Sourcing Parts and Small Business Suppliers for Defense Contractors

What defense primes and subs typically need sourced

On a defense program, the drawing is only half the requirement. The other half is the list of contract clauses the prime has to flow down, and a supplier who cannot meet them cannot take the order no matter how good its machines are.

The outside work defense contractors buy most often includes machined and fabricated parts built to print, harnesses and electronic assemblies, special processes such as heat treat, plating and NDT, obsolete or hard to find components, test fixtures and tooling, and qualified small businesses to fill subcontracting plan goals. Each comes with its own paperwork, and the clauses below decide which suppliers are even eligible.

Defense work on the Space Coast

Brevard County has a large defense industrial base alongside its launch sites. A few examples from public reporting:

• L3Harris Technologies is headquartered in Melbourne.
• Northrop Grumman runs a Melbourne campus that ClearanceJobs reported in August 2026 is home to a workforce of about 5,000 in two million square feet of facilities. The company had just opened a new 300,000 square foot engineering facility there focused on next generation aircraft, with room for more than 1,200 additional engineers and 17 secure laboratories.
• Lockheed Martin is building an approximately 225,000 square foot facility in Titusville to produce components for the Trident II D5LE2 submarine launched ballistic missile. The company said it is anticipated to be ready for operations in 2027.
• Space Launch Delta 45 at Patrick Space Force Base runs the Eastern Range, which supports national security launches such as ULA's USSF-87 mission in February 2026.

These companies are named to describe the local market. None of them is a Aerospace Sourcing customer or partner.

DFARS clauses that change who you can buy from

Specialty metals, DFARS 252.225-7009

This clause requires specialty metals in delivered items to be melted or produced in the United States, its outlying areas, or a qualifying country, subject to listed exceptions. Specialty metals include certain steels above set alloy content limits, nickel and iron-nickel alloys and cobalt alloys with more than 10 percent other alloying metals, titanium and titanium alloys, and zirconium and zirconium alloys. There is a minimal content exception when noncompliant specialty metal is no more than 2 percent of the total weight of specialty metals in the end item, but it does not apply to high performance magnets. The prime must flow paragraphs (a) through (c) to subcontracts for items containing specialty metals, including commercial products.

In practice this means material certs have to show where the metal was melted, and a shop that buys bar stock from an unknown distributor can turn a good part into a nonconforming one. Say on the PO that DFARS compliant material is required.

Counterfeit electronic parts, DFARS 252.246-7007 and 252.246-7008

252.246-7007 requires contractors subject to the Cost Accounting Standards to run a counterfeit electronic part detection and avoidance system covering training, inspection and testing, traceability, reporting suspect parts to the contracting officer and GIDEP, flow-down to subcontractors, and control of obsolete parts. 252.246-7008 sets the buying order: first from the original manufacturer, its authorized suppliers, or suppliers who buy only from them; then from contractor approved suppliers using industry counterfeit prevention standards, with the contractor responsible for authenticity; and otherwise only with written notice to the contracting officer and inspection, testing and authentication. It flows down to subcontracts for electronic parts or assemblies, except to the original manufacturer.

The industry standards behind these practices are SAE AS5553 for organizations that buy and use electronic parts, AS6081 for independent distributors, and AS6174 for non-electronic materiel. Our counterfeit parts avoidance page goes deeper, and obsolete aerospace parts covers buying hard to find components safely.

Safeguarding covered defense information, DFARS 252.204-7012

Any supplier that will handle covered defense information, which includes controlled technical drawings, must provide adequate security, meaning NIST SP 800-171 for its own systems, report cyber incidents to DoD within 72 hours of discovery, and use cloud services that meet security requirements equivalent to the FedRAMP Moderate baseline. The clause flows down unaltered to subcontracts involving covered defense information, and subcontractors report incidents up the chain.

CMMC flow-down in 2026

CMMC is in contracts, but its rollout changed this year, so check the current status before you write requirements into a subcontract.

• Phase 1 began November 10, 2025, when the DFARS rule putting CMMC into solicitations took effect. It requires Level 1 or Level 2 self-assessments as a condition of award on applicable contracts. DFARS 252.204-7021 requires primes to flow the right CMMC level to subcontractors that will process, store or transmit federal contract information or CUI.
• Phase 2 was scheduled for November 10, 2026, when Level 2 certification by a third-party assessor (C3PAO) would have become the default for many contracts involving CUI. On July 13, 2026, the Department of War suspended Phase 2 and later phases and set up a CMMC Reform Task Force to review the program.
• Still in effect during the suspension, according to law firm summaries of the announcement: Phase 1 self-assessments, DFARS 252.204-7012, NIST SP 800-171 Revision 2 as the baseline, SPRS score submission, and 72-hour incident reporting.

For buyers, the practical point is unchanged: before sending a CUI drawing to a supplier, confirm the supplier has a current SPRS score and can protect the data. We ask suppliers about their cyber status when they join, and we do not send CUI through our website.

