For aerospace and defense contractors, quality and cybersecurity are no longer separate business concerns. Customers expect reliable products, controlled processes, secure information, and documented proof that your organization can manage risk. The AS9100D standard addresses quality management for aviation, space, and defense organizations, while CMMC addresses the protection of Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) in the defense industrial base.
An organization may need one framework, the other, or both. AS9100D certification does not create CMMC compliance, and a successful CMMC assessment does not produce an AS9100 certificate. However, the management discipline behind AS9100D—leadership, risk-based thinking, documented processes, internal audits, corrective action, and continual improvement—can help create a stronger foundation for cybersecurity governance.
CMMC IT Support is a San Diego-based consultancy that helps Department of Defense contractors and subcontractors prepare for and maintain CMMC Level 2 compliance. If your aerospace or defense business needs a practical path from cybersecurity gaps to assessment readiness, schedule a free compliance call, call 858-483-8770, or email info@cmmcitsupport.us.
What Is the AS9100D Standard?
The AS9100D standard is a quality management system, or QMS, standard designed for organizations in the aviation, space, and defense supply chain. Published in the United States as AS9100D, it incorporates ISO 9001:2015 requirements and adds controls developed for the higher risks and stricter customer expectations found in aerospace and defense work.
The International Aerospace Quality Group describes the 9100 standard as a way to standardize QMS requirements across the supply chain and improve quality, schedule, and cost performance. The current published edition is commonly identified as AS9100D or AS9100:2016.
AS9100D gives organizations a repeatable system for controlling work rather than a checklist for inspecting quality at the end. It emphasizes issues such as:
- Product safety and conformity
- Operational risk management
- Configuration management
- Prevention of counterfeit or suspect parts
- Supplier selection and monitoring
- On-time delivery and customer satisfaction
- Employee competence and product-safety awareness
- Ethical behavior
- Documented evidence, traceability, and corrective action
The standard can apply to manufacturers, engineering firms, service providers, software organizations, maintenance providers, and other companies whose work affects aviation, space, or defense quality.
What Does an AS9100 Certificate Prove?
An AS9100 certificate provides independent evidence that an organization’s QMS has been audited against the applicable AS9100 requirements. Certification is performed by an accredited certification body—not by IAQG and not through a self-declaration.
Certification can help an organization demonstrate that it has defined processes, assigned responsibilities, maintained required records, measured performance, addressed nonconformities, and committed to continual improvement. Many prime contractors and aerospace customers require certification before approving a supplier.
An AS9100 certificate is not a blanket guarantee that every product will be defect-free. It confirms that the certified management system and scope were evaluated against the standard. Buyers should review the certificate’s scope, locations, dates, certification body, and current status. Aerospace supplier certification data can also be verified through the IAQG OASIS database when access and visibility permit.
Steps to Earn an AS9100 Certificate
A typical certification project includes the following stages:
- Confirm scope and customer requirements. Define the sites, products, services, processes, and business units that the QMS will cover.
- Conduct a gap analysis. Compare existing operations with AS9100D and identify missing or ineffective controls.
- Build an implementation plan. Assign owners, deadlines, resources, and measurable objectives.
- Document and implement the QMS. Create the procedures and records your organization genuinely needs, then put them into daily practice.
- Train employees. Personnel should understand their responsibilities, the importance of product safety and conformity, and how to report problems.
- Perform an internal audit. Test whether the QMS conforms to planned arrangements and works effectively.
- Complete management review. Leadership evaluates performance, risks, resources, audit results, customer feedback, and improvement opportunities.
- Resolve nonconformities. Correct problems, investigate root causes, and verify that corrective actions are effective.
- Complete certification audits. An accredited certification body generally performs a readiness-focused Stage 1 audit followed by a Stage 2 implementation audit.
- Maintain the system. Certification requires ongoing operation, surveillance audits, corrective action, and periodic recertification.
The best implementation is not the one with the most paperwork. It is the one that gives employees clear, usable controls and produces reliable evidence during normal operations.
AS9100D Clauses at a Glance
The first three clauses establish scope, references, and terminology. Clauses 4 through 10 contain the core management-system requirements.
