AS9100 vs ITAR vs CMMC: Defense Certifications Explained

What Each Certification Covers

ITAR — International Traffic in Arms Regulations

ITAR is a regulatory regime covering defense articles and services on the US Munitions List (USML). If your procurement involves items that appear on the USML — and many machined components, electronics, and materials do — your suppliers need ITAR registration with DDTC.

ITAR compliance requires registration ($2,250/year for manufacturers), strict handling of technical data, and prohibition on unauthorized export. Unlike quality certifications, ITAR is binary: a company is either registered and compliant or it is not.

Key point: ITAR registration does not guarantee a supplier has robust compliance procedures — it only confirms they are registered. Ask about their written export compliance plan, employee training, and ITAR handling procedures.

AS9100D — Quality Management for Aerospace

AS9100 is an industry-developed quality management standard built on ISO 9001, with additional requirements specific to aerospace manufacturing. The "D" revision (released 2016) incorporated risk-based thinking, key person identification, and supply chain traceability requirements.

Most major defense primes (Lockheed, Boeing, Raytheon, etc.) require AS9100 certification from their suppliers as a condition of contract. A supplier with AS9100 is not automatically ITAR-registered — these are independent certifications. However, AS9100 certification includes most ISO 9001 requirements.

CMMC — Cybersecurity for Defense Supply Chains

The Cybersecurity Maturity Model Certification is a DoD framework for assessing and improving cybersecurity posture across the defense industrial base. CMMC covers how companies handle Controlled Unclassified Information (CUI), which includes program data, specifications, and contract information that requires protection.

CMMC has five levels. Most defense programs with CUI requirements will require Level 2 at minimum. Level 3 requires a government-led assessment. By late 2025, CMMC requirements will be included in all new DoD contract awards.

If your program involves CUI — and most defense programs do — you need to verify your suppliers' CMMC level before engaging them. ForgeLine suppliers show their CMMC certification level in their directory profile.

How These Certifications Interact

A fully compliant defense supplier typically holds all three:

• ITAR registration — legal authority to work with controlled defense articles and technical data
• AS9100D certification — quality management system meeting aerospace/defense manufacturing standards
• CMMC Level 2 or higher — cybersecurity posture adequate for handling CUI on DoD contracts

Note that DFARS (the Defense Federal Acquisition Regulation Supplement) sets the domestic sourcing and cybersecurity baseline that flows down from DoD primes to their supply chain. DFARS compliance — including Buy American Act origin requirements and NIST SP 800-171 cybersecurity controls — applies to any supplier doing work on DoD contracts. See our DFARS compliance guide for the full breakdown of flow-down requirements and key clauses.

ForgeLine's directory shows all three certification statuses for every listed supplier, making it easy to filter by the certifications your program requires. Once you understand which certifications apply, our guide on 5 questions to ask before choosing a defense supplier walks through the full evaluation checklist beyond certification alone.

Frequently Asked Questions

Describe your program requirements and we'll identify domestic defense manufacturers holding the certifications your contract demands — ITAR, AS9100, and CMMC included.