|---|---|
| 36 | DDTC registration | Registration status and expiration date, or a statement that the supplier does not manufacture defense articles | Manufacturers of defense articles register under 22 CFR 122.1; see ITAR registration |
| 37 | Export compliance program | Written program, a named empowered official or export manager, and how foreign person access to technical data is controlled | Controls must reach the shop floor, screens and file shares |
| 38 | EAR classification and screening | How the supplier classifies items and screens parties | Applies to commercial and dual-use work as well as defense work |
| 39 | Information handled | Whether the supplier will handle Federal Contract Information only, or CUI as well | Sets which cyber requirements apply |
| 40 | NIST SP 800-171 assessment | Assessment level, date and summary score as posted in SPRS, and the planned date to reach 110 | DFARS 252.204-7019 (Nov 2023) requires a current assessment, not more than 3 years old unless the solicitation sets less, posted in SPRS |
| 41 | Incident reporting | Ability to report cyber incidents within 72 hours via DIBNet, a DoD-approved medium assurance certificate, and any cloud service used for covered defense information | DFARS 252.204-7012 (May 2024) requires 72-hour reporting and FedRAMP Moderate equivalent cloud security |
| 42 | CMMC status | CMMC level, status (conditional or final), CMMC unique identifier and date of the last annual affirmation | DFARS 252.204-7021 (Nov 2025) requires a current CMMC status and annual affirmation in SPRS; confirm current program status on the DoD CIO site before making this a knockout |
Part G: insurance, performance and continuity
Close with the questions that predict whether the supplier will still be delivering in a year.
| # | Field / clause | What to enter or require | Why it matters / reference |
|---|---|---|---|
| 43 | Certificates of insurance | Current certificates for the coverages your contracts team requires, with limits and expiry | Your contracts team sets types and limits; ask whether the supplier can name you as additional insured |
| 44 | On-time delivery | On-time delivery rate for the last 12 months, and whether it is measured to the customer's requested date or the promised date | The two give very different numbers; see supplier scorecards |
| 45 | Quality performance | Rejection rate or PPM for the last 12 months, and recent customer scorecards if the supplier will share them | Ask how rejects are counted: by part, by lot or by line |
| 46 | Business continuity | Single points of failure (one machine, one person, one certified material source), backup power, data backup and the recovery plan | ISO 22301 certification is optional evidence; a written plan with named alternates is the minimum |
| 47 | Financial condition | Willingness to share financial statements or a credit report under NDA | A supplier that fails mid-program costs more than a late one |
| 48 | References | Two or three aerospace or defense customer references for similar work | Ask references about paperwork and responsiveness, not only quality |
| 49 | Attestation | Name, title, signature and date of an officer attesting that the answers are accurate | Makes the survey a record you can rely on |
How to score the answers
Score in three passes: knockouts, evidence scores, then weighted totals. The numbers below are a starting point for your own procedure, not an industry standard.
Pass 1, knockouts. Any of these ends the evaluation for the scope in question: no active SAM registration when your contract requires it; an exclusion in SAM; a quality certificate that cannot be found in OASIS or does not cover the site; a required Nadcap accreditation missing from eAuditNet; foreign ownership or control for ITAR work without the needed authorization; covered telecom equipment under FAR 52.204-25; no SPRS score when DFARS 252.204-7019 applies.
Pass 2, evidence scores. Score every remaining question 0 to 3.
| Score | Meaning | Example |
|---|---|---|
| 3 | Answered, with evidence you verified in a public record or document | Certificate found in OASIS with matching site and scope |
| 2 | Answered, with a document you could not independently verify | Calibration certificate from a lab whose accreditation scope you did not check |
| 1 | Answered, no evidence | "We have a counterfeit prevention plan" with nothing attached |
| 0 | Not answered, or the answer shows a gap | No out-of-tolerance recall procedure |
Pass 3, weights. Convert each part to a percentage of its maximum and weight it by what the commodity puts at risk.
| Part | Machined or processed flight parts | Distributor of standard hardware |
|---|---|---|
| A and B, identity and ownership | 10 percent | 10 percent |
| C, quality and special processes | 25 percent | 20 percent |
| D, equipment, calibration, inspection | 25 percent | 10 percent |
| E, counterfeit and sub-tier | 15 percent | 35 percent |
| F, export and cyber | 15 percent | 15 percent |
| G, insurance, performance, continuity | 10 percent | 10 percent |
A typical decision rule: 80 percent or more with no knockouts, approve for the stated scope; 60 to 79 percent, conditional approval with a corrective action plan, source inspection or tightened receiving; below 60 percent, do not approve. Record the scope with the approval, since a shop approved for 3-axis aluminum work is not approved for welded titanium.
Where to verify each answer
| Answer | Where to check | What to look for |
|---|---|---|
| UEI, CAGE, registration, exclusions | SAM.gov entity search | Active status, expiration date, name and address match, no exclusion record |
| AS9100, AS9120 certificate | IAQG OASIS | Certificate listed, site and scope match, not suspended or expired |
| Nadcap | eAuditNet Online QML | Commodity, audit checklist in the scope, issue and expiration dates for that site |
| Calibration accreditation | The accreditation body's directory named on the lab's certificate | Scope covers the measurement type and range |
| NIST SP 800-171 and CMMC | SPRS printout or screenshot from the supplier, with dates | Score, assessment date, CMMC status and affirmation date |
| DDTC registration | The supplier's current registration letter | Registrant name matches the legal name, expiration date in the future |
Re-verify at each re-survey. Certificates, accreditations, SAM registrations and SPRS scores all expire on different cycles.
