Aerospace suppliers arrive at CMMC with an advantage and a trap. The advantage is that a shop holding AS9100 already knows how to run a documented system, keep records, and be audited without panicking. The trap is assuming that experience transfers further than it does.
What AS9100 gets you, and what it does not
AS9100 gives you document control, corrective action, traceability, and — most valuable here — a workforce that does not treat an auditor as an intruder. Those habits genuinely shorten a readiness project.
What it does not give you is any coverage of the 110 requirements themselves. AS9100 asks whether your process produces conforming parts. CMMC asks who can read the drawing, from where, on what device, and how you would know if someone else had. There is no clause of the quality standard that answers the second question, and an assessor will not accept the certificate as evidence for any of the 110.
The overlap that does count is your record-keeping discipline. Shops that already retain evidence as a matter of course clear the evidence half of CMMC far faster than shops that have to invent the habit.
ITAR sits on top, not instead
Most aerospace part suppliers hold technical data that is export-controlled as well as CUI. These are separate obligations from separate agencies, and meeting one does not satisfy the other. ITAR concerns who may access the data by nationality and location; CMMC concerns how the system holding it is secured.
In practice this shows up in two places. First, cloud services: an ITAR-relevant workload usually needs a US-person-administered, US-located environment, which narrows your options before CMMC has said anything. Second, personnel: a non-US-person on the shop floor with access to controlled technical data is an export question your CMMC boundary diagram will not answer for you.
Prime pressure arrives earlier here
Engine and airframe programs have long, formal supply chains with active supplier-management functions. That means aerospace suppliers typically hear about CMMC from their prime months before a shop making ground-support brackets does — and it means the request usually arrives with a date attached rather than as a survey.
It also means the prime is tracking your answer. A supplier who responds with a real SPRS score and a dated plan is treated differently from one who does not respond, and that difference tends to persist into the next sourcing decision.
Where to start if you hold AS9100
Reuse what you have. Your document control system can hold the SSP and policy library. Your corrective-action process is a working POA&M with a different name. Your internal audit rhythm is the evidence-refresh cadence CMMC maintenance requires. What has to be built new is the boundary definition, the technical implementation of the 110, and the evidence trail behind each one.