Most defense manufacturers run two compliance programs that never speak to each other. One binder for the AS9100 quality auditor, a separate one for the cyber assessor, two sets of owners, two calendars, two fire drills a year. The overlap between them is large enough that maintaining them separately is paying twice for evidence you only need to produce once.

The fix is to treat your aerospace quality management system as the host and fold the cyber requirements into it as a defined set of processes, rather than standing up a parallel program with its own life. You already maintain a controlled, audited management system. The cyber controls have homes inside it.

Where AS9100 and CMMC actually overlap

AS9100 and CMMC 2.0 overlap most heavily on the management-system disciplines: document and record control, risk management, corrective action, internal audit, and management review. These are clauses you already run for quality, and they are the same disciplines NIST asks for in security.

AS9100 is the aerospace quality management standard built on ISO 9001, adding aviation, space, and defense requirements. CMMC 2.0 Level 2 is built on NIST Special Publication 800-171, which defines 110 security controls across 14 control families for protecting Controlled Unclassified Information (CUI). The two standards were written for different purposes, but the machinery they require is often the same machinery:

  • Document and record control. AS9100 Clause 7.5 governs documented information. NIST 800-171's Media Protection (3.8) and Configuration Management (3.4) families govern controlled documents and baselines. Same control discipline, different document set.
  • Risk management. AS9100 Clause 6.1 and 8.1.1 require risk-based thinking and operational risk planning. NIST 800-171's Risk Assessment family (3.11) requires you to assess and manage security risk. One risk process, two risk registers feeding it.
  • Corrective action. AS9100 Clause 10.2 is your nonconformity and corrective action process. NIST's Incident Response (3.6) family is, in operational terms, corrective action applied to security events. The same root-cause-and-close workflow handles both.
  • Internal audit. AS9100 Clause 9.2 requires a planned internal audit program. NIST 3.12 (Security Assessment) requires periodic control assessment. One audit calendar covers both scopes.
  • Management review. AS9100 Clause 9.3 puts results in front of top management. The same review meeting can carry the security posture, the SPRS score, and the POA&M status.

If you already run corrective action for a quality escape, you already own the engine that closes a security finding. You do not need a second engine. You need to route the second input into the one you have.

Where they do not overlap, and why that matters

Auditing once works only if you are honest about where the standards diverge, because the gaps are where quality coverage runs out and an assumption quietly becomes an overstated score.

The technical security controls in NIST 800-171 have no AS9100 equivalent. Access Control (3.1), Identification and Authentication (3.5), System and Communications Protection (3.13), and Audit and Accountability (3.3) are engineering controls on your IT and OT environment: multifactor authentication, network boundary protection, audit logging, FIPS-validated encryption. AS9100 never asked for these, so there is no existing process to fold them into. They are net-new, and they live with IT, not quality.

The integrated approach is not pretending the two standards are the same. It is mapping the management-system clauses onto your existing AS9100 structure, and building the technical controls as new processes governed by that same structure. The quality system becomes the system of record. The cyber controls become processes inside it.

Build one evidence system, not two binders

The reason two programs cost more than one is evidence. Each audit wants proof, and when the programs are separate, you generate proof twice: a quality version and a cyber version of the same training record, the same access log review, the same management-review minutes.

A single integrated management system produces one piece of evidence that answers both auditors:

  • One controlled-document register holds the quality procedures and the System Security Plan (SSP). The SSP, required to claim a CMMC self-assessment score, lives under the same document control your AS9100 procedures already use.
  • One corrective-action log holds quality nonconformities and security Plan of Action and Milestones (POA&M) items. A POA&M is a corrective-action record with a remediation date, which is what your quality system already tracks.
  • One internal-audit schedule covers process audits for AS9100 and control assessments for NIST 800-171, with findings flowing into the same corrective-action log.
  • One management review reports quality metrics and the Supplier Performance Risk System (SPRS) score together, so leadership sees both in the same meeting.

This is the difference between compliance as a workflow and compliance as a stack of PDFs. The PDF approach produces a binder that is accurate the week of the audit and stale the week after. The workflow approach produces evidence as a byproduct of running the business, which is exactly what an auditor wants to find.

What the assessor sees, and why integrated wins the room

The contractual driver is real, and as of July 2026 it is a clause rather than a date. On July 13, 2026 the Department suspended CMMC Phase II, the phase originally scheduled for November 10, 2026 that would have made third-party (C3PAO) Level 2 certification mandatory in applicable DoD contracts, and opened a reform review of the program under 32 CFR Part 170. What stayed: the DFARS 252.204-7012 safeguarding obligation, the -7019 and -7020 SPRS self-assessment, and enforcement of NIST 800-171 Revision 2 through self-assessments and select government-led assessments. Per CyberSheath's 2025 State of the DIB report, only 1 percent of defense contractors feel fully prepared for these assessments.

