Defense Machining Suppliers: How to Vet the ITAR, CMMC and AS9100 Stack

“ITAR certified” is a phrase suppliers use, primes accept, and the State Department has never issued. This guide gives procurement teams a verification framework for the four credentials that actually matter in defense machining: ITAR registration, CMMC Level 2, AS9100D and SPRS. JD Machine holds all four, and the framework below is how your team can confirm it on any sub before sending CUI.

Key Takeaways

• ITAR is a registration and compliance regime under 22 CFR Part 122, not a certification any agency issues.
• A CMMC Level 2 status can sit in conditional status for up to 180 days under DFARS Subpart 204.75; verify status type and date.
• AS9100D, not ISO 9001 alone, is the aerospace and defense quality standard; verify it through IAQG's OASIS.
• A defense-ready supplier proves all four: ITAR registration, current CMMC status, AS9100D, and SPRS entry.

Why “ITAR Certified” Is a Red Flag, Not a Credential

“ITAR certified” appears in supplier marketing, vendor pitches, and even RFP language. The State Department has never issued such a credential. Under 22 CFR Part 122, ITAR is a registration regime for any U.S. person engaged in manufacturing or exporting defense articles or furnishing defense services on the United States Munitions List. DDTC's public guidance frames the International Traffic in Arms Regulations around registration and export controls, not certification language.

The compliance picture has also moved. Per the Defense Acquisition Regulations System, the rule below is now contract-relevant on every covered award.

The DoD final DFARS rule incorporating CMMC became effective on November 10, 2025.

A subcontractor's current cyber status now sits alongside ITAR registration in pre-award supplier vetting. A supplier still pitching itself as “ITAR certified” in 2026 is signaling either marketing sloppiness or an out-of-date compliance picture. Both are AVL risks. The defensible baseline is registered, compliant and current, which is what our certifications page documents for security-conscious primes.

The Defense Machining Compliance Stack: ITAR, CMMC, AS9100D and SPRS

Four credentials, four different questions:

• ITAR — Are you legally allowed to handle this data?
• CMMC — Can you protect it?
• AS9100D — Can you make the part right?
• SPRS — Has DoD seen evidence of your posture?

Treating them as one blob is how primes end up with subs that pass a logo check and fail an audit.

ITAR registration (export control compliance)

Registration under 22 CFR Part 122 is required for U.S. manufacturers and exporters of defense articles and for parties furnishing defense services. The registration is the legal status; operational compliance is the process layer behind it: restricted-access controls for ITAR-controlled drawings, documented U.S. person access rules, and export procedures tied to the United States Munitions List. A buyer verifying ITAR asks for DDTC registration evidence and a written process summary, then maps both against the scope of the work being awarded.

CMMC Level 2 (cyber maturity)

CMMC Level 2 is built on NIST SP 800-171 control families and applies across the defense supply chain wherever CUI flows.

NIST SP 800-171 Rev. 2, the standard incorporated by reference for CMMC, contains 110 security requirements.

“We're secure” is not a meaningful substitute for documented control implementation against those 110 requirements. A buyer verifies status type (final vs. conditional), status date, the scope of the assessed environment, and whether CUI flowdown is supported across the manufacturing operations that will touch the work. Maintaining CMMC Level 2 status requires documented processes for access control, incident response and system monitoring across the cells, programming stations and network segments where controlled technical data actually lives.

AS9100D (aerospace and defense standard)

AS9100D is the aerospace and defense standard, not an upgrade label on ISO 9001. Per IAQG's certification scheme, the 9100-series consists of three standards (9100, 9110, 9120), and 9100 adds aviation, space and defense requirements on top of ISO 9001.

For mission-critical components with tight tolerances, traceability across precision machining and multi-axis machining, and configuration management on production runs, AS9100D is the relevant standard. Buyers verify the current certificate, scope and certifying body through IAQG's OASIS repository, then cross-reference against the JDM quality systems summary a credible sub will provide.

SPRS (DoD supplier risk visibility)

SPRS is the DoD-side record of cyber posture. For DIB companies handling CUI in supply chain management for defense programs, SPRS captures:

• The NIST SP 800-171 self-assessment score tied to the in-scope environment.
• Current registration entry for DIB companies as a trusted partner in the defense industry.
• Status data primes draw on during pre-award vetting.

Per NIST MEP guidance, SPRS score entry is a legal requirement for DIB companies handling CUI in DoD supply chains, which is why a missing SPRS entry is disqualifying regardless of how the rest of the deck reads.

How to Verify a Defense Machine Shop's Compliance Claims

A supplier's logo on a slide deck is not verification. Each of the four credentials has an independent verification path, and a procurement-grade vet uses all four.

Under DFARS Subpart 204.75, CMMC Levels 2 and 3 can be awarded in a conditional status for up to 180 days from the CMMC status date.

A prime should verify whether a subcontractor's claimed level is final or conditional before award. The matrix below turns vendor pitch language into independently checkable evidence.

Conditional and final status are not interchangeable, which is why the status date matters as much as the level itself. A defense contract manufacturing partner who cannot produce all four lines fails AVL-grade vetting before contract award, not after. JD Machine maintains the full stack for the defense and aerospace industries we serve, and our CNC machining services are scoped against this same verification logic.

A buyer's pre-award verification checklist

• Request DDTC registration evidence and current ITAR process summary.
• Confirm CMMC status type and status date in writing.
• Verify AS9100D certificate and scope through IAQG OASIS.
• Confirm SPRS entry and current NIST 800-171 self-assessment score.
• Request our compliance documentation package before sharing any CUI with a new sub.

What CMMC Actually Requires of a CNC Machining Operation

NIST SP 800-171 Rev. 3 explicitly names CNC machining equipment among specialized systems where certain security requirements may have implementation limitations that must be documented in the system security plan. For a defense machining floor, the implication is concrete:

• CUI on the shop floor: controlled drawings, CAM files, fixture programs and post-processed code all qualify as CUI when tied to ITAR-controlled work, and access scoping has to follow them.
• Specialized systems: legacy CNCs without modern authentication or encryption require documented compensating controls in the SSP rather than silent exceptions.
• Removable media: USB-based program transfer between programming stations and machines requires controlled handling, not ad-hoc workflows across the facility.
• U.S. person access: ITAR-controlled work requires access controls at the machining cell itself, not only at the network edge, with materials staging and operator assignment built around that scope.

A CMMC Level 2 status that is current and paired with documented SSP exceptions for specialized systems is what a defense-ready operation looks like in practice. JD Machine is CMMC Level 2 certified (C3PAO audit, registered in SPRS), AS9100D, and ITAR registered, inside a 70,000 sq ft climate-controlled facility with a lean manufacturing approach embedded since 1998. That alignment is what keeps the documentation a prime receives consistent with what an auditor would find at the cell.

Frequently Asked Questions