5 Questions to Ask Before Choosing a Defense Supplier

ITAR registration is a legal prerequisite for suppliers working with items on the US Munitions List (USML). Without active registration with the State Department's Directorate of Defense Trade Controls (DDTC), a supplier cannot legally receive controlled technical data, manufacture ITAR-controlled components, or participate in export-controlled programs.

Do not take the supplier's word for it. Ask for their ITAR registration number and verify it directly against the DDTC registry at pmddtc.state.gov. Registration must be current — lapsed registrations are a disqualifier. Also ask whether they have a written Technology Control Plan (TCP) and a dedicated export compliance officer. Registration alone does not indicate robust compliance procedures.

ForgeLine's ITAR supplier directory pre-screens and verifies ITAR registration for every listed manufacturer, so you start with suppliers already confirmed compliant rather than auditing each one manually.

ITAR registration covers legal compliance. Certifications cover quality, cybersecurity, and process standards. The three most important for defense procurement are:

• AS9100D — the aerospace and defense quality management system standard. Required by most defense primes (Lockheed, Boeing, Raytheon, L3Harris, Northrop Grumman). A supplier with AS9100D has had their production processes independently audited against aerospace-specific requirements.
• CMMC Level 2+ — required for any supplier handling Controlled Unclassified Information (CUI) on DoD contracts. CMMC requirements are being phased in across all new DoD awards through 2025–2026.
• NADCAP — special process certification for heat treatment, NDT, welding, and surface treatment. Required by many programs for safety-critical components.

For a complete breakdown of what each certification covers and when it is required, see our AS9100 vs ITAR vs CMMC comparison. The key point: certifications should match what your contract requires. Confirm the specific requirements before filtering suppliers.

Most defense programs require domestic manufacturing under DFARS and the Buy American Act. Even programs without explicit domestic sourcing requirements often carry flow-down clauses that restrict where manufacturing can occur. Offshore manufacturing on a DFARS-covered contract is a compliance violation that can void a contract award. For a full breakdown of DFARS clauses, specialty metals requirements, and compliance verification, see our DFARS compliance guide for defense suppliers.

Ask where manufacturing physically occurs — not just where the company is headquartered. A US-headquartered supplier that subcontracts machining overseas may not meet domestic content requirements. Confirm that all primary manufacturing operations for your components happen within the United States. When you receive their capabilities statement, look for specific capacity data (employee count, square footage, equipment list) rather than vague "extensive capacity" language — see our guide to reading capabilities statements for what to look for and what to flag.

The ForgeLine supplier directory lists only US-based manufacturers with verified domestic production facilities. You can filter by state, which matters for programs requiring regional sourcing or for supply chain redundancy planning.

A supplier may hold every certification and have all the right equipment — and still be the wrong fit if they cannot reliably deliver at your required volume and schedule. This is one of the most common mismatch points in defense procurement, and one of the most expensive to discover after a contract starts.

Relevant data to request:

• Current backlog and capacity utilization — how much of their capacity is already committed?
• Largest recent program by volume — have they delivered at your scale before?
• Employee count in production roles — a rough proxy for production bandwidth
• Lead time windows — stated lead time under normal load vs. stressed capacity
• Surge capacity — can they scale 20–30% if program demand increases?

The ForgeLine search tool lets you filter by employee count and production capabilities, giving you a starting population of suppliers who at least meet your scale requirements before you engage them directly.

AS9100D certification establishes a baseline — but a supplier's actual quality management system implementation matters as much as the certificate. Two suppliers can both hold AS9100D and have radically different first-pass yield rates, non-conformance rates, and customer return rates.

In supplier qualification conversations, ask specifically about:

• First article inspection (FAI) process — do they follow AS9102 or equivalent? What does their FAI documentation look like?
• Non-conformance management — what is their corrective action process? How do they handle escapes to customers?
• Supplier flow-down — how do they manage quality requirements for their own subcontractors and material suppliers?
• Traceability — can they trace materials and processes back to the original lot for any part shipped?
• Recent audit history — have there been any major findings in their last AS9100 surveillance audit? What was closed, and how quickly?

Suppliers who can answer these questions with specific data — not generalities — typically have mature quality systems. Those who deflect or cannot provide specifics warrant deeper scrutiny before engaging.