ISO and GRC standards for aerospace and defence: where to start: video

What aerospace and defence suppliers are asked for

Aerospace primes check 9100-series certification in OASIS, the International Aerospace Quality Group's database, before they approve a supplier, and US defence solicitations name the CMMC level they expect. For a machine shop, an electronics assembler, a maintenance organisation or a defence subcontractor, the standards therefore decide whether the work can be won at all.

The family most often requested is the 9100 series: AS9100 for design and production, AS9110 for maintenance, repair and overhaul, and AS9120 for distributors. Around it sit ISO 9001 as the quality foundation, CMMC 2.0 and NIST SP 800-171 where defence information such as controlled unclassified information is handled, ISO/IEC 27001 for information security, ISO 14001 and ISO 45001 for environment and safety, and ISO/IEC 17025 for laboratories. This short film sets out that landscape and where a supplier should begin.

Why suppliers act now, and where to start

The pressures are familiar across the sector. Primes look suppliers up in OASIS, and no listing means no approval. Defence solicitations name the CMMC level they expect. Requirements flow down every tier: CMMC applies to subcontractors that handle federal contract information or controlled unclassified information, and AS9100 asks you to pass critical items, key characteristics and counterfeit-part controls to your own suppliers. And the editions keep moving, so systems built today have to absorb revisions tomorrow.

The usual starting point is the standard your customer names: AS9100, AS9110 or AS9120 for supplier approval, or the CMMC level and NIST SP 800-171 for defence information. From there, quality, environment, safety and information security can run as one integrated system rather than five separate ones. The free Select the Standard™ tool and the readiness checks help confirm the priority before any commitment.

Sterling's expert and experienced consultants build AS9100 and the standards around it with your engineers, planners, inspectors and IT team, with the system run in Effivity, included with the engagement. Sterling does not certify: an accredited certification body audits and decides, and records the certificate in OASIS.