Guide · Websites
How to show AS9100, ITAR registration and CMMC status on your website
Buyers check certifications before they read anything else. Show each one so a supplier-quality engineer can verify it in a minute: the standard, the scope, the registrar and the expiry date. Never claim more than your certificate says. This is marketing guidance for your website, not compliance advice.
What buyers check
A supplier-quality engineer screens your certifications against her approved-supplier requirements. Four things decide whether yours pass, and she will look most of them up.
-
Step 1, OP 10
Scope
What the AS9100 or ISO 13485 certificate actually covers. Machining only? Assembly too? Which site? Scope is the first line she reads and a line websites often leave out.
-
Step 2, OP 20
Registrar and expiry
Who issued it, and when it renews. An expired date on your site reads as an expired certificate, even when the new one is in a drawer.
-
Step 3, OP 30
Registrations she can look up
ITAR registration, CAGE code, UEI and SAM status. She checks AS9100 in the IAQG OASIS database and your identifiers in SAM.gov, so write them exactly as registered.
-
Step 4, OP 40
Special processes
Nadcap accreditation or customer approvals for heat treat, NDT, chemical processing or welding. Primes often require these for the process they're buying, so name each process and who runs it.
How to say it, and what not to
Write each one the way the certificate or registration states it. If a word isn't on the document, it doesn't go on the site.
| Say | Don't say | |
|---|---|---|
| AS9100 | AS9100D certified for CNC machining and assembly, with the registrar and expiry date beside it. Use the revision on your certificate. | AS9100 compliant |
| ISO 9001 | ISO 9001 certified, with the year, scope and registrar from the certificate. | ISO certified (which standard?) |
| ITAR | Registered with the DDTC under ITAR. | ITAR certified (no such certificate exists) |
| CMMC | The level and assessment type exactly as recorded, for example Level 2 (C3PAO), with the date. | CMMC compliant or CMMC certified, with no level, type or date |
| ISO 13485 | ISO 13485 certified for the scope on the certificate, such as machining of surgical instrument components. | FDA approved (registration isn't approval) |
| Nadcap | Nadcap accredited for heat treating, with the expiry date. | Nadcap certified shop (when only one process is accredited) |
| ISO/IEC 17025 | Accredited to ISO/IEC 17025 by the named accreditation body, for the tests on your scope. | ISO 17025 certified lab, or tests listed that aren't on the scope |
| IATF 16949 | IATF 16949 certified, with the site and scope. | Automotive-grade quality |
Why the exact words matter
A supplier-quality engineer compares your site with the certificate, line by line. If the site says more than the certificate, she doesn't give you credit for the difference. She starts wondering what else is stretched.
Exact wording also travels. Search engines and AI assistants repeat what your pages say, so an overclaim on your site becomes an overclaim in someone else's answer, with your name on it.
Where to put them
Certifications belong where the buyer is checking, with one page that holds the full detail.
-
A quality page
Scope, numbers and dates for every cert and registration.
-
Each process page
The certs that cover that process, linked to the quality page.
-
Near the RFQ form
Badges that link to the quality page, where the scope and dates are.
-
Your capability statement
The one-page sheet primes and agencies screen first.
-
Product pages
Listings and marks such as UL or CE on the products they apply to, never sitewide.
-
The footer
Standard names, linked to the quality page. A row of logos with no scope proves nothing.
What a manufacturing quality page holds
One page a supplier-quality engineer can read top to bottom in a minute, written as text so search engines and AI assistants can read it too.
-
Step 1, OP 10
The quality system
Standard, revision, scope, registrar and expiry date. Add the certificate number if you share it.
-
Step 2, OP 20
Registrations
ITAR registration, CAGE code, UEI, and any customer approvals you have permission to name.
-
Step 3, OP 30
Special processes
Each accredited or approved process, whether you run it or an approved outside source does, and how requirements flow down.
-
Step 4, OP 40
Inspection and traceability
Inspection equipment, first-article method, lot or heat traceability, and how long records are kept.
-
Step 5, OP 50
Current certificates
Dated PDFs, replaced the day they renew. The text on the page says the same thing as the file.
-
Step 6, OP 60
A named contact
Who in quality answers supplier surveys, and how to reach them directly.
What buyers check, industry by industry
The documents change with the market. The rule doesn't: state exactly what you hold, for exactly what scope.
-
Aerospace and defense
AS9100 scope, Nadcap by process, ITAR registration, CAGE code and CMMC status as assessed. Primes screen these before they read your capabilities.
-
Medical device
ISO 13485 scope, FDA establishment registration if you hold one, cleanroom class and validated processes. Never 'FDA approved' for a supplier.
-
Coatings, plating and heat treat
Nadcap by process, plus the customer and spec approvals you're allowed to name, each with its spec number.
-
Testing labs
ISO/IEC 17025 accreditation, the accreditation body and the scope of tests, linked to the scope document.
-
Automation and integrators
UL 508A panel shop status if you have it, and which panels carry the mark.
-
Distributors
Authorized-distributor status for each line, and AS6081 if you sell electronic parts into defense.
-
Automotive suppliers
IATF 16949 certification by site, and the customer-specific requirements you meet.
Keep it current
A certification page is only as good as its dates. When a cert renews, the new expiry date goes on the site that week and the old PDF comes down. When a scope changes, every process page that mentions it changes too.
That is maintenance work, and it sits with our website care alongside updates and security checks. An expired date is easy for a buyer to spot and easy for your own team to miss.
Six ways certifications go wrong on manufacturing websites
-
Badges with no scope
A logo says you hold the standard. It doesn't say for what.
-
Expired dates
Last cycle's certificate, still in the downloads.
-
'Compliant' in place of 'certified' or 'registered'
It claims a result nobody verified, and invites the question: certified by whom?
-
One scope stretched over every page
AS9100 for machining, shown on the assembly page too.
-
Naming customers without permission
Approved by a named prime is a claim that prime controls. Ask before you print it.
-
Marks used against the rules
Registrars and accreditation bodies set rules for how their marks appear. Follow them.
Questions about certifications on your website
Should we put our AS9100 certificate on the website?
Yes, as a current PDF on your quality page, with the scope, registrar and expiry date written as text beside it, so buyers and search engines can read them without opening the file.
Can we say 'ITAR compliant'?
Say what you can show: registered with the DDTC under ITAR. Registration is a fact a buyer can ask you to confirm. 'Compliant' is a claim they can't check.
Should we publish our CAGE code and UEI?
Many defense suppliers do, because primes and agencies screen on them and they usually show in SAM.gov already. Check with your compliance lead first.
What if our CMMC assessment isn't done yet?
Say where you are, plainly and dated, or say nothing. Never imply a level or an assessment type you don't hold.
Should we show certifications we're working toward?
Only as a plain, dated status, for example 'AS9100 certification audit scheduled for spring'. Keep it off the badges and off the capability list until the certificate is issued.
Where do customer approvals go?
On the quality page and on the process pages they cover. Name the customer only with its permission. Without permission, describe the approval and the spec it covers.
Do distributors, labs and service firms need a quality page too?
Yes. The documents differ: line authorizations for a distributor, an accreditation scope for a lab, safety records and insurance for a field service firm. The rule is the same: exactly what you hold, for exactly what scope.
Do certifications help with search and AI answers?
When they're written as text, they can. A buyer who searches 'AS9100 sheet metal' or asks an AI assistant for ITAR-registered machine shops can only find you if your pages say it in words.
Check your quality page
The free Buyer's-Eye Audit reads your website line by line against the RFQ you most want to win, quality page included. Or subscribe for the next guide.