Aerospace and defence · ISO and GRC consulting
ISO certification for aerospace and defence suppliers that primes and defence buyers can verify.
Aerospace primes check 9100-series certification in OASIS before they approve a supplier, and US defence solicitations name the CMMC level they expect. Sterling's expert and experienced consultants build AS9100 and the standards around it with your engineers, planners, inspectors and IT team, and stay with you through the audit and the years after it. We ensure successful certification for our clients.
- One integrated system for quality, environment, safety and information security, run in Effivity, included with the engagement at no additional cost
- Expert and experienced consultants advising on management systems across sectors and countries since 2003, with offices in 21 countries
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides
- Visible to the primesAn AS9100 certificate from an accredited body, recorded in OASIS where customers look before they approve you.
- Ready for defence bidsThe CMMC level a solicitation names, with a system security plan and evidence behind every affirmation.
- One system, not fiveQuality, environment, safety and information security run together, with one internal audit programme and one management review.
- Evidence that holds upFirst article, configuration, supplier and special-process records kept in Effivity as the work happens.
What aerospace and defence is asked for
The standards primes, defence buyers and your own customers ask for.
Most aerospace work starts with AS9100, the IAQG's quality standard, which contains the whole of ISO 9001 and adds product safety, configuration management, counterfeit-part prevention and first article inspection. US defence contracts that involve controlled information add CMMC 2.0 and NIST SP 800-171. Around them sit the environmental, safety and laboratory standards your sites and test rooms need. Start with the ones your contracts name; we integrate them into one system.
- AS9100Aerospace quality
- ISO 9001Quality foundation
- CMMC 2.0Defence cybersecurity
- NIST SP 800-171CUI safeguarding
- ISO/IEC 27001Information security
- ISO 14001Environmental management
- ISO 45001Health and safety
- ISO/IEC 17025Laboratory accreditation
- All standards & frameworksThe full catalogue, with sector schemes
Why now
Why aerospace and defence suppliers are acting now.
Six pressures we hear from machine shops, electronics assemblers, maintenance organisations and defence subcontractors.
- Primes look you up in OASISBoeing's supplier quality requirements (D6-82479) call for certification by an accredited body listed in OASIS under the IAQG scheme, and other primes and tier-one suppliers set the same condition. No listing, no approval.
- Defence solicitations name a CMMC levelSince 10 November 2025, applicable US defence solicitations call for Level 1 or Level 2 self-assessment status in SPRS. Phase 2 was suspended on 13 July 2026, but the Phase 1 requirements remain in place.
- Requirements flow down every tierCMMC applies to subcontractors at all tiers that handle FCI or CUI, and AS9100 asks you to pass critical items, key characteristics and counterfeit-part controls to your own suppliers. Your supply chain inherits your customer's expectations.
- The editions are movingISO 9001:2026 was published on 16 September 2026 and ISO 14001:2026 on 15 April 2026, and the IAQG has slated the 9100 revision, IA9100, for the first quarter of 2027. A system built now should be ready for all three.
- Counterfeit parts and escapesA suspect part or a foreign object found at the customer leads straight back to your controls. AS9100 expects counterfeit-part prevention, foreign object controls and containment you can show, not just describe.
- Special processes and test resultsNadcap, the industry's cooperative accreditation programme administered by the Performance Review Institute, covers special processes such as heat treating, coatings, welding and non-destructive testing alongside AS9100. Laboratories whose results customers must rely on work to ISO/IEC 17025.
Scope and evidence
What the auditor will ask to see on your shop floor.
