Most shops don’t lose government work because they can’t do it. They lose it because nobody told them what it actually takes to bid on it.

There is federal work available to machine shops right now. Not someday, not after a two-year certification process, not after a six-figure investment in compliance infrastructure. Right now, with what a shop already has or can get to relatively quickly.

Not all government work requires AS9100. Not all of it requires ITAR registration. Not all of it requires CMMC. Ground vehicle components, maritime surface systems, support equipment, tooling, and general land-based defense systems often require ISO 9001 only, a significantly lower barrier to entry than the full certification stack that aerospace and flight-critical work demands. Civilian agencies, GSA, DHS, DOE, and others, buy manufactured parts where ISO 9001 is the standard and nothing more is required to be considered.

Understanding which category your capability falls into is the first question. It’s also the one most shops never ask, because nobody walked them through it.

That’s where most of the real damage happens. Not in the certification process itself, but in the sequence. A shop owner decides it’s time to pursue government work. The capability is there, the interest is there, and the timing feels right. So they hire someone to help them get in.

The consultant they hire knows how to search SAM.gov. They pull up solicitations by NAICS code, find opportunities that look like a match, and present them as proof the federal market wants what this shop makes. The shop owner gets excited. Then they look at the actual requirements.

AS9100. ITAR registration. CMMC. Past performance on federal contracts.

None of which the shop has. None of which the consultant mentioned before taking the engagement. The solicitations are real. The shop just can’t bid on any of them.

That’s not a federal market problem. That’s a sequence problem. And it’s one of the most expensive mistakes a small manufacturer can make when entering the government contracting space, hiring guidance from someone who knows the procurement system but has never stood on a shop floor, never read a technical data package, and doesn’t understand that the certifications required to bid on certain defense work aren’t a formality. They’re the entry fee, and they cost real money and real time to obtain.

Here’s what those certifications actually are, for the shops that need them.

AS9100 is the quality management standard for aerospace and defense manufacturing. It builds on ISO 9001 but adds over a hundred aerospace-specific requirements, risk management, configuration management, counterfeit part prevention, that take a shop’s quality system from documented to defensible under audit. Getting certified takes months and costs thousands. Maintaining it requires ongoing surveillance audits. For aerospace programs, flight-critical components, and most DLA work touching aviation systems, not having it means not being considered. Full stop.

ITAR, the International Traffic in Arms Regulations, controls the manufacture, handling, and export of defense articles and technical data. Any shop receiving drawings or specifications for defense-program parts is almost certainly receiving ITAR-controlled data, whether they know it or not. Registration with the State Department’s Directorate of Defense Trade Controls is required before that data can legally change hands. A prime contractor sending technical data to an unregistered supplier is creating legal exposure for themselves. They won’t do it. Which means an unregistered shop doesn’t get the drawing, doesn’t get the quote package, and doesn’t get the work.

CMMC, Cybersecurity Maturity Model Certification, is the newest layer. Level 1 is now required to bid on most defense contracts. Level 2 is required for anything involving Controlled Unclassified Information. The assessment process alone, especially for Level 2, takes months to prepare for. A shop that starts the process after finding a solicitation they want to bid on is already too late.

This is the third pattern worth naming, and it’s the quietest one. A shop with steady commercial work that doesn’t see the urgency. Commercial customers are consistent, relationships are established, and the federal market feels like a distraction. That’s a reasonable position until the commercial customer consolidates their supply chain, brings work in-house, or goes somewhere else. Commercial work is real work, and the relationships built there are genuinely valuable. A shop with one revenue stream and no federal presence has no fallback. Diversification into the federal market isn’t an alternative to commercial work. It’s the insurance policy on it.

The certification landscape is expensive and the sequence is specific. But the sequence starts with knowing which work you’re actually positioned for right now, not which work requires everything you don’t have yet. Most shops never get that question answered clearly before they start spending money.

That’s what PSC does. Not a generic government contracting engagement. A clear assessment of where your shop stands, which opportunities are actually accessible today, what the path to the next tier looks like, and what it realistically costs to get there, from someone who has been on the floor, read the drawings, and understands what these certifications mean in practice versus what they look like on a wall.

Parallax Strategic Consulting. A different angle on manufacturing intelligence.

If you want to know which category your shop is actually in before you spend another dollar on the federal market, get in touch