日本語

Industry

How a Metalworking Company Can Enter the U.S. Defense Industry: Entry Points, SAM.gov and JCP, ITAR, CMMC, Specialty Metals, Hurdles

Start with SAM.gov and CAGE! Registration is free. Lock down your drawing control first.

Chips, the Kezuriba mascot
How a Metalworking Company Can Enter the U.S. Defense Industry: Entry Points, SAM.gov and JCP, ITAR, CMMC, Specialty Metals, Hurdles

The number of small businesses doing business with the DoD fell by more than 40% between FY2011 and FY2020, and the Department of Defense (Department of War) now makes lowering barriers to entry for small and new companies a pillar of its acquisition reform. For turning, milling, grinding, heat-treating and finishing shops, defense work means making the same parts for years, but getting in means dealing with a stack of unique rules on registration, export control, cybersecurity and material origin. This article walks through how to choose an entry point, registration from SAM.gov to JCP, ITAR registration and disclosure to foreign persons, the latest status of CMMC, specialty metals and quality requirements, the realities of cost and payment, step by step, based on primary federal sources (as of October 2026).

DoD (Army, Navy, Air Force, DLA, etc.)Buyer (contracting officer). Oversight: DCMAPrime contractorsLarge firms contracting directly with DoD (aircraft, ships, vehicles)Tier 1, Tier 2Component and subsystem makersTier 3 and below: specialistsMachining, heat treat, finishing, NDT, sheet metal, welding← The easiest place for a machine shop to startOrdersRoute A: SubcontractSupply primes or tier suppliersRoute B: Direct to DLAQuote spare parts on DIBBSRoute C: Small businessSet-asides, SBIRD: Free helpAPEX, Mentor-Protégé, MEPWhat flows down through contractsCybersecurity rulesDFARS 7012, SPRS, CMMCExport controlITAR, EAR (incl. foreign persons)Material originSpecialty metals: U.S. or qualifying-country meltQuality requirementsAS9100, first article inspectionRecords and oversightDCMA, prime contractor auditsDoD estimates that more than 200,000 suppliers are involved in producing weapon systems and non-combat items.Even as a subcontractor, the same cyber, export control and material rules as the prime's come with the contract clauses (flowdown).
The defense supply chain and entry points (conceptual diagram). Supplier count from GAO-25-107283[3]; flowdown of clauses to subcontractors per the DFARS CMMC rule[36], 252.204-7020[33] and 252.225-7009[43] .

Why the defense industry is looking for new companies now

According to an analysis by the Government Accountability Office (GAO), the number of small businesses with DoD contracts fell 43%, from 42,723 in FY2011 to 24,296 in FY2020. Meanwhile, contract dollars to small businesses rose, reaching $80.5 billion in FY2020 (FY2020 dollars), the highest in the decade. In other words: "more money, but fewer companies receiving it"[2]. In a 2025 report, GAO also found that DoD's supply chain visibility does not reach down to the raw material and component tiers, and that DoD has not fully grasped its dependence on foreign sources[3].

Of about $755.1 billion in federal contract obligations in FY2024, DoD accounted for $445.1 billion[4]. The Defense Logistics Agency (DLA), which centrally buys spare parts, alone provided more than $51.8 billion in goods and services in FY2025[9], and the Defense Contract Management Agency (DCMA), which oversees contracts, is responsible for more than 300,000 contracts and more than 18,000 contractor locations[8].

DoD procurement funding ($ billions, nominal)Actual / enactedRequest (pending)$0$100$200$300$400120FY16126FY17148FY18149FY19144FY20143FY21156FY22182FY23205FY24187FY25224FY26413FY27TOA (Total Obligational Authority). Includes supplemental and mandatory funding. FY2025 and FY2026 include allocations from the 2025 reconciliation act (P.L. 119-21).FY2027 is the President's April 2026 request and assumes $350 billion in mandatory funding from the next reconciliation bill (subject to change in Congress).
DoD procurement funding over time. Drawn from the values in Table 6-1 of the FY2027 Green Book[5] ; notes are from the FY2027 Overview Book[6] .

DoD's FY2026 budget (TOA) is about $1.015 trillion, of which procurement is $223.8 billion. The FY2027 request is about $1.45 trillion, with procurement at an unprecedented $413.1 billion, putting munitions, drones, shipbuilding and expanded domestic production capacity front and center[5][7][6]. It may not be enacted as requested, but the direction toward building more is clear.

