Morsa publishes this guide. Morsa is not an ERP. Its AI agent builds each shipment’s cert packet and chases missing certs, and quality approves what ships. Prices read 8 November 2026.
Quick answer
Do you need a special ERP? Not always. A shop ERP with lot and serial tracking, a place for first articles and certs, and access control on drawings covers most AS9100 subcontract work. JobBOSS2 may already do it (see below).
What CMMC means for your shop today: keep your NIST SP 800-171 self-assessment current, with a summary score no more than 3 years old posted in SPRS (the Supplier Performance Risk System) [8]. The 7012 clause still binds you. A third-party audit is not a condition of new requirements while the suspension lasts, and we found no newer published guidance as of 8 November 2026.
Prices: Cetec ERP $50 a user a month, ITAR hosting $500 a month [6]. Most others quote; third-party figures are in the vendor table.
Do you need to leave JobBOSS?
Probably not for AS9100. Here is what ECI, its maker, states for JobBOSS2:
What the work needs | JobBOSS2, per ECI |
|---|---|
Supplier lot traceability at receiving inspection | Stated [11] |
Serial numbers tracked from assembly start, linked to production data | Stated [12] |
Quality module: documents, calibration, CAPA (corrective action) workflows | Stated, with uniPoint for advanced quality [11][12] |
ITAR | ECI says JobBOSS2 “complies with ITAR standards” [11] |
Hosting | Three US options: multi-tenant cloud, private hosted cloud, or on-premise [11] |
Heat-lot trace through to shipment, FAI and cert attachment | Not stated; test it on your own part |
CMMC | Not stated |
Before you shop, run the heat-lot trace below in JobBOSS2 on a real serial. If it answers every row, staying costs nothing new in licenses. If it fails, the costs to switch are in our shop ERP pricing guide.
Where CUI must live, and what CMMC costs
DFARS 252.204-7012 covers every “covered contractor information system”: any system you own or run that “processes, stores, or transmits covered defense information” [3]. Controlled technical drawings count. So the ERP, email, file shares and any laptop holding those drawings are all in scope. Any cloud among them must meet the FedRAMP (federal cloud security) Moderate baseline or equivalent [3]. The cheapest compliance is usually to keep CUI (controlled unclassified information) in as few systems as possible.
The CMMC levels, from 32 CFR 170 [13]:
Level 1: the 15 basic safeguards in FAR 52.204-21, for federal contract information; self-assessed every year.
Level 2: all of NIST SP 800-171 Rev 2 (110 requirements [14]), for CUI; self-assessed every three years, or audited by a C3PAO (an accredited assessor) where a contract asks. A shop that receives controlled drawings is at Level 2.
Level 3: selected NIST SP 800-172 requirements on top of Level 2, where a contract asks for it.
What it costs. DoD estimated a Level 2 self-assessment and affirmation for a small business at $34,277, or $37,196 over three years, and a C3PAO certification at $101,752, or $104,670 over three years. Those figures exclude the cost of putting the 110 controls in place, which DoD treats as already required under 7012 [14]. That secure environment is often the bigger bill. One published example: Cetec charges $3,500 upfront and $600 a month for its CMMC-aligned cloud setup, plus about $800 a month of hosting paid to the cloud provider [6].
Where CMMC stands in November 2026
Phase 1, self-assessments, took effect on 10 November 2025. Phase 2 would have added C3PAO audits to contracts from 10 November 2026 [5].
On 13 July 2026 the Department of War CIO suspended the Phase 2 transition (Department of War is the Department of Defense’s secondary title since September 2025 [15]). The class deviation that implements it tells contracting officers to [4]:
permit Level 1 (Self) or Level 2 (Self) assessments in new requirements;
require baseline NIST SP 800-171 Rev 2 compliance under DFARS 252.204-7012;
amend active solicitations that call for C3PAO or Level 3 assessments, and remove those requirements from existing contracts at the next option or administrative modification.
What the rules ask of the ERP
Rule | What the ERP must do |
|---|---|
AS9100 (the aerospace quality standard) | Lot and serial traceability from the raw material heat lot to shipment, material certs linked to each lot, inspection steps in the routing, controlled BOM revisions [1] |
AS9102 first article inspection (FAI) | Store the FAI report against the part number and revision, and flag when a change triggers a new one (how to do an FAI) |
ITAR (22 CFR 120 to 130) | Restrict technical data to US persons; a release to a foreign person in the US is a deemed export [2] |
ITAR cloud storage | Technical data encrypted end to end with FIPS 140-2 validated modules, and not stored in a proscribed country, is not an export [7] |
DFARS 252.204-7012 | NIST SP 800-171 on the system; FedRAMP Moderate or equivalent for any cloud; report cyber incidents within 72 hours [3] |
If ITAR drawings sit in a commercial cloud, either they are encrypted end to end as the rule describes, or you must be sure they stay in the US and no foreign person, including the provider’s own staff, can reach them [2][7]. That is why ITAR hosting is often a US-government cloud region, as Cetec’s is on Azure Government, or your own servers [6].
A worked heat-lot trace
A customer reports a cracked bracket, serial 1187. The ERP should answer in minutes:
Question | Answer |
|---|---|
What material? | 7075-T7351 plate, heat H-55210, mill cert on file |
Which jobs used that heat? | 3 jobs: 40 brackets and 12 clips |
Which outside processes? | Anodize at one vendor, lot A-9931, cert attached |
Where did the parts go? | 2 shipments to the prime, serials 1160 to 1199 |
Was the FAI current? | Yes, revision C, first article dated March |
If the mill cert or the anodize cert lives in a filing cabinet, each row is a phone call. Our material cert packet checklist lists what each shipment should carry.