ITAR and controlled technical data

If the part is a defense article on the US Munitions List, the supplier making it generally must be registered with the State Department's Directorate of Defense Trade Controls. Under 22 CFR 122.1, a manufacturer of defense articles must register even if it does not export. The annual fee for a new registrant is $3,000 under the fee schedule that took effect January 9, 2025, so a small shop that has never needed it may not have registered yet.

Registration alone does not authorize sharing technical data with foreign persons. Showing a controlled drawing to a foreign national employee can be an export. Ask suppliers how they confirm US person status and restrict access before you send data. The design owner sets the export classification; put it on the RFQ. Our confidentiality page explains how we handle NDAs and controlled data.

Small business subcontracting goals and certified suppliers

Large primes on contracts expected to exceed $900,000, or $2 million for construction, with subcontracting possibilities must submit a subcontracting plan under FAR subpart 19.7. The plan sets separate goals for small, veteran-owned, service-disabled veteran-owned, HUBZone, small disadvantaged and women-owned small businesses, and the prime reports progress in eSRS. A prime that fails to make a good faith effort can owe liquidated damages.

Government-wide prime contracting goals show where pressure sits. The Congressional Research Service reported these statutory goals and fiscal year 2025 results:

The women-owned and HUBZone goals were missed in FY2025, which is one reason primes look hard for certified firms in those categories. Certification matters: to count toward veteran-owned goals, a firm now needs SBA VetCert certification, and women-owned status for set-asides requires SBA certification or an SBA-approved certifier.

Certified small suppliers help a prime in two ways. Their spend counts toward plan goals, and they often turn small, urgent jobs faster than large suppliers. They still have to pass the prime's own supplier qualification. When you send us a request and certified small business participation matters, say which categories and how the spend needs to be reported, so the order can be structured with that in mind before the purchase order is placed.

The real constraints: schedule, export control and quality escapes

Schedule. Defense programs run on long lead material, especially DFARS compliant specialty metals, and on parts that went out of production years ago. A replacement source has to be found and qualified before the shortage stops a line.

Export control. A capable shop that is not set up for ITAR or CUI cannot see the drawing. Check registration and data controls before the RFQ, not after a quote comes back.

Quality escapes. The costly ones on defense work are paperwork failures as much as dimensional ones: titanium melted in a non-qualifying country, an electronic part bought from an unauthorized broker with no traceability, a process done by an unapproved source. Any of them can mean rework, a waiver request, or a GIDEP report.

How a sourcing partner helps, and its limits

Aerospace Sourcing, matches defense requests to qualified suppliers, including small business subcontractors, flows down the requirements you specify such as DFARS clauses, FAI, material traceability and special processes, tracks the job, and checks the paperwork before delivery. Every order ships with a certificate of conformance, plus other certs the request requires. You deal with one point of contact and one purchase order even when several shops are involved.

We do not replace your supplier qualification, your export classification decisions or your contracting officer's judgment, and we do not promise a supplier for every request. Suppliers sign a flow-down NDA before seeing files and do not learn the end customer without your approval. No ITAR, EAR or CUI data moves through our website. Related pages: launch providers, satellite manufacturers, and our aerospace RFQ checklist.

Find a qualified small business supplier

If you need a certified small business for a subcontract, or a supplier that can meet DFARS, ITAR and cyber flow-downs on a specific part, send the request through the small business match form. List the certifications you need, the clauses that apply and the export classification. A person will reply within one business day.

Questions

Related

• How to Buy Obsolete Parts Without Buying Counterfeits
• Sourcing Obsolete Aerospace Parts Safely
• Aerospace RFQ Checklist for Machined and Fabricated Parts
• Sourcing GSE, Pad Hardware and Fluid System Parts for Launch Providers

Sources

• Acquisition.gov: DFARS 252.225-7009 Restriction on acquisition of certain articles containing specialty metals
• Acquisition.gov: DFARS 252.246-7007 Contractor counterfeit electronic part detection and avoidance system
• Acquisition.gov: DFARS 252.246-7008 Sources of electronic parts
• Acquisition.gov: DFARS 252.204-7012 Safeguarding covered defense information and cyber incident reporting
• DLA: SAE counterfeit avoidance standards overview (AS5553, AS6081, AS6174)
• Federal Register: DFARS CMMC final rule, effective Nov. 10, 2025
• McGuireWoods: DoW suspends CMMC Phase II requirements, launches 60-day review (July 14, 2026)
• Holland & Knight: DOW suspends CMMC Phase II requirements (July 2026)
• eCFR: 22 CFR part 122, Registration of manufacturers and exporters
• Federal Register: ITAR registration fees final rule (Dec. 10, 2024)
• FAR subpart 19.7: The Small Business Subcontracting Program
• Congressional Research Service: Federal small business contracting goals (June 2026)
• SBA: Veteran contracting assistance programs (VetCert)
• SBA: Women-Owned Small Business Federal Contracting Program
• Lockheed Martin: Navy awards $383 million for D5LE2, Titusville facility (Jan. 31, 2025)
• ClearanceJobs: Northrop Grumman expands footprint in Florida (Aug. 5, 2026)
• L3Harris Technologies (headquarters, Melbourne, Florida)
• ULA: Vulcan USSF-87 mission