In July 2026, DoD halted the next phase of its CMMC cybersecurity certification. It explained that the costs and procedures of certification were driving small and new companies away from the defense industry[40]. "Lowering barriers to entry for small companies" is one of the pillars of current acquisition reform.

About the name "Department of War"A September 2025 executive order allowed the Department of Defense to also use the name "Department of War." The statutory name remains the Department of Defense, and the names of regulations and clauses (DoD, DFARS) are unchanged[1]. Official websites and documents in 2026 mostly use "DoW"; read it as the same organization.

Four entry points: start as a subcontractor

RouteWhat it looks likeWhat you needBest suited to
A Subcontract
(the most common)		Become a supplier to a prime or a Tier 1/Tier 2 supplier and deliver parts, machining or processing to printPrime's supplier qualification (quality, cyber, export control, financials). Clauses flow down via purchase ordersCompanies strong in a specific process: turning, machining, grinding, heat treatment, surface treatment, etc.
B Direct to DLAAnswer DLA requests for quotation (RFQs) for spare parts and consumables on DIBBSSAM.gov, CAGE and DIBBS registration. JCP to view drawings. Source approval for some itemsShops that can make small-lot spare parts from drawings
C Small business programsBid on small business set-asides or apply for SBIR R&D fundingMeet SBA size standards (500 employees or fewer for machine shops)Companies with unique processes, materials or inspection capabilities
D Free helpGet help preparing and finding customers from APEX Accelerators, the Mentor-Protégé Program and MEPRequest counselingCompanies unsure where to start

Route B: Quote directly to DLA on DIBBS

DLA's weapon-system supply chains (DLA Land and Maritime in Columbus for land and maritime parts, DLA Aviation in Richmond for aviation parts) accept many RFQs only through DLA Internet Bid Board System (DIBBS). DLA's recommended order for getting started: (1) consult your local APEX Accelerator, (2) register in SAM.gov and get a CAGE code, (3) register in DIBBS, (4) prepare for CMMC and SPRS, (5) get JCP certification if needed, (6) find RFQs and bid. Procurements over $25,000 are also posted on SAM.gov[10].

Some items are restricted to approved sourcesSome items, such as safety-critical parts, are bought only from approved manufacturers and part numbers. A company that wants to become a new source submits a Source Approval Request (SAR) to DLA. You can submit one without an open RFQ, but you need drawings, a manufacturing plan and inspection data, and review usually takes 90–120 days. Approval does not guarantee orders[49].

Route C: Small business set-asides and SBIR

  • Small business set-asides: Acquisitions over $15,000 (the micro-purchase threshold) and up to $350,000 (the simplified acquisition threshold) are generally set aside for small businesses if offers from two or more small businesses at fair prices, with acceptable quality and delivery, are expected. Above $350,000 they are set aside when the same expectation exists (the "rule of two")[21][22].
  • Limitations on subcontracting: A company that wins a small business set-aside contract for supplies (over $350,000) may not pay more than 50% of the amount it receives to subcontractors that are not similarly situated. Cost of materials is not counted as subcontracting[23].
  • SBIR: R&D funding. Typical awards are 6–12 months and $50,000–$275,000 for Phase I, and 24 months and $750,000–$1.8 million for Phase II. The government takes no equity and no IP[18]. The program lapsed at the end of September 2025, but an extension through September 30, 2031 was enacted on April 13, 2026[17]. It suits companies that want to commercialize new processes (difficult-to-cut materials, post-processing of additively manufactured parts, automated inspection, etc.).

Start with free counselingFunded by the DoD Office of Small Business Programs, APEX Accelerators have more than 90 locations nationwide and help with registration and review bid documents at no cost[14]. Under DoD's Mentor-Protégé Program , large companies doing business with DoD (often primes) serve as mentors, spending 2–3 years teaching small businesses quality, procurement and cybersecurity while steering work to them (the mentor submits the application)[15]. The state-based MEP (Manufacturing Extension Partnership centers, more than 450 locations across all 50 states and Puerto Rico) advise on improvements, including cybersecurity[16].