Six areas where aerospace and defence audits go deeper than a general quality audit, and the evidence that answers them.
| Requirement area | What it looks like in aerospace and defence | Evidence auditors ask for |
|---|---|---|
| Configuration and traceability | Every delivered part matches its drawing revision and approved changes, and can be traced from raw material through each operation to the customer | Configuration records that match the delivered part, change approvals, lot and serial traceability, identification on the part and on its paperwork |
| First article inspection | A full verification of the first production run of a new part, and again after a design or process change | FAI reports on the 9102 forms, ballooned drawings, material certificates and a record of re-inspection after each change |
| External providers and flow-down | Approved suppliers, customer-designated sources and subcontracted processes, with requirements passed down on every purchase order | An approved external provider register with status, purchase orders that flow down critical items and key characteristics, supplier delivery and quality data |
| Counterfeit parts and product safety | Controls that keep unauthorised copies, substitutes and modified parts out, and a clear view of which items could cause harm if they fail | Purchasing from approved sources, receiving inspection, quarantine of suspect parts, product safety assessments for critical items |
| Special processes, FOD and human factors | Heat treatment, plating, bonding, welding and inspection carried out by qualified processes and competent people, in a clean and controlled work area | Process qualification and revalidation, operator and inspector competence records, tool control, foreign object checks, calibration records |
| Controlled unclassified information | Drawings, specifications and contract data from a US defence customer protected on your own systems where the contract requires it | A defined CMMC assessment scope, a system security plan against the 110 NIST SP 800-171 Rev 2 requirements, the SPRS entry and the annual affirmation |
Maintenance organisations answer these questions under AS9110 and distributors under AS9120, each shaped to its own work. We identify the records your processes genuinely need, without creating documents to fill folders, and keep them in Effivity from the first workshop.
The engagement
What happens between the first call and the certificate.
For most suppliers the primary standard is AS9100, with ISO 14001, ISO 45001, ISO/IEC 27001 or CMMC 2.0 added to the same system where contracts call for them. The six steps stay the same; the evidence is aerospace evidence.
- 01Define what the certificate needs to cover.Confirm activities, sites, headcount, customer expectations and the intended certification scope.
- 02Gap analysis: review the current system against the requirements.The gap analysis identifies what is missing, preserves effective practice and agrees actions, owners, dates and resources.
- 03Implement and collect meaningful evidence.Put controls into use, train the relevant people and keep the records that show how the system operates.
- 04Audit, review and address the findings.Internal audit and management review evaluate implementation; findings are raised by us first and closed with evidence.
- 05Complete the independent assessment.The certification body's Stage 1 readiness review, then the Stage 2 audit; respond to any findings and await its decision.
- 06Maintain the system after certification.Monitoring, internal audits, reviews and improvement continue, alongside the body's surveillance audits and three-yearly recertification.
What you receive
Everything a working, certifiable system needs. Nothing to source separately.
- Scope and gap analysis reportThe scope of the certificate and every shortfall against the standard, with an owner and a date.
- Implementation planMilestones, responsibilities, the weekly session calendar and the target audit window.
- The documented management systemPolicies, processes, procedures, forms and records on Sterling's template sets, tailored to your operation.
- Effivity workspace, configuredDocuments, registers, audits, actions, training records and management review in one place, included at no additional cost.
- Trained peopleAwareness e-learning for everyone, practitioner courses for the people who run the system, internal auditor training for your audit team, as applicable to your standard, with Certificates of Completion.
- Internal audit and management reviewProgramme, checklists, report, corrective actions closed with evidence, and a management review record with decisions.
- Certification readinessCertification bodies compared and their accreditation checked, Stage 1 and Stage 2 preparation, and support until the certificate is issued.
- The Sustain™ calendarThe year after certification planned: surveillance dates, internal audits, refreshers, new-hire training and any transition to a revised edition.
Effivity · included with the engagement
Your system runs in software from the first workshop.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures it within the agreed scope, so evidence accumulates as people do their work and the certification auditor reviews a live system rather than a binder. Sterling consulting clients get their subscription included with the engagement, at no additional cost.
ISO & GRC softwareSterling Academy · included with the engagement
Your people learn the standard, not just the forms.
E-learning with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online, with progress by department for the certification audit. Sterling consulting clients get preferential course access and special pricing, including complimentary awareness training for their people as part of the engagement.
Contact us about Academy accessStandards
Standards for Aerospace and defence
- AS9100AS9100 certification consulting for aerospace and defence suppliers: ISO 9001 plus product safety, configuration and FAI, ready for an IAQG scheme audit.
- AS9110AS9110 certification for aviation maintenance organisations: the 9110 requirements, the IAQG audit route, cost and timeline factors, and Sterling's support.