Clauses 1–3: Scope, References, and Terms
These clauses explain where the standard applies, identify its normative reference, and establish the terminology needed for consistent interpretation.
Clause 4: Context of the Organization
The organization identifies internal and external issues, interested parties, QMS scope, and the processes needed to achieve intended results. This prevents the QMS from becoming disconnected from actual business risks and customer obligations.
Clause 5: Leadership
Top management must demonstrate accountability for the QMS, establish a quality policy, assign responsibilities, promote customer focus, and support a culture that values product safety and ethical behavior.
Clause 6: Planning
Organizations address risks and opportunities, establish measurable quality objectives, and plan changes. In aerospace work, planning should account for operational risks that could affect conformity, safety, schedule, or customer requirements.
Clause 7: Support
This clause covers people, infrastructure, work environments, monitoring resources, organizational knowledge, competence, awareness, communication, and documented information. Records must be controlled so that personnel use accurate and approved information.
Clause 8: Operation
Clause 8 governs operational planning and control, customer communication, design and development, external providers, production and service provision, release, and nonconforming outputs. It also contains aerospace-specific expectations involving configuration, product safety, counterfeit-parts prevention, risk, and special requirements.
Clause 9: Performance Evaluation
Organizations monitor and analyze QMS performance through measures such as customer satisfaction, process results, internal audits, and management reviews. The goal is to use evidence to determine whether controls work.
Clause 10: Improvement
Organizations respond to nonconformities, correct causes, and continually improve the suitability, adequacy, and effectiveness of the QMS. A closed corrective action should show more than a repaired symptom; it should demonstrate that recurrence risk was addressed.
Difference Between AS9100 and ISO 9100
People frequently search for the difference between AS9100 and ISO 9100, but the phrase contains a common naming error: there is no equivalent quality management standard called “ISO 9100.” The relevant comparison is usually AS9100 versus ISO 9001.
AS9100 includes the ISO 9001:2015 QMS requirements and adds aviation, space, and defense-specific requirements. ISO 9001 is industry-neutral and can be used by organizations of almost any type. AS9100 is intended for higher-risk aerospace and defense supply chains.
| Area | ISO 9001 | AS9100D |
| Primary use | General quality management | Aviation, space, and defense quality management |
| Industry-specific controls | Limited | Adds aerospace and defense requirements |
| Product safety | Addressed through general QMS controls | Explicit aerospace-focused requirements |
| Counterfeit parts | Not an explicit dedicated focus | Explicit prevention expectations |
| Configuration management | General controls may apply | Explicitly addressed |
| Operational risk | Risk-based thinking | Additional operational risk expectations |
| Typical market driver | Broad customer or improvement requirement | Aerospace/defense customer and supply-chain requirement |
An ISO 9001-certified organization may have a useful starting point, but it must implement and demonstrate the added AS9100 requirements before it can earn an AS9100 certificate.
How AS9100D Relates to CMMC Level 2 Compliance
AS9100D and CMMC Level 2 compliance serve different purposes. AS9100D focuses on quality management and dependable delivery. CMMC focuses on safeguarding sensitive government information in contractor environments.
CMMC Level 2 aligns with the 110 security requirements in NIST SP 800-171 Revision 2 under the current program framework. Those requirements cover areas including access control, incident response, configuration management, audit and accountability, identification and authentication, media protection, risk assessment, security assessment, and system integrity.
The overlap is primarily managerial, not control-for-control equivalence. An effective AS9100D system may already provide useful habits and evidence, including:
- Defined responsibilities and executive accountability
- Controlled policies, procedures, and records
- Supplier oversight
- Risk assessment and treatment
- Internal audits and management reviews
- Corrective-action workflows
- Competence, training, and awareness records
- Change and configuration discipline
- Metrics and continual improvement
These practices can support a CMMC program, but they do not replace technical safeguards, a System Security Plan, scoping decisions, asset management, evidence mapped to assessment objectives, or other CMMC-specific work.
If your organization handles CUI, CMMC IT Support can evaluate your readiness and develop a prioritized remediation plan that works with your existing business processes.
What to Expect During a CMMC Assessment
A CMMC assessment evaluates whether required cybersecurity practices have been implemented and can be supported with sufficient evidence. Assessors may examine documents, interview responsible personnel, and test or observe technical and operational controls. A written policy alone is not enough if the control is not consistently performed.