Registration order: SAM.gov, CAGE, NAICS, JCP

  1. Register your entity in SAM.gov: This is the registration for doing business with the federal government, and it assigns your unique entity identifier, the UEI . Registration must be renewed every 365 days to stay active[13]. Cost of registration: Free. Anyone who contacts you asking for a fee ("we'll register for you," "your registration will lapse unless you renew") is not the government[12].
  2. CAGE code: A five-character identifier assigned by DLA's CAGE Program Office and requested automatically as part of your SAM.gov registration. Processing takes up to about 10 business days[11]. It's also the first number primes ask for when you register as a supplier.
  3. Check your NAICS code and size: The small business size standard for machining (332710 Machine Shops) is 500 employees[19]. Employees are averaged over the last 24 months, counting part-time and temporary workers and all domestic and foreign affiliates (including parent companies) as well[20].
  4. JCP certification (DD Form 2345): Required to receive export-controlled military technical data (drawings, etc.) from DLA. You must be located in the U.S. or Canada, be registered in SAM.gov with a CAGE code, and have a NIST SP 800-171 assessment posted in SPRS. It requires renewal every 5 years, and both new applications and renewals should be submitted at least 120 days before you need them. You also designate an in-house Data Custodian[24].
NAICSIndustrySmall business limit (employees)
332710Machine Shops500
332721Precision Turned Product Manufacturing500
332811Metal Heat Treating750
332813Electroplating, Plating, Polishing, Anodizing and Coloring500

NAICS size standards relevant to metalworking (13 CFR 121.201, as of October 2026)[19]. The contracting officer assigns the NAICS code for each solicitation.

ITAR and EAR: manufacturing alone requires registration

Export control is where shops handling defense drawings most often stumble. A company that manufactures defense articles on the U.S. Munitions List (USML) in the United States must register with the State Department's Directorate of Defense Trade Controls (DDTC) even if it does not export. Manufacturing even once counts[25]. The same applies to a subcontractor that only machines parts to print, if the part is a USML item.

DDTC registration fee tierWhat's coveredAnnual fee
Tier 1New registrants and registrants with no licenses or other approvals in the prior year$3,000
Tier 2Registrants with 5 or fewer licenses or other approvals$4,000
Tier 3Registrants with 6 or more licenses or other approvals$4,000 + $1,100 per approval over 5

ITAR registration fees (22 CFR 122.3, from January 2025)[26]. Approvals are counted over the 12 months ending 90 days before the renewal date.

  • Showing drawings to foreign persons is also an "export": Even inside the U.S., showing or giving technical data to a foreign person (anyone who is not a U.S. citizen, permanent resident, etc.) is deemed an export and requires authorization. The same applies if showing a part reveals technical data[28]. The EAR has the same "deemed export" concept[29]. Decide who may access drawings, including employees, temps, visitors and even outside CAD contractors.
  • Report changes promptly: Notify DDTC within 5 days of changes to your name, address, ownership or control, and at least 60 days before transferring ownership or control to a foreign person[27]. If you are considering foreign investment or a sale, check early.
  • EAR "600 series": Many military items formerly on the USML are now controlled under "600 series" ECCNs on the Commerce Control List (CCL)[30]. Leaving the USML does not mean an item is uncontrolled. Check your prime's designation, and request a commodity jurisdiction (CJ) determination when in doubt.

Cyber rules: DFARS 7012, SPRS, CMMC

Most defense drawings, specifications and process sheets are Controlled Unclassified Information (CUI). Under contract clause DFARS 252.204-7012 , the systems of companies handling it must meet NIST SP 800-171 controls, and cyber incidents must be reported within 72 hours of discovery. The clause's definition of "technical information" explicitly includes drawings, specifications and process sheets[31].

  • SPRS score: A company required to implement NIST SP 800-171 is not eligible for award unless a summary score from an assessment within the last 3 years is posted in DoD's Supplier Performance Risk System (SPRS). Primes also cannot award work to subcontractors without an assessment. A self-conducted Basic Assessment is fine to start[32][33].
  • The standard is Rev. 2: NIST SP 800-171 Rev. 3 was published in May 2024[34], but DoD's CMMC still uses the 110 requirements of Rev. 2 as its baseline[38][41].
CMMC levelInformation protected and requirementsAssessmentStatus in October 2026
Level 1Federal Contract Information (FCI). 15 requirements in FAR 52.204-21Annual self-assessment and affirmation (posted in SPRS). No POA&M (plan to fix unmet requirements later) allowedRequired
Level 2CUI. 110 requirements of NIST SP 800-171 Rev. 2Assessment every 3 years plus annual affirmation. Self-assessment or certification assessment by a third-party assessment organization (C3PAO)Self-assessment only (C3PAO assessments suspended)
Level 3Higher-priority CUI. 24 requirements selected from NIST SP 800-172Assessed by DoD's DIBCACSuspended

CMMC levels (32 CFR 170.14, 170.21)[38][39] and their status as of October 2026[41]. At Level 2, a "conditional" status is allowed under conditions such as scoring at least 80% of the maximum, and remaining items must be closed out within 180 days.