When an assessor walks into a shop that runs an integrated system, whether that is a government-led NIST 800-171 assessment, a prime's supplier audit, or whatever the reform task force ultimately produces, they see security controls operating inside a quality system that has already survived years of AS9100 surveillance audits. The corrective-action process has a track record. The document control is mature. The internal audit cadence is established. The assessor is evaluating new technical controls against a management system that demonstrably works, which is a far easier room to win than a security program stood up six months ago with no audit history.

The manufacturer who bolted on a separate cyber binder is asking the assessor to trust a brand-new program. The manufacturer who integrated is asking the assessor to trust a proven one with new inputs. That is the quiet advantage of auditing once.

The suspension sharpens that advantage rather than blunting it. A program built to pass one dated exam has nothing to show on a Tuesday when the exam moves. A program built inside the management system you already audit produces the same evidence on any Tuesday, for any assessor, under whatever rule the review lands on.

How to start the integration without stopping production

You do not rebuild the management system. You extend it. The practical sequence:

  1. Map the 110 NIST 800-171 controls against your AS9100 clauses. Every control either has a home in an existing process or is net-new. The mapping itself is the deliverable that tells you the size of the real gap.
  2. Route the overlapping controls into the existing process. Security findings into corrective action, the SSP into document control, control assessments into the internal audit schedule.
  3. Stand up the net-new technical controls as governed processes, owned by IT, audited on the same calendar, reporting into the same management review.
  4. Post the SPRS self-assessment score once the SSP and POA&M support it, as 252.204-7019 requires a current score on file.

The bottom line

AS9100 and CMMC 2.0 overlap on document control, risk, corrective action, internal audit, and management review, so the management-system half of CMMC can live inside the quality system you already audit. Map the 110 NIST 800-171 controls onto your AS9100 structure, route the overlap into existing processes, build the technical controls as net-new governed processes, and you maintain one evidence system instead of two binders. With CMMC Phase II suspended as of July 2026 and the underlying DFARS obligation untouched, the integration is the cheaper and stronger path precisely because it never depended on the date, and it starts with the control map.

Sources

  • IAQG, 9100 Quality Management Systems, Requirements for Aviation, Space and Defense Organizations. The standard itself, described by its owner as a quality management system with additional requirements over an ISO 9001 system, for the aviation, space and defense industries. The International Aerospace Quality Group designates it 9100; AS9100 is the SAE Americas designation of the same document. The clause text is a paywalled normative standard, so the clause numbers cited above should be read against your own controlled copy.
  • NIST SP 800-171 Revision 2. The 110 security requirements and the 14 control families, including every family number referenced above: Access Control (3.1), Audit and Accountability (3.3), Configuration Management (3.4), Identification and Authentication (3.5), Incident Response (3.6), Media Protection (3.8), Risk Assessment (3.11), Security Assessment (3.12), and System and Communications Protection (3.13). NIST withdrew Revision 2 in May 2024 in favor of Revision 3; it still governs DoD work because 32 CFR 170 incorporates Revision 2 by reference.
  • 32 CFR 170.24, CMMC Scoring Methodology. The technical controls named as net-new here, in their codified form: FIPS-validated encryption is requirement SC.L2-3.13.11 and multifactor authentication is IA.L2-3.5.3. Also the rule that an assessment cannot be completed without a current System Security Plan (CA.L2-3.12.4).
  • 32 CFR 170.21, Plan of Action and Milestones requirements. What a POA&M is permitted to carry and the 180-day closeout window, which is why a POA&M behaves like a corrective-action record with a remediation date.
  • DoD CIO, About CMMC. The July 13, 2026 suspension of Phase II, the Phase 1 pause, and the statement that the action does not eliminate the requirement to protect information under DFARS 252.204-7012. Also the source for enforcement of NIST 800-171 Revision 2 through self-assessments and select government-led assessments during the review. Retrieved July 16, 2026.
  • DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. The safeguarding obligation that survived the suspension. Retrieved July 16, 2026.
  • DFARS 252.204-7019, Notice of NIST SP 800-171 DoD Assessment Requirements. The requirement for a current score on file, not more than three years old, to be considered for award. Retrieved July 16, 2026.
  • CyberSheath, State of the DIB Report 2025. The 1 percent readiness figure. A vendor-commissioned survey, conducted by Merrill Research, and cited as such. Retrieved July 16, 2026.