IN Brief:
- CIS Secure has obtained AS9100:2016 Rev. D certification following an independent audit of its Ashburn, Virginia, facilities.
- The certified scope covers design, manufacture and assembly of repackaged commercial computing and networking components.
- The approval addresses quality management and manufacturing processes; it does not independently certify the cybersecurity performance of finished products.
CIS Secure has obtained AS9100:2016 Rev. D certification for its quality management system at its Ashburn, Virginia, facilities, extending its independently audited manufacturing assurance arrangements for defence and intelligence communications equipment. The certification was awarded by American Global Standards following an assessment covering the design, manufacture and assembly of repackaged commercial computing and networking components intended for secure and non-secure communications environments.
AS9100 is a quality management standard used within aviation, space and defence supply chains. It builds on ISO 9001 by incorporating additional requirements relating to areas including product safety, configuration management, operational risk, supplier control and delivery performance. The certification confirms that the management system within the assessed scope has met the applicable standard; it does not independently validate the cybersecurity performance of every product manufactured by CIS Secure or establish that individual systems have received a separate military qualification.
CIS Secure specialises in adapting commercial technology for sensitive government and military applications, with activities covering secure collaboration equipment, computing platforms and communications systems. The certified work involves repackaging commercial off-the-shelf components and integrating them into products intended to meet defined customer requirements. Such work can include the assembly of hardware from several suppliers, creating responsibilities for maintaining the configuration, documenting changes and verifying that completed equipment matches the approved design.
Configuration management is particularly important where commercial electronic components are incorporated into systems expected to remain in service for extended periods. Component manufacturers can introduce revisions, change manufacturing arrangements or discontinue individual parts, affecting the availability and characteristics of the original equipment. An alternative component may have different electrical, thermal or software requirements even when it performs a broadly similar function. Documented processes help establish which changes have been authorised and which additional checks are needed before a revised assembly is delivered.
Traceability allows completed equipment to be associated with its component and manufacturing records. When a defect or supplier issue is identified, those records can assist an investigation into which assemblies may be affected and whether corrective action is required. Maintaining reliable traceability depends on consistent documentation throughout purchasing, assembly, inspection and release. The certification supports an audited framework for those processes, although it does not mean that every upstream component supplier operates under the same quality management approval.
AS9100 also establishes expectations around assessing suppliers and maintaining control over externally provided products and processes. A specialist integrator may depend on processors, communications modules and other electronics manufactured by several businesses, making it necessary to determine whether incoming equipment meets the required specification. Changes to suppliers or components can affect an established product configuration, particularly where the completed system must satisfy customer-specific requirements. The certified management system provides a framework for handling those matters within CIS Secure’s assessed operations.
Defence prime contractors can require subcontractors to demonstrate particular quality management arrangements before they are approved for production work. AS9100 certification can provide evidence supporting that assessment and help a manufacturer respond to contractual requirements passed down through the supply chain. Further qualification may still be required for individual programmes, including product-specific testing, security controls and acceptance procedures. CIS Secure has not announced a new customer order or production contract directly resulting from the October certification.
The company holds separate credentials covering other aspects of its business, including ISO 9001, ISO 14001, CMMC Level 2 certification and recognition as an NSA-certified TEMPEST manufacturer. These designations address different requirements. CMMC concerns specified cybersecurity practices associated with handling controlled information in the defence industrial base, while TEMPEST relates to the control of compromising electromagnetic emanations. AS9100 addresses manufacturing and quality management, and the presence of all three does not make their scopes interchangeable.
Manufacturing assurance and product security can intersect because authorised components, controlled assembly procedures and accurate records help maintain consistency between units produced for security-sensitive applications. Those arrangements cannot substitute for secure system design, software verification or assessment of the protections applied to information handled by the equipment. A product assembled under a certified quality management system can still require separate vulnerability assessment, security testing and approval against a customer’s operational requirements.
Joe Adams, chief executive of CIS Secure, described the certification as recognition of the company’s investment in disciplined manufacturing processes. Dave Sawyer, vice-president of operations and engineering, also linked the approval to the ability to provide consistent quality across customer programmes. The announcement concerns an independently audited manufacturing management system rather than the introduction of a new hardware platform, technical capability or factory expansion.
The certification establishes a recognised quality credential for the company’s specified Ashburn operations and may support its participation in defence supply chains requiring AS9100 compliance. Maintaining that approval will depend on continued adherence to the applicable procedures and subsequent assessment of the management system. The next commercial developments will be determined by whether the certification helps CIS Secure secure additional manufacturing work, for which no new award has yet been disclosed.