How to adapt this template
- Delete parts that do not apply. A COTS distributor does not need Part D in depth; a machine shop with no electronics needs only the counterfeit rows that cover materiel.
- Add your customer's requirements by document and revision, for example a prime's supplier quality manual, and ask the supplier to confirm it has read it.
- Set re-survey intervals by risk, and trigger an early re-survey on an ownership change, a lost certificate or a quality escape.
- Keep the completed survey, evidence and score with the approval record.
- Have your own contracts, legal and quality teams review the template before use. It is a working draft for buyers, not legal advice, and it does not replace your quality management system procedures.
What goes on the RFQ and PO after approval
Approval sets the scope; the RFQ and PO carry the requirements. Name the approved scope, the quality clauses and revisions, FAI, special process sources, counterfeit and specialty metals clauses, export classification and the paperwork to ship with each lot. The RFQ builder and the aerospace RFQ checklist cover what to send, and supplier quality clauses covers how primes write those requirements.
Skip the survey cycle on your next job
We qualify suppliers against requirements like these, flow your clauses down by number and revision, check the paperwork before delivery and ship with a certificate package. Mutual NDA before files, and controlled data never goes through the website. Request a quote with your requirements attached; a person replies within 1 business day.
Send the job. A person replies within 1 business day.
Part, quantity and date are enough to start. Drawings and the mutual NDA follow by reply, and controlled programs never send technical data through this site.
We have it.
Reference . A person replies within 1 business day. Watch for our email from [email protected].
Questions
What is the difference between a supplier survey and a supplier audit?
A survey is a questionnaire the supplier fills in and you verify against records and documents. An audit is an on-site or remote examination of how the supplier actually works, with objective evidence gathered by your auditor. Buyers use the survey to screen and scope, then audit the suppliers that pass, especially for flight hardware, special processes and new technologies. A survey alone is weak evidence for high-risk parts.
How do I check a supplier's AS9100 certificate?
Look it up in the IAQG OASIS database by company name and site. Confirm that the certificate is listed, that the site address and scope match the work you are buying, and that it is not suspended or expired. Certificate data is public. Audit results are in the private Tier 2 data, which suppliers are expected to share with aerospace customers on request under AS9104/1 unless they justify a refusal.
Can a supplier with foreign ownership work on ITAR parts?
Possibly, but it changes what you can send them. ITAR treats a firm as foreign owned above 50 percent foreign ownership of voting securities and presumes foreign control at 25 percent under 22 CFR 120.65. Foreign persons need authorization to receive ITAR technical data. Ask the questions in Part B, then have your export compliance team decide before any controlled data moves.
Should CMMC be a knockout question?
Only if your contract requires a CMMC level from the supplier. DFARS 252.204-7021 requires a current CMMC status where the contract specifies a level, and it flows to subcontracts involving FCI or CUI. On July 13, 2026 DoD suspended the Phase II third-party assessment requirements, while Phase I self-assessments and DFARS 252.204-7012 still apply. Confirm the current program status before you set the rule.
How often should suppliers be re-surveyed?
Set the interval by risk in your own procedure. Many buyers re-survey critical suppliers more often than low-risk ones, and trigger an immediate re-survey after an ownership change, a lost or suspended certificate, a move to a new site or a significant quality escape. Every re-survey should repeat the public record checks, because registrations and accreditations expire on their own cycles.
Can I use this questionnaire as written?
Use it as a draft. Remove rows that do not apply to the commodity, add your customer's flow-downs by document and revision, and set your own scoring thresholds. Your contracts, legal and quality teams must review it before it is sent, because it will become part of your supplier approval records. We provide it as a buyer's working template, not legal advice.
Related
Sources
- GSA, Systems switch to Unique Entity ID (SAM) on April 4, 2022
- FAR 52.204-13, System for Award Management Maintenance (Oct 2018)
- FAR 52.204-17, Ownership or Control of Offeror (Aug 2020)
- FAR 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (Nov 2021)
- 22 CFR 120.65, Foreign ownership and foreign control (Cornell LII)
- 22 CFR 122.2, Submission of registration statement (Cornell LII)
- DFARS 252.204-7019, Notice of NIST SP 800-171 DoD Assessment Requirements (Nov 2023)
- DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (May 2024)
- DFARS 252.204-7021, Contractor Compliance with the CMMC Level Requirements (Nov 2025)
- Davis Wright Tremaine, Department of Defense suspends CMMC Phase II (July 2026)
- DFARS 252.246-7008, Sources of Electronic Parts (Jan 2023)
- Lockheed Martin, Nadcap approvals: how to register and use eAuditNet Online QML (December 2017)
- The Timken Company, OASIS level 2 access request response (March 3, 2026), quoting AS9104/1 section 18.1
- NCSL International, ANSI/NCSL Z540.3 status page
Ready to
source it?
A person replies within 1 business day. NDA first.
Request a quote