A missing AS9100 certificate can end a defense bid before a single part gets quoted. For casting and component suppliers trying to win work tied to a Department of Defense program, this one credential often decides whether a company gets invited to compete at all.
As an AS9100 Rev D-certified investment casting foundry that produces components for aerospace and defense programs, we are often asked what this certification covers and why it carries so much weight in regulated contracts. This article answers both questions and walks through what defense program managers and procurement officers should confirm before qualifying a casting supplier.
AS9100 Certification, Explained
AS9100 is the quality management standard written for the aviation, space, and defense industries. The International Aerospace Quality Group developed it as a joint effort between the Society of Automotive Engineers and European aerospace industry groups. It builds on ISO 9001, adding requirements specific to flight-critical and defense-critical hardware. A company that holds this credential has a documented quality management system that an accredited third-party registrar audits on a set cycle. It’s not a self-declared claim of quality.
AS9100-certified companies, and the aerospace certifications they hold, show up across every level of the supply chain, from prime contractors down to the foundries and machine shops pouring and machining individual parts. For a deeper look at how AS9100 quality standards fit alongside Nadcap and other aerospace quality certifications, see our overview of aerospace manufacturing certifications and standards.
ISO 9000 vs. AS9100: Where the Standards Diverge
ISO 9001 sets quality management expectations that apply across nearly any industry, from food packaging to automotive parts. When people compare ISO 9000 vs. AS9100, the relationship is simple: AS9100 does not replace ISO 9001; it absorbs the entire ISO 9001:2015 text and adds over 100 aerospace-specific clauses on top of it. A company certified to AS9100 automatically satisfies ISO 9001. A company certified only to ISO 9001 has not met a single one of the additional AS9100 certification requirements that a defense program depends on.
What AS9100D Specifically Requires That ISO 9001 Does Not
The current revision, AS9100D, introduced clauses that have no equivalent in the generic ISO 9001 standard. These are the requirements a casting supplier has to build a quality management system around, and they’re the reason a defense program manager can’t treat an ISO 9001 certificate as a substitute for AS9100 on a regulated program.
- Configuration management: Suppliers have to control which design revision, drawing, and specification apply to a given part or lot, and prove that the link remains intact from engineering release through delivery.
- FOD prevention: Foreign object debris programs require documented procedures and inspection records to keep tools, hardware, and shop debris out of parts and assemblies, particularly for components going into fuel systems or flight controls.
- First article inspection: A new or changed part requires a full first article inspection following the AS9102 format, with a complete dimensional check confirming the production process, not just the first piece, can hold the print.
- Counterfeit parts prevention: Suppliers need a documented program to keep counterfeit or suspect material out of the supply chain, and any material identified as counterfeit has to be marked, controlled, and physically destroyed rather than returned to a supplier where it could re-enter circulation.
- Product safety: The standard requires suppliers to plan for and assess product safety across the life of a part, not just at final inspection.
- Risk-based thinking: AS9100 pushes risk management into the production process, with formal risk reviews built into contract review, design changes, and process planning rather than being treated as a background policy.
Taken together, these AS9100 requirements are what separate a general-purpose quality system from one built specifically for parts where a defect can ground an aircraft or cause a weapon system to fail.
How AS9100 Flows Down Through the Defense Supply Chain
Defense programs run through a tiered supplier network. Prime contractors sit at the top, subcontracting systems and subassemblies through Tier 1, Tier 2, and Tier 3 suppliers, with casting and component manufacturers usually at the Tier 2 or Tier 3 level. Our guide to aerospace supply chain tiers covers how that structure works in detail.
Prime contractors like Lockheed Martin and Northrop Grumman write AS9100 into their supplier quality requirements as a standard contract clause. Once a prime writes that requirement into a subcontract, it flows down through every tier below it. A Tier 1 supplier won’t source a casting from a Tier 2 foundry that lacks AS9100, because doing so would put the Tier 1 supplier’s own compliance at risk with the prime above them.
This is why a Tier 2 or Tier 3 casting supplier without AS9100 certification effectively can’t win work on regulated defense programs. No single federal statute names AS9100 as a legal precondition for every DoD contract. Instead, the certification requirement gets written into the contract itself at the prime level, then flows down as a condition of doing business at every tier below. That makes it a practical barrier to entry even where it isn’t a legal one.