Dec 16, 202432 CFR Part 170 takes effectCMMC program establishedNov 10, 2025Phase 1 begins (DFARS rule effective)L1/L2 self-assessments required for awardJul 13, 2026Phase II suspended; 60-day reviewPaused at Phase 1Nov 10, 2026 (was planned)Phase 2: L2 third-party assessment(C3PAO) required for award2027–2028 (was planned)Phases 3–4: L3 (DIBCAC)and full implementationAs of October 2026: paused at Phase 1. Only Level 1 and Level 2 self-assessments are required.DFARS 252.204-7012 obligations, SPRS posting and annual affirmations continue. The review's conclusions have not yet been announced.
CMMC rollout timeline. Dates are from two Federal Register rules[35][36], the phase-in rules (32 CFR 170.3)[37], the DoD announcement[40] and the DoD CIO page[41] . Dates from Phase 2 onward are planned dates calculated from the rules before the suspension.

CMMC Phase 1 began on November 10, 2025, and third-party assessments (C3PAO) were to become a condition of award a year later, on November 10, 2026. But DoD immediately suspended the Phase II rollout on July 13, 2026, paused all later phases, and set up a working group to review the entire program within 60 days. In the meantime, it says it will verify compliance with NIST SP 800-171 Rev. 2 through self-assessments and some government assessments[40][41]. In September 2026, as part of the Revolutionary FAR Overhaul, the DFARS Part 240 class deviation was also revised, so clause locations and numbers may move in the future[42].

What stopped is the "assessment," not the "obligation to comply"DoD has stated clearly that the suspension does not eliminate the obligation to protect CUI, and that contractual obligations under DFARS 252.204-7012 remain in place[40]. A self-assessment is an annual affirmation in SPRS by a senior company official that the company "continues to comply"[36]; if that does not match reality, the company may be held liable. Third-party assessments may return in a different form after the review, so "it's paused, so we'll do nothing" is risky.

As a cost guide, DoD's CMMC rule estimated assessment costs per small business at $5,977 per year for a Level 1 self-assessment, $37,196 over 3 years for a Level 2 self-assessment, and $104,670 over 3 years for a Level 2 C3PAO assessment. All of these assume NIST SP 800-171 is already implemented; they cover the assessment only and exclude equipment replacement and building internal systems[35].

A realistic first step for a small companyThe shortcut is to shrink the area where CUI is handled as much as possible. Separate the PCs, CAM stations and file storage that handle defense drawings from the rest of your network (an enclave), ban USB drives and personal email, designate who handles it and give them separate accounts, and log entry and exit. Starting here keeps both the assessment scope and the cost small. MEP and APEX can also help[16][14].

Quality and materials: AS9100, first article inspection, specialty metals

The FAR calls for "higher-level quality requirements" in contracts for complex or critical items, citing examples such as ISO 9001, SAE AS9100 and AS9003[47]. For aircraft and missile parts, primes often require AS9100 certification from suppliers, and for each part you'll be asked for first article inspection (FAI) records in AS9102 format. AS9102 was revised to Revision C in June 2023[48]. MIL standards and specifications cited on drawings can be searched by number in DLA's ASSIST[50]. DoD contracts are overseen by DCMA, whose roughly 9,200 employees check quality, delivery and cost at field offices and contractor plants[8]. For processes like heat treating, plating and welding, where quality can't be verified by inspecting the finished product afterward, be ready to show records down to temperature and solution control and operator qualifications.

Specialty metals (DFARS 252.225-7009)

What hits metalworking shops most directly are the origin rules for specialty metals. Specialty metals in items delivered to DoD must be melted or produced in the United States, its outlying areas, or a qualifying country to comply[43].

Specialty metalConditionsCommon examples in metalworking (guide)
SteelExceeds Mn 1.65%, Si 0.60% or Cu 0.60%, or contains more than 0.25% of any of Al, Cr, Co, Mo, Ni, Nb, Ti, W or VStainless steel, alloy steels such as chrome-moly, tool steel
Nickel and iron-nickel alloysAlloying elements other than nickel and iron total more than 10%Nickel-based superalloys (718, 625, etc.)
Cobalt alloysAlloying elements other than cobalt and iron total more than 10%Wear- and heat-resistant cobalt-based alloys
Titanium, zirconiumAll, both unalloyed and alloysTi-6Al-4V, etc.