Evidence may include system configurations, access records, tickets, screenshots, training records, logs, policies, procedures, network and data-flow diagrams, risk assessments, incident-response materials, and other artifacts tied to the assessment objectives.
Current CMMC Implementation Note
As of August 2026, the Department’s official CMMC site states that implementation remains in Phase 1 and that Phase II requirements were suspended in July 2026 pending review. Phase I self-assessment requirements remain in place, and the pause does not eliminate existing obligations to protect covered information under applicable contract clauses. Because policy and contract language can change, contractors should verify the requirements in each solicitation and contract rather than delay security work based on a general program update.
How to Prepare for a CMMC Assessment
Start by confirming what information you receive, create, store, process, or transmit and where it flows. Then define the assessment scope, inventory in-scope assets, evaluate each applicable requirement, and gather objective evidence.
A strong readiness process should include:
- CUI and FCI discovery and data-flow mapping
- Assessment-scope validation
- NIST SP 800-171 control and objective review
- System Security Plan development or correction
- Technical remediation and secure configuration
- Policy and procedure alignment
- Evidence collection and organization
- Personnel interviews and mock-assessment preparation
- POA&M review where permitted
- Ongoing monitoring and annual affirmation support
CMMC IT Support helps contractors turn this work into a manageable roadmap. Our team supports gap analysis, documentation, implementation, managed compliance, technical remediation, and assessment preparation. Request a quote or schedule a free compliance call today.
A Practical Integrated Approach for Defense Contractors
Organizations pursuing both frameworks should avoid building two isolated compliance programs. Use shared governance where it makes sense while preserving the distinct requirements and evidence for each standard.
For example, one controlled-document process can manage quality and cybersecurity policies. A coordinated internal-audit calendar can reduce disruption. Management review can consider quality performance, supplier risk, cyber incidents, remediation status, and resource needs. Corrective-action methods can use a consistent root-cause approach across QMS and security findings.
However, the certification boundaries must remain clear. Use an accredited certification body for AS9100 certification and follow the applicable CMMC assessment path for your contract. Never describe an AS9100 audit as proof of cybersecurity compliance or a CMMC result as proof of aerospace QMS certification.
Frequently Asked Questions
Is AS9100D still the current AS9100 standard?
Yes. The current published edition is AS9100D, also identified as AS9100:2016 in the United States. Organizations should monitor IAQG and their standards publisher for revision or transition announcements.
Is there an ISO 9100 standard?
No. Searches for ISO 9100 usually refer to ISO 9001 or AS9100. AS9100 incorporates ISO 9001 requirements and adds aviation, space, and defense-specific controls.
Does an AS9100 certificate satisfy CMMC requirements?
No. An AS9100 certificate addresses the quality management system within its certified scope. CMMC evaluates cybersecurity requirements for protecting FCI or CUI. The programs can share governance practices, but one does not substitute for the other.
Who needs CMMC Level 2 compliance?
Level 2 generally applies when a DoD contractor or subcontractor must protect CUI and the applicable contract or solicitation specifies the requirement. Confirm the required level and assessment type from authoritative contract language.
How long does preparation take?
Timing depends on scope, existing controls, system complexity, documentation quality, available staff, and the number of gaps requiring remediation. A focused readiness review is the best way to develop a defensible timeline and budget.
Build Quality and Cybersecurity Into the Same Business Strategy
AS9100D can help an aerospace or defense organization deliver consistent quality, manage operational risk, and meet demanding customer expectations. CMMC Level 2 addresses a different but equally important responsibility: protecting sensitive information entrusted to the defense supply chain.
The most resilient contractors treat both as operating disciplines, not last-minute audit exercises. Establish ownership, understand scope, build controls into daily work, retain evidence, test effectiveness, and correct problems before an assessor finds them.
Ready to understand your CMMC gaps and next steps? Contact CMMC IT Support for a free compliance call or quote, call 858-483-8770, or email info@cmmcitsupport.us. We help DoD contractors and subcontractors move toward assessment readiness with practical guidance, hands-on implementation, and ongoing support.