Selling to U.S. Prime Contractors: How Onboarding Works

A non-U.S. manufacturer becomes a supplier to Lockheed Martin, Northrop Grumman or another U.S. prime by registering through the prime's supplier channel, being invited to bid, and proving it can meet the U.S. government clauses the prime flows down: cybersecurity, specialty metals, counterfeit parts, telecom bans and export control. Quality certification and an NCAGE code come first.

How do U.S. prime contractors find new suppliers?

U.S. primes find suppliers through their own databases and invitations, not open applications. Lockheed Martin's Supplier Marketing Portal is, in the company's words, its "primary database for searching for suppliers when there is a procurement opportunity", and its FAQ says "most opportunities will be by invitation to participate in a competitive bid." Northrop Grumman starts with a Supplier Information Form.

The two primes describe their entry points in different terms:

Two practical points follow from Lockheed Martin's own guidance. It prefers specialists over generalists and buys from original equipment manufacturers and franchised or authorized distributors, because it wants assurance that components match specifications. It also keeps a complete marketing record for about five years, but deletes incomplete records or those with outdated contacts after about a year (FAQ).

Neither prime's public pages promise a response time or describe how they score foreign suppliers. Treat the portal as a way to be findable when a program searches, and pair it with a specific program or technical need you can name.

Which U.S. government clauses will a prime flow down to you?

A prime flows down the clauses in its own U.S. government contract that the regulations say must reach subcontractors. Which ones apply depends on what you supply and what information you handle; for hardware on a Department of Defense (DoD) program, the usual set covers cybersecurity, specialty metals, counterfeit electronic parts, Section 889 telecom equipment and export control.

The specialty metals clause has exceptions a supplier should know: electronic components, most COTS items, and end items whose noncompliant specialty metal is no more than 2 percent of the total specialty-metal weight. The 2 percent exception does not apply to high-performance magnets. Our guide to non-red supply chains covers the newer magnet, battery and semiconductor restrictions that sit alongside it.

Clause numbers are changing. Under the Revolutionary FAR Overhaul, DoD now prescribes 252.204-7012 and 252.204-7021 in a rewritten DFARS Part 240 (Class Deviation 2026-O0025, Revision 3), and the Section 889 prohibition now sits in FAR 52.240-91, Security Prohibitions and Exclusions. Read the clause list in each purchase order rather than relying on a template.

What cybersecurity will a prime expect, and when does CMMC bite?

A prime will expect a supplier that handles covered defense information to meet NIST Special Publication 800-171 and, increasingly, to hold a Cybersecurity Maturity Model Certification (CMMC) status. Phase 2 of DoD's CMMC rollout begins November 10, 2026, when DoD intends to require third-party Level 2 certification as a condition of award for applicable contracts.

The dates come from two rules. The DFARS rule that puts CMMC into contracts took effect on November 10, 2025, which started Phase 1. Under 32 CFR 170.3, each later phase begins one calendar year after the previous one, ending with full implementation in Phase 4.

For suppliers, the flow-down is what matters:

• Levels follow the information. A subcontractor that handles only Federal Contract Information (FCI) needs CMMC Level 1 (Self). One that handles Controlled Unclassified Information (CUI) needs at least Level 2 (Self), and Level 2 certified by a third-party assessment organization (C3PAO) if the prime contract requires that level or Level 3 (32 CFR 170.23).
• Checked before award. DFARS 252.204-7021 requires the prime to ensure the subcontractor has a current CMMC status at the right level before it awards the subcontract. Each subcontractor must complete an affirmation of continuous compliance before award and keep it current every year; the results live in DoD's Supplier Performance Risk System (SPRS).
• The underlying standard. In DoD's current Part 240 deviation text, 252.204-7012 points to NIST SP 800-171 Revision 2. Lockheed Martin describes that standard as 110 security requirements across fourteen control categories.

Primes are already collecting this information. Lockheed Martin's supplier cybersecurity page carries an April 6, 2026 notice that "all active Lockheed Martin suppliers are required to submit their CMMC status" through a Cybersecurity Compliance Attestation in Exostar, and that its Cybersecurity Compliance and Risk Assessment (CCRA) questionnaire, with up to 60 questions, must also be completed in Exostar.

What quality certification do primes look for?

Primes look for a quality management system built to the 9100 series of the International Aerospace Quality Group (IAQG). The base standard, 9100, is titled "Quality Management Systems: Requirements for Aviation, Space and Defense Organizations"; the version issued for the Americas is AS9100 Revision D, dated September 20, 2016, according to the IAQG's October 2025 standards register.

The same register lists the companion standards a supplier is most likely to meet in practice:

• 9120 for distributors (AS9120 Revision B in the Americas).
• 9102 for first article inspection (AS9102 Revision C, June 28, 2023).
• 9145 for advanced product quality planning and production part approval.

Lockheed Martin asks suppliers to list their quality certifications in the Supplier Marketing Portal, and its Get Connected page links to Nadcap and the Supplier Excellence Alliance. Its public pages do not state a blanket certification requirement, so read the quality clauses in each request for quote. Check the IAQG register for the current revision before you certify, because the standards are revised on IAQG's schedule, not the prime's.

How does export control shape onboarding?

Export control shapes onboarding in both directions. DFARS 252.225-7048 requires every subcontractor to comply with the International Traffic in Arms Regulations (ITAR) and the Export Administration Regulations (EAR). And a U.S. prime that needs to furnish defense services to a foreign supplier needs U.S. government approval first.