Definition of specialty metals (DFARS 252.225-7009(a))[43]. Ordinary carbon steel and aluminum alloys are not covered unless they meet the conditions above. The examples column is the editors' guide; check composition on the mill cert.

  • Qualifying countries: 27 countries, including Japan, Canada, the UK, Germany, France, Israel and Turkey (Austria is decided case by case). China, Taiwan, South Korea and India are not included[44]. When buying material, check the mill cert for the country of melt and keep records.
  • The 2% exception: Nonconforming specialty metal is allowed if it is no more than 2% of the total weight of specialty metal in the end item (high-performance magnets excluded). Electronic components and some other items are also exempt[43]. However, since this is "2% by weight of the end item," assume it can't be used for the material of major parts.
  • Berry Amendment: In addition to food, clothing, textiles and other items, hand or measuring tools delivered to DoD must also be domestic[45]. Watch out when you make tools or fixtures themselves as deliverables.
  • Counterfeit part prevention: Electronic parts must be bought from the original manufacturer or authorized distributors at all tiers[46]. This also matters for metal parts shops when they deliver units that incorporate sensors or wiring.

Order of steps to entry (guideline)

0–3 monthsTake stock & register• SAM.gov, CAGE (free)• Talk to APEX• Check if drawings are ITAR3–12 monthsBuild the system• NIST SP 800-171, SPRS• ISO 9001 → AS9100• Record country of melt1–2 yearsTrack record as subcontractor• Prime supplier audits• FAI (AS9102)• DDTC registration, JCP2 years+Expand• Bid directly on DIBBS• Set-asides, SBIR• Source approval (SAR)
A rough roadmap to entry (varies widely with company size and target items).
  1. List your strengths: difficult-to-cut materials (titanium, superalloys, high-strength steel), deep holes, thin walls, large parts, tight tolerances, in-house heat treating and finishing, high-mix low-volume work, the ability to keep making the same part for decades, and so on.
  2. Get SAM.gov and CAGE, and talk to APEX: all free[12][14]. You'll also need a CAGE code to register on primes' supplier portals.
  3. Build your cyber and quality foundation first: Define where CUI is handled, perform a NIST SP 800-171 self-assessment, and post it in SPRS[32]. For quality, move from ISO 9001 to AS9100.
  4. Manage materials and records: Confirm the country of melt on mill certs and keep them tied to lots[43]. Be ready to provide first article inspection records.
  5. Expand once you have a track record: If you make USML parts, register with DDTC; to view DLA drawings, get JCP; to become an approved source for spare parts, submit a SAR[25][24][49].

The real hurdles and how to deal with them

HurdleDetailsExample countermeasures
Cyber costs and outlookAssessments alone are estimated at several thousand to about $100,000. CMMC is under review, and how third-party assessments will return is undecided[35][41]Narrow the scope where CUI is handled. Post honest self-assessments and fix gaps on a plan
Payment and cash flowThe standard due date is the 30th day after the later of invoice receipt or acceptance[52]. DoD aims to speed up payments to small businesses, with a 15-day target[51]. Subcontract terms depend on negotiation with the primeConfirm invoice formats and acceptance procedures up front. Keep enough working capital
Export control burdenDDTC registration starts at $3,000 a year. Showing drawings to foreign employees or visitors is also an export[26][28]Decide who can access drawings and where. Build it into hiring, visitor and outsourcing procedures
Material sourcingSpecialty metals must be melted in the U.S. or a qualifying country, which can rule out cheaper imported material[43][44]Use separate suppliers for defense material and record the country of melt
Approval and track record barriersSome items are bought only from approved sources. SAR review takes 90–120 days[49]Build a track record making the same parts for primes first
Classified work and foreign ownershipYou can't apply for a facility clearance for classified work yourself; you need sponsorship from the government or a prime. Companies whose management foreign capital can influence must adopt FOCI mitigation[53][54]Parts-machining subcontracts rarely involve classified work. Start with unclassified jobs