Vendors and prices
ERP | Fit | Price |
|---|---|---|
Cetec ERP | Small AS9100 contract manufacturers | $50 a user a month, 5-user minimum; ITAR hosting on Azure Government $500 a month [6] |
ProShop ERP | Machine shops; QMS, AS9100 and ITAR access controls built in; ProShop says it has a dedicated path to CMMC Level 2 [9] | Quote; Software Finder reports $500 to $715 a month for 5 to 10 users [10] |
JobBOSS2, Global Shop, E2 | Job shops; see the JobBOSS2 table above | Quote; see our shop ERP pricing guide |
Epicor Kinetic | Larger machining and fabrication suppliers | Quote; ERP Research reports from $100 a user a month and a 5 to 10 month go-live [1] |
Deltek Costpoint, IFS, Infor, SAP, Oracle | Primes, large tier 1 suppliers and contractors audited by DCAA (the Defense Contract Audit Agency) | Quote [1] |
Getting the cert packet complete before the truck leaves
The ERP holds the records; someone still chases the missing ones. Morsa is software with an AI agent that works in your ERP, email and Teams, including JobBOSS2, ProShop, Global Shop and Cetec. For ITAR and CUI work it installs on your own servers with the AI models running there too, so drawings never leave your network.
Forty brackets ship Friday. On Wednesday, Morsa finds the anodize cert missing from the packet and shows which other orders that lot holds up.
The buyer approved this kind of chase once; under that rule Morsa asks the anodizer for the cert and a ship time from the buyer’s mailbox.
When the cert arrives, Morsa checks the lot number against the ERP and attaches it. Quality reviews the packet and signs the certificate of conformance.
To see it on your own open orders, book a 30-minute walkthrough.
What to do this week
Check the date of your SPRS score and your system security plan; self-assessments still apply.
Pick one shipped serial and time a full trace back to the mill cert in your current ERP.
List every place controlled drawings live today: ERP, email, file share, laptops.
If you are choosing an ERP, ask each vendor in writing where ITAR data is hosted and who can reach it.
Sources
ERP Research, Aerospace and Defense ERP: AS9100 and ITAR (updated August 2026; third-party estimates): https://erpresearch.com/erp-for/aerospace-defense (read 8 November 2026)
eCFR, 22 CFR 120.50 Export: https://www.ecfr.gov/current/title-22/chapter-I/subchapter-M/part-120/subpart-C/section-120.50 (read 8 November 2026)
eCFR, 48 CFR 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting: https://www.ecfr.gov/current/title-48/chapter-2/subchapter-H/part-252/subpart-252.2/section-252.204-7012 (read 8 November 2026)
Office of the Assistant Secretary of War (Acquisition and Sustainment), Class Deviation 2026-O0025, Revision 3, citing the CIO memorandum of 13 July 2026 suspending CMMC Phase 2: https://www.acq.osd.mil/dpap/dars/classdev/DFARS_RFO/Part-240/2026-O0025_Rev3_TAB_A_Deviation_Memo.pdf (read 8 November 2026)
Crowell and Moring, Department of War Immediately Suspends CMMC Phase II Requirements (updated 14 July 2026): https://www.crowell.com/en/insights/client-alerts/department-of-war-immediately-suspends-cmmc-phase-ii-requirements-launches-60-day-reform-review (read 8 November 2026)
Cetec ERP, Pricing: https://cetecerp.com/pricing/ (read 8 November 2026)
eCFR, 22 CFR 120.54 Activities that are not exports: https://www.ecfr.gov/current/title-22/chapter-I/subchapter-M/part-120/subpart-C/section-120.54 (read 8 November 2026)
eCFR, 48 CFR 252.204-7019 Notice of NIST SP 800-171 DoD Assessment Requirements: https://www.ecfr.gov/current/title-48/chapter-2/subchapter-H/part-252/subpart-252.2/section-252.204-7019 (read 8 November 2026)
ProShop ERP, Aerospace ERP page and home page: https://proshoperp.com/aerospace-erp/ and https://proshoperp.com/ (read 8 November 2026)
Software Finder, ProShop ERP pricing (third party, not the vendor): https://softwarefinder.com/erp-software/proshop-erp/pricing (read 8 November 2026)
ECI Solutions, JobBOSS2: https://www.ecisolutions.com/jobboss2 (read 8 November 2026)
ECI Solutions, Benefits vs. costs: achieving the AS9100 certification (11 June 2024): https://www.ecisolutions.com/blog/manufacturing/jobboss2/considering-as9100/ (read 8 November 2026)
eCFR, 32 CFR 170.14, 170.15 and 170.16 (CMMC level requirements and self-assessments): https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170 (read 8 November 2026)
Federal Register, Cybersecurity Maturity Model Certification (CMMC) Program, final rule, 89 FR 83092 (15 October 2024), cost estimates for small entities: https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program (read 8 November 2026)
Federal Register, Executive Order 14347, Restoring the United States Department of War (signed 5 September 2025): https://www.federalregister.gov/documents/2025/09/10/2025-17508/restoring-the-united-states-department-of-war (read 8 November 2026)