Under the ITAR, a U.S. person must get approval from the State Department's Directorate of Defense Trade Controls (DDTC) before furnishing defense services, usually through a manufacturing license agreement or a technical assistance agreement (22 CFR 124.1). Such agreements "may not enter into force without the prior written approval" of DDTC, and amendments need approval too. If a job depends on that kind of agreement, work cannot start until it is approved.

For a supplier, three things speed this up: know the export classification of what you sell, be ready to name the people and sites that would receive controlled data, and expect the prime's trade compliance team to drive the authorization. Our plain-English guide to ITAR vs. EAR for space hardware suppliers explains the classification side.

Do you need SAM.gov, a CAGE code or an NCAGE code?

A non-U.S. supplier needs a NATO Commercial and Government Entity (NCAGE) code before it can register in SAM.gov, the U.S. government's System for Award Management. SAM.gov registration lets an entity bid on U.S. government contracts directly; selling only to a prime is a different relationship, but the NCAGE code is worth having either way.

Under FAR 2.101, a CAGE code identifies an entity "by unique location". The Defense Logistics Agency assigns CAGE codes to U.S. locations; a NATO member or the NATO Support and Procurement Agency (NSPA) assigns NCAGE codes to locations outside the United States. Section 889 reporting under FAR 52.204-25 asks primes for a supplier's CAGE code, if known.

GSA's Quick Start Guide for International Registrations sets out the mechanics:

1. Obtain an NCAGE code for each entity you will register; it takes up to three business days.
2. Use the identical legal business name and physical address for the NCAGE code and the SAM.gov registration.
3. Register through SAM.gov with a Login.gov account; there is no charge.
4. Allow at least ten business days after submission for the registration to become active.
5. Renew every 365 days.

A U.S. taxpayer identification number is needed only if the entity pays U.S. taxes.

Do small-business plans and mentor-protégé programs help a non-U.S. supplier?

Mostly not directly. U.S. primes set small-business subcontracting goals, and DoD's Mentor-Protégé Program rewards them for developing small suppliers, but both are built around U.S. small business concerns. A manufacturer located outside the United States should not plan its U.S. entry around either.

Subcontracting plans. A large prime negotiating a U.S. government contract expected to exceed $900,000 ($2 million for construction) with subcontracting possibilities must submit a small-business subcontracting plan (FAR 19.702; FAR 19.109 under the overhaul). Small business concerns are exempt, and so are contracts performed entirely outside the United States. To count as small, SBA requires a business with "a place of business located in the United States" that operates primarily in the U.S. or contributes significantly to the U.S. economy (13 CFR 121.105).

Mentor-Protégé. Under 10 U.S.C. 4902, a protégé must be a disadvantaged small business concern, such as a service-disabled veteran-owned, women-owned or HUBZone small business, or a small business that is a nontraditional defense contractor. A protégé may hold only one agreement at a time, within five years of its first. The program's September 30, 2024 sunset was removed in December 2022, so it is now permanent.

A U.S. subsidiary does not escape these limits automatically: SBA counts the size of "all of its domestic and foreign affiliates" when deciding whether it is small (13 CFR 121.103). Lockheed Martin's FAQ adds that most size and status categories are self-certified, except HUBZone and service-disabled veteran-owned status, and that third-party certification is not recognized for government contracting.

What are the onboarding steps, in order?

The onboarding steps run from targeting to evidence. Do the paperwork that does not depend on a prime first, so you are ready when an invitation arrives.

1. Pick programs, not primes. Use each prime's "What We Buy" pages to match your product to a business area and a named need.
2. Get an NCAGE code for each location that will ship, with the same legal name and address you will use everywhere else; register in SAM.gov if you also plan to bid directly.
3. Register in the prime's channel: Lockheed Martin's Supplier Marketing Portal with complete NAICS codes and certifications; Northrop Grumman's Supplier Information Form. Keep both current.
4. Certify to the 9100 series and be able to run AS9102 first article inspection.
5. Decide your information boundary. If you will receive covered defense information or CUI, implement NIST SP 800-171 Revision 2 on those systems and plan for the CMMC level the prime will flow down.
6. Build a flow-down evidence file: specialty-metal melt origin, electronic parts sources and traceability, a Section 889 check of your products, and country-of-origin records.
7. Prepare for export control: classify your products, name the people and sites that would receive controlled data, and expect the prime to seek any DDTC agreement.
8. When invited, complete the prime's registration (SAP Ariba at Northrop Grumman; Exostar for Lockheed Martin systems), its cybersecurity questionnaires and any C-TPAT request for international suppliers.

What this means for allied companies

The portal is the easy part. Primes buy from suppliers who already look like low-risk U.S. defense suppliers: a 9100-series quality system, a defined cybersecurity boundary, and documented answers to every clause in the flow-down table above. The timing matters too: CMMC Phase 2 starts November 10, 2026, so a supplier that will handle CUI should expect the certification question before the first purchase order, not after.

For a non-U.S. manufacturer, the realistic advantages are capability and evidence, not small-business status. Lead with a specific program need, and bring the paperwork that lets a prime's supply-chain team say yes quickly. If you are still working out how DoD itself buys, start with our overview of how the DoD buys commercial space technology.