Aerospace manufacturing has never accepted "trust me" as a quality standard.
If you build wheels for airplanes, you don't test every wheel that comes off the line. You can't, not at the volume this industry manufactures at. Instead, you design a testing regime: this part, at this frequency, at these tolerances, with documented evidence that the line held.
That discipline goes back to World War II, when a single part failure could decide the outcome of a battle. It became AS9100. It became NADCAP. Nobody in this industry questions it anymore. It’s a little strange to watch the same companies treat cybersecurity compliance like a one-time box to check off a list.
The Cybersecurity Maturity Model Certification (CMMC) CEO attestation requirement (the annual affirmation of continuous compliance under DFARS 252.204-7021) asks aerospace to apply the exact same discipline it already applies to metal, fasteners and flight software. This is not a new discipline. It’s essentially the same one, pointed at a different part of the business.
However, the key word in the statute is "continuous,” not "as of the date we were assessed." So while the assessment of continuous compliance isn’t new, the Affirming Official (AO) who signs that attestation is doing something much closer to a quality sign-off with legal teeth than a compliance formality.
The Exposure is Personal, the Precedent is Set
The DOJ recovered $52 million under its Civil Cyber-Fraud Initiative in FY2025. Those cases turn on exactly this kind of attestation gap: a company said its controls were operating, they weren't, and someone's name was on that statement.
That's not a corporate fine sitting on a balance sheet. False Claims Act liability follows the named individual who signed. Aerospace executives aren't strangers to personal accountability. Quality and safety regimes in this industry have carried that weight for decades. Ask anyone who watched what happened to the people connected to Boeing's manufacturing failures.
What hasn't caught up is applying that same instinct to a cybersecurity attestation. Too many still treat CMMC as a compliance project owned by IT. It isn't. It's a statement an executive makes, in their own name, that can be tested against reality and holds them to an incredibly high standard of accountability.
You're Not Just Affirming for Yourself
Here's what makes this harder than a typical attestation: the Affirming Official isn't signing for their own four walls. They're signing for the whole supply chain.
In aerospace, that could include a machining shop that rotates staff off a covered system without closing out access. A materials supplier that lets an access review lapse for a quarter. An avionics integrator with a gap in their scan logs.
Any one of those is a period of unverifiable compliance the AO has already attested to, on behalf of a company they don't operate day-to-day. DFARS 252.204-7012(m) requires the prime to flow the clause down to subcontractors without alteration, and the prime remains responsible for enforcement.
A security questionnaire and an SPRS score were never built to carry that weight. If a vendor has a breach and the answer is "Well, I asked them," that isn't confirmation. That's hope with a signature on it. I'd frame it this way for any Affirming Official: you're not being asked to trust your supply chain. You're being asked to confirm that trust in your supply chain based on evidence. Only one of those options is defensible in front of a regulator.
Evidence has to Match the Language
The instruments most primes use today—the questionnaire, the point-in-time audit, the annual assessment—were designed for a snapshot. CMMC's affirmation wasn't written for a snapshot. It was written for "continuous" compliance.
Rigor comes from testing, and testing done more often, with more accuracy, produces more rigor. That's true whether you're checking the thickness of a wheel casting or checking that an offboarded employee's credentials were actually revoked.
Neither gets safer because someone wrote a policy about it. It gets safer because someone can produce evidence, on demand, that the policy was followed continuously across every tier of the supply chain touching the work. If I were an Affirming Official deciding what would assure me to sign with a clear conscience, I'd want two things:
- Third-party assessment evidence of effective practice over a period of time, not a single date.
- Evidence I can test myself: configuration exports, access logs, proof a designed process exists at all.
That last one matters more than people expect. If there's no written process for how something gets done, that's not a technicality. That's the moment you find out the newest hire has no idea what they're supposed to do, because nobody ever told them.
The wake-up call won't be a headline. It'll be a lost contract.
DOJ enforcement is already here, but the moment that changes behavior in this industry won't be a press release, it'll be quieter. Imagine a contracting officer at DoD looking at two SPRS scores side by side, and the smaller, less-established company has the cleaner one. No exceptions on the report. Higher score than the prime that's been doing this for eighty years.
That contracting officer has a career riding on the next decision. Reputation used to be enough cover: nobody got blamed for hiring the name everyone recognized.
Now a numerical score based on evidence changes that math. It's comparable. It's defensible. And it puts the buyer, not just the supplier, in a position where "I picked the bigger name" is no longer an adequate answer if something goes wrong.
Manufacturers already know how to build a business that withstands that kind of scrutiny. It's the same instinct behind AS9100 and NADCAP: don't wait to be tested once. Build the evidence architecture that proves, continuously, across every tier of the supply chain, that what you signed your name to is actually true.
That won't make the work disappear, but it will make the business stronger, more valuable, and a far better partner to be down the supply chain from. Which, in this industry, has always been a critical key to success.