Good fits, and companies that should think carefully

Good fit
  • You already do difficult-to-cut or tight-tolerance work in aerospace, medical, etc.
  • You manage mill certs, inspection reports and traceability
  • You have the size and structure to limit the people and terminals that handle drawing data
  • You're used to high-mix low-volume work and making the same parts for many years
Think carefully
  • You rely almost entirely on imported material from non-qualifying countries
  • You freely exchange CAD/CAM data with outside foreign persons
  • Your plan relies on defense for most of your sales (exposed to budget and policy changes)
  • A sale to or investment from foreign capital is in progress (affects ITAR notifications and FOCI)

How it differs from entering Japan's defense industry

ItemUSAJapan
Registration for direct contractingSAM.gov (free, renewed every 365 days) and CAGE[13][11]Unified Qualification for All Ministries and Agencies (renewal review every 3 years)[55]
Cybersecurity standardDFARS 252.204-7012, NIST SP 800-171, SPRS, CMMC[31][41]Defense Industry Cybersecurity Standard (Japan's ATLA describes it as equivalent to NIST SP 800-171)[56]
Free counselingAPEX Accelerators (90+ locations nationwide)[14]ATLA's New Entrant Consultation Desk[57]

FAQ

Can a 20-person job shop get in?
Yes. DoD sees the decline in small businesses as a problem and offers free support such as APEX Accelerators and the Mentor-Protégé Program[2][14][15]. The usual starting point is subcontracting to a prime or supplying small orders of spare parts to DLA.
If CMMC is paused, can cybersecurity wait?
No. What was paused is the rollout of third-party assessments. DFARS 252.204-7012 obligations, posting scores in SPRS, and Level 1 and Level 2 self-assessments with annual affirmations all continue[40][41]. Primes cannot award covered work to subcontractors without an assessment score[33].
Does SAM.gov registration cost anything?
No. Registration and renewal are both free. Vendors who contact you asking for a fee are not the government[12]. Registration must be renewed every 365 days[13].
Why do I need ITAR registration if I don't export?
Because ITAR requires any company that manufactures USML items in the United States to register with DDTC, whether or not it exports. Manufacturing even once counts[25]. To check whether a part is on the USML, confirm the prime's designation and the notes on the drawing.
Can I use material made in Japan?
Yes. Japan is a qualifying country for specialty metals, so specialty metal melted in Japan can be used[43][44]. Material melted in China, Taiwan, South Korea or India is not from a qualifying country and cannot be used unless an exception such as the 2% rule applies.

Cutting conditions for difficult-to-cut materials common in defense work: Materials database, hole and fit data: Fits and Tolerances, and dimensional change from surface treatment: How to tell black oxide from plating, and how dimensions change.

Sources

  1. Federal Register, "Restoring the United States Department of War" (Executive Order, 90 FR 43893, September 10, 2025)
  2. GAO-22-104621, "Small Business Contracting: Actions Needed to Implement and Monitor DOD's Small Business Strategy" (October 2021)
  3. GAO-25-107283, "Defense Industrial Base: Actions Needed to Address Risks Posed by Dependence on Foreign Suppliers" (July 2025)
  4. GAO, "A Snapshot of Government-Wide Contracting for FY 2024" (June 2025)
  5. Office of the Under Secretary of War (Comptroller), "National Defense Budget Estimates for FY 2027" (Green Book, Table 6-1, PDF)
  6. Office of the Under Secretary of War (Comptroller), "FY 2027 Budget Request Overview Book" (April 2026, PDF)
  7. Congressional Research Service R49023, "FY2027 Defense Budget: Funding for Selected Weapon Systems" (updated September 2026)
  8. Defense Contract Management Agency, "About DCMA"
  9. Defense Logistics Agency, "About the Defense Logistics Agency"
  10. DLA Office of Small Business Programs, "Getting Started: Doing Business With DLA"
  11. DLA, "Registration, Renewal, and CAGE Creation in System for Award Management (SAM)"
  12. GSA, "Don't Take the Bait: Beware of Misleading Marketing, Imposters, and Phishing" (May 2023)
  13. SAM.gov, "Entity Registration"
  14. DoD Office of Small Business Programs, "APEX Accelerators" (May 2025, PDF)
  15. DLA, "Mentoring Small Business Programs" (Mentor-Protégé Program)
  16. NIST, "Manufacturing Extension Partnership (MEP)"
  17. SBA News release 26-43, "Administrator Loeffler Applauds SBIR-STTR Reauthorization" (April 13, 2026)
  18. SBIR.gov, "America's Seed Fund"
  19. eCFR 13 CFR 121.201, "What size standards has SBA identified by NAICS codes?"
  20. eCFR 13 CFR 121.106, "How does SBA calculate number of employees?"
  21. eCFR 48 CFR 2.101 (FAR) Definitions
  22. eCFR 48 CFR 19.502-2 (FAR) Total small business set-asides
  23. eCFR 13 CFR 125.6, "What are the prime contractor's limitations on subcontracting?"
  24. DLA, "Joint Certification Program (JCP)"
  25. eCFR 22 CFR 122.1 (ITAR) Registration: requirements, exemptions, and purpose
  26. eCFR 22 CFR 122.3 (ITAR) Registration fees
  27. eCFR 22 CFR 122.4 (ITAR) Notification of changes in information furnished by registrants
  28. eCFR 22 CFR 120.50 (ITAR) Export
  29. eCFR 15 CFR 734.13 (EAR) Export
  30. eCFR 15 CFR 772.1 (EAR) Definitions ("600 series")
  31. eCFR 48 CFR 252.204-7012 (DFARS) Safeguarding Covered Defense Information and Cyber Incident Reporting
  32. eCFR 48 CFR 252.204-7019 (DFARS) Notice of NIST SP 800-171 DoD Assessment Requirements
  33. eCFR 48 CFR 252.204-7020 (DFARS) NIST SP 800-171 DoD Assessment Requirements
  34. NIST, "SP 800-171 Rev. 3 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations"
  35. Federal Register, “Cybersecurity Maturity Model Certification (CMMC) Program” (32 CFR Part 170, 89 FR 83092, Oct 15, 2024)
  36. Federal Register, “DFARS: Assessing Contractor Implementation of Cybersecurity Requirements” (48 CFR, 90 FR 43560, Sep 10, 2025)
  37. eCFR 32 CFR 170.3 Applicability (phased implementation)
  38. eCFR 32 CFR 170.14 CMMC Model
  39. eCFR 32 CFR 170.21 Plan of Action and Milestones requirements
  40. U.S. Department of War, “Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements” (Jul 13, 2026)
  41. DoW Chief Information Officer, “About CMMC” (accessed Oct 14, 2026)
  42. Defense Pricing, Contracting, and Acquisition Policy, "DFARS Revolutionary FAR Overhaul Class Deviations"
  43. eCFR 48 CFR 252.225-7009 (DFARS) Restriction on Acquisition of Certain Articles Containing Specialty Metals
  44. eCFR 48 CFR 225.872-1 (DFARS) General (qualifying countries)
  45. eCFR 48 CFR 225.7002-1 (DFARS) Restrictions (Berry Amendment)
  46. eCFR 48 CFR 246.870-2 (DFARS) Contractors' counterfeit electronic part detection and avoidance: Policy
  47. eCFR 48 CFR 46.202-4 (FAR) Higher-level contract quality requirements
  48. SAE International, “AS9102C Aerospace Series - First Article Inspection Requirements” (Jun 2023)
  49. DLA, “The Source Approval Request (SAR) Process” (May 2023, PDF)
  50. DLA, “ASSIST QuickSearch” (search for defense specifications and standards)
  51. eCFR 48 CFR 232.009-1 (DFARS) General (accelerated payments to small businesses)
  52. eCFR 48 CFR 32.904 (FAR) Determining payment due dates
  53. eCFR 32 CFR 117.9 (NISPOM) Entity eligibility determination for access to classified information
  54. eCFR 32 CFR 117.11 (NISPOM) Foreign Ownership, Control, or Influence (FOCI)
  55. Ministry of Defense, “Qualification to participate in tenders”
  56. Japan's ATLA, “Frequently asked questions on the information security standard” (Oct 2024, PDF, in Japanese)
  57. Japan's ATLA, “Promoting entry into the defense industry” (in Japanese)

More articles

Gears

Polishing Internal Gears: A Mass-Production Method Using Generating Grinding Kinematics (Nidec Machine Tool x RWTH Aachen), Explained with Figures

Industry

How a Metalworking Company Can Enter U.S. Medical Device Parts Machining: Market Trends and Hubs, Major OEMs and Contract Manufacturers, FDA Registration and QMSR, ISO 13485, Hurdles

Industry

How a Metalworking Company Can Enter U.S. Aircraft Parts Machining: Entry Routes, AS9100D and IA9100, FAA Part 21, First Article Inspection, Nadcap, Export Control, Hurdles