- AS9120AS9120 certification for aerospace distributors and stockists: requirements, the IAQG audit route, OASIS listing, cost and timeline factors, with Sterling.
- ISO 45001ISO 45001 certification consulting to prevent work-related injury and ill health, with an OH&S system built with your people and audit-ready, in 60+ countries.
- ISO/IEC 27001ISO/IEC 27001 certification consulting: an ISMS built with your people, evidence prepared, and support through Stage 1, Stage 2 and surveillance audits.
- ISO/IEC 17025ISO/IEC 17025 accreditation consulting for testing and calibration laboratories: competence, impartiality and evidence ready for accreditation assessment.
- ISO 9001ISO 9001 certification consulting: a quality management system built with your people, evidence prepared and support until an accredited body certifies you.
- CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.
Aerospace and defence client experience
Client letters on file, available on request.
Signed client letters in related sectors are available on request. The client feedback wall lists every letter by standard.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions aerospace and defence clients ask before they engage us.
The specific answers for your organisation come from the discovery call. These are the general ones.
Which ISO certification does an aerospace supplier need first?
For design, production or engineering work, AS9100 is normally the first certificate primes ask for, because they check 9100-series certification in OASIS before approval. AS9100 contains the whole of ISO 9001, so an AS9100 system already meets every ISO 9001 requirement. ISO 9001 on its own remains a sensible first step for a business still working towards its first aerospace order. Maintenance organisations use AS9110 and distributors AS9120.
We already hold ISO 9001. How much more work is AS9100?
A meaningful but manageable step: your ISO 9001 system stays, and AS9100 adds the aerospace requirements on top. The work sits in operational risk management, configuration management, product safety, counterfeit-part prevention, critical items and key characteristics, first article inspection, supplier flow-down and human factors. A working ISO 9001 system puts you at the shorter end of the typical six to twelve months; qualifying special processes or re-approving a supply chain puts you at the longer end.
Our prime has asked about CMMC. Where do we start?
Start by establishing whether you handle Federal Contract Information only, or Controlled Unclassified Information as well, because that decides the level. Level 1 covers FCI with 15 basic safeguarding requirements, self-assessed every year; Level 2 covers CUI with the 110 requirements of NIST SP 800-171 Rev 2. We trace where that information lives, define the assessment scope, write the system security plan and prepare the SPRS entry your senior official affirms.
Can AS9100, ISO 14001 and ISO 45001 run as one system?
Yes, and on a shop floor that is usually the sensible design. The three standards share a common high-level structure, so one document system, one risk process, one internal audit programme and one management review can serve all of them, whether the certification body audits them together or separately. Your people learn one way of working, and the environmental and safety controls sit beside the production controls they affect.
Does ISO/IEC 27001 certification satisfy CMMC?
No. CMMC Level 2 is assessed against the 110 requirements of NIST SP 800-171 Rev 2, and an ISO/IEC 27001 certificate does not replace that assessment. The two overlap, and NIST's own publication includes an informal mapping to ISO/IEC 27001, so an information security management system can carry the CUI programme, its risk assessment and its evidence. For a supplier that also serves commercial customers, running both from one system avoids doing the work twice.
Does ISO 9001:2026 or the 9100 revision change what we build now?
Not the starting point. AS9100 certification continues to Rev D until the IAQG publishes the revision, which it has slated for the first quarter of 2027 as IA9100, linked to ISO 9001:2026. We build to Rev D and keep the system ready for the revised edition, so the change becomes a planned review rather than a rebuild. If your certificate also cites ISO 9001:2015, ask your certification body how the two transitions will be handled.
Who audits us, and how does a prime see the result?
An accredited certification body working under the IAQG scheme audits you with IAQG-authenticated auditors, and records the certificate and audit results in OASIS, where primes check their suppliers. Sterling does not certify, assess or approve suppliers. We build the system with you, prepare you for the Stage 1 readiness review and the Stage 2 audit, and help you check a body's accreditation and OASIS listing before you sign with it.
Talk to a consultant
Plan certification for your aerospace and defence operation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice