At a Glance

• AS9102 Rev C requires three forms — Form 1 (part accountability), Form 2 (raw material and process records), Form 3 (characteristic accountability) — for the first production article from a new or significantly changed process.
• Many AS9102 artifacts double as evidence for FAR 52.204-21 / CMMC Level 1 controls when handled inside a controlled documentation system.
• The most common rejection reasons are administrative — unballooned drawings, missing material certs, blank Form 1 fields — not measurement problems.
• A CMMC-aware FAI package controls who can sign, where files are stored, and how Controlled Unclassified Information (CUI) markings carry through the inspection record.

What AS9102 Actually Requires

AS9102 Rev C, published by SAE under the IAQG, defines the minimum content of a First Article Inspection Report (FAIR) for aerospace and defense parts. It is the standard most primes flow down by reference in their PO terms. A complete FAIR consists of three forms.

• Form 1 — Part Number Accountability: Identifies the part, drawing revision, supplier, PO, and the type of FAI (full, partial, delta). This is the cover sheet auditors read first.
• Form 2 — Product Accountability: Captures every raw material, special process (heat treat, plating, NDT), and any sub-tier supplier responsible for them. Each entry references a certification document.
• Form 3 — Characteristic Accountability: One row per design characteristic on the balloon-numbered drawing — nominal, tolerance, measured value, measurement method, and pass/fail. This is the bulk of the package.

Olympus Machining produces complete AS9102 First Article Inspection packages for prime contractors and Tier 1 suppliers, including CMM inspection records for tight-tolerance characteristics.

Where AS9102 Artifacts Map to FAR 52.204-21 Controls

CMMC Level 1 codifies the 15 basic safeguarding requirements in FAR 52.204-21 (expressed as 17 practices across six domains). Most of these are cybersecurity controls, but several are satisfied — at least in part — by records that already live inside a properly run FAI package. The table below maps common AS9102 artifacts to the practices they help evidence.

The takeaway: a shop that already builds clean FAI packages is doing roughly half the documentary work that CMMC Level 1 asks for. The remaining gap is cybersecurity policy, system configuration, and personnel verification.

The 10 Most Common FAI Rejection Reasons

Across primes we work with, FAI packages get bounced for the same recurring administrative defects far more often than for actual measurement failures.

1. Drawing revision mismatch between the PO, the ballooned print, and Form 1.
2. Missing or unballooned characteristics — tolerances, notes, GD&T frames, or thread callouts left off Form 3.
3. Material cert not traceable to the heat/lot used for the FAI part.
4. Special-process certs missing for heat treat, plating, anodize, or passivation called out on the print.
5. Form 2 sub-tier suppliers unnamed when an outside service was used.
6. Measurement method blank on Form 3 for one or more characteristics.
7. Inspection equipment uncalibrated at the date the measurement was taken (or no cert provided).
8. Unsigned forms — preparer or approver fields blank.
9. PFAI submitted when a full FAI was required due to a major design or process change. See Full FAI vs Partial FAI.
10. Out-of-tolerance condition reported on Form 3 with no nonconformance disposition referenced.

Nine of these ten are documentation problems, not metrology problems. They are also exactly the problems that a controlled documentation system — the same system CMMC asks you to maintain — eliminates.

What a CMMC-Aware FAI Package Looks Like

An FAI package built inside a CMMC Level 1 control environment has practical differences from one built ad hoc.

• File handling: The TDP, ballooned drawing, and FAIR PDF live in an access-controlled folder, not on a shared desktop or personal email.
• CUI markings carry through: If the source drawing is marked CUI, the balloon overlay, Form 3 export, and any CMM screenshot inherit and retain the marking.
• Authorized signers only: Form 1 preparer and approver fields are restricted to verified U.S. persons identified in the shop's personnel record.
• Transmission controls: The completed FAIR is sent through a customer-approved portal or encrypted channel — not unencrypted email.
• Retention windows: FAIRs and their supporting records are retained for the contractually required period (commonly 7 years or per PO terms) and then dispositioned per a documented media-sanitization procedure.

None of this changes the AS9102 forms themselves. It changes the environment they are produced and stored in — which is what the FAR 52.204-21 audit looks at.

Full FAI vs Partial FAI on a CMMC-Controlled Program

AS9102 distinguishes between a full FAI (every characteristic verified from scratch) and a partial FAI (PFAI / delta FAI, which addresses only the characteristics affected by a defined change). On CMMC-controlled work the decision drivers are the same as on any aerospace program:

• Full FAI is required for a new part number, a new supplier, a lapse in production greater than two years, or a major change to design, process, or sub-tier supplier.
• Partial FAI is appropriate when a discrete change (drawing revision affecting a subset of features, tooling change, machine relocation) is documented and the unaffected characteristics carry forward from the previous FAIR.

What CMMC adds is the requirement that the rationale for choosing PFAI over full FAI lives in the controlled record — not in a verbal handoff. A PFAI submitted without a referenced change document is one of the rejection patterns listed above. See Full FAI vs PFAI for the decision tree.

Frequently Asked Questions

Does CMMC Level 1 require AS9102?

No. CMMC Level 1 is a cybersecurity standard; AS9102 is a quality standard. They are independent flow-downs. Most aerospace and defense POs require both, which is why the artifacts overlap in practice.

Is a FAI package considered Controlled Unclassified Information (CUI)?

It depends on the source material. If the drawing or TDP is marked CUI, the derivative FAIR — including the ballooned print and Form 3 — inherits that marking and must be handled accordingly. An FAI built from a non-CUI commercial drawing is not CUI by default.

Who can sign Form 1 on a CMMC-controlled FAI?

Personnel identified as authorized within the shop's access-control record. For ITAR-controlled programs, they must additionally be verified U.S. persons.

How long do we have to retain a FAIR?

Retention is set by the PO or quality clause flowed down by the prime. Seven years is common; some programs require the life of the program plus a defined tail. The CMMC media-sanitization practice asks for a documented disposition at the end of that window.

Can a small subcontractor self-assess at CMMC Level 1?

Yes. Level 1 is self-assessed annually with an executive affirmation in SPRS. Levels 2 and 3 involve third-party or government assessment.

Does Olympus Machining ship FAI packages electronically?

Yes — via customer-approved portals or encrypted channels, not unencrypted email. The transmission method is recorded in the FAI traveler so it is auditable later.

What measurement equipment do you use for Form 3 characteristics?

Hand metrology (calibrated calipers, micrometers, indicators), surface plate work, and CMM inspection for GD&T features and tight-tolerance characteristics. Equipment calibration status is referenced from the FAI traveler.

Do you provide ballooned drawings if the customer doesn't supply one?

Yes. See our balloon drawing page for the convention we follow.

Explore Olympus Machining's AS9102 First Article Inspection capability, CMMC Level 1 compliance page, CMM inspection services, or our credentials and capability statement.

Contact Olympus Machining

Olympus Machining LLC
639 Frederick St, Suite 1
Hanover, PA 17331
Phone: (717) 634-5094
Website: www.olympusmachining.com
Google Business Profile: View on Google
Request a Quote: Submit a project

About Olympus Machining

Olympus Machining LLC is a precision CNC machining shop located in Hanover, Pennsylvania. As a dedicated CNC machining shop and reliable machining vendor, we provide CNC milling, CNC turning, and prototype-to-production services for OEMs and manufacturers nationwide.