How AS9100 Interacts with ITAR, DFARS, and CMMC
AS9100 covers quality management, but it isn’t the only compliance framework a defense casting supplier has to carry. Three additional frameworks recur in defense programs, and each covers different ground.
ITAR (International Traffic in Arms Regulations) governs the export of defense articles and defense-related technical data under State Department jurisdiction. A casting supplier can be fully AS9100 certified and still need a separate ITAR registration if the program involves export-controlled parts or drawings.
DFARS (Defense Federal Acquisition Regulation Supplement) includes contractual clauses, such as DFARS 252.204-7012, that require contractors to protect controlled unclassified information and extend those protections to their subcontractors.
CMMC (Cybersecurity Maturity Model Certification) verifies that a contractor meets the cybersecurity controls referenced in DFARS 252.204-7012. Phase 1 of the rule took effect on November 10, 2025, requiring self-assessments on applicable solicitations and contracts. In July 2026, the Department of Defense suspended the subsequent phases — including the Phase 2 third-party certification requirement that would have started that November, along with the Phase 3 and 4 milestones — pending a program-wide review. Phase 1 self-assessment remains in force; defense casting suppliers should confirm the current phase-in status rather than assume later requirements are locked in on the original schedule.
These three frameworks stack on top of AS9100 rather than replacing it. A program can require AS9100 alone, AS9100 plus ITAR, or all three, depending on what the casting supplier handles and what information passes through their shop. We hold AS9100 Rev D and Nadcap certification and operate as an ITAR-compliant manufacturer, which is the combination most defense casting programs expect from a military and defense castings supplier.
What Defense Program Managers and Procurement Officers Should Verify When Qualifying an AS9100-Certified Casting Supplier
A certificate on a website doesn’t confirm much on its own. Before qualifying a new casting source for a regulated program, verify the following:
- Confirm the certificate is active, rather than relying on a scanned certificate or a claim on a supplier’s site.
- Confirm that the certificate scope covers the casting process, alloy family, and part type the program needs, since a certificate can be valid even if it excludes the specific process in question.
- Confirm Nadcap accreditation for the special processes the parts require, such as heat treat, nondestructive testing, or welding, since AS9100 alone doesn’t validate those processes.
- Confirm ITAR registration status if the program involves export-controlled technical data or defense articles.
- Confirm DFARS flow-down clauses appear in the purchase order and ask the supplier for their current CMMC status as documented in SPRS.
- Review the supplier’s surveillance audit history and ask directly about any open nonconformities.
- Confirm the supplier runs first article inspection in the AS9102 format and can produce a completed FAI report on request.
Partner With an AS9100 Rev D Certified Defense Casting Foundry
Bescast holds AS9100 Rev D and Nadcap certification, and we produce investment castings across steel, cobalt, and nickel alloys for aerospace and defense programs. Our engineering and quality teams work directly with program managers and procurement officers to confirm certificate scope, material traceability, and process control before a part reaches production. Contact us to talk through your next defense casting project.
Frequently Asked Questions About AS9100 Certification
Is AS9100 certification mandatory to bid on US Department of Defense contracts?
No single federal law makes AS9100 a blanket legal requirement for every DoD contract. What makes it feel mandatory in practice is how prime contractors write AS9100 certification into their own subcontracts.
How long does it take a casting foundry to achieve AS9100 certification from scratch?
For a foundry with no existing formal quality management system, the process commonly runs nine to 15 months from the initial gap assessment through the certification audit; complex, multi-site operations can take 18 months or longer. A foundry that already holds ISO 9001 certification can significantly compress this timeline, since the foundational quality system already exists.
How frequently must AS9100-certified companies undergo audits to maintain certification?
Initial AS9100 certification is valid for three years, but it isn’t a set-it-and-forget-it credential. Certified suppliers undergo annual surveillance audits by their accredited registrar to confirm that the quality management system still meets the standard, and any nonconformities found during those audits need documented corrections. At the end of the three-year cycle, the supplier goes through a full recertification audit to renew the certificate for another three years.
