ISO & GRC Training for defence and aerospace suppliers.

Why defence suppliers train with Sterling Academy

Defence and aerospace supply chains are built on trust that is checked, not assumed. A prime contractor will only pass work down to a supplier that can protect the information it receives and deliver parts that are right the first time. The US Department of Defense now writes that check into its contracts through the Cybersecurity Maturity Model Certification (CMMC) programme, which is being phased into contracts over several years. A supplier that cannot show the right CMMC status for the information it handles risks losing the work.

CMMC is built on known requirements. Level 1 covers the basic safeguarding of federal contract information. Level 2 assesses the 110 security requirements of NIST SP 800-171 for protecting controlled unclassified information (CUI), either by self-assessment or by a third-party assessment, depending on the contract. Awareness and training is one of the requirement families: people must know the security risks of their work and the policies that apply, and those with security duties must be trained for them. An assessor will ask for the evidence.

Quality is the other half. Primes and their customers expect a disciplined quality management system, usually built on ISO 9001 and often extended to aerospace requirements, with suppliers who find the real cause of a problem, analyse risk in design and process, and control their own suppliers. A nonconforming part in a defence programme is costly, and the corrective action request that follows will ask what training the people involved received.

Many defence suppliers are small and mid-sized manufacturers and engineering firms. They do not have large training departments, and they cannot take a production team off the floor for days. Online training, taken on any device in short sessions, fits the way these companies work.

Sterling Academy brings Sterling's classroom training online, with the same content, available 24/7. Each course ends with a final exam, and each person who completes it receives a verifiable certificate with a QR code that a prime, an assessor or a certification body can check. Sterling's classroom training certificates have been accepted by certification bodies at client audits, and the Academy carries the same content.

What each role in a defence supplier needs to know

Every employee. Everyone who handles contract information, on the shop floor, in engineering or in the office, needs the same foundation: what CUI and federal contract information are and how to mark, store and share them; how to recognise phishing and social engineering aimed at defence suppliers; how to use systems and removable media safely; how insider threats show themselves; and how to report an incident at once. They also need to understand the quality system they work in and the security of the supply chain. The pack gives them Information Security Essentials, ISO/IEC 27001:2022 Awareness, ISO 9001:2026 Awareness, ISO 28000 Security and Resilience Awareness and AI Literacy & Responsible Use of Generative AI, so staff know what contract information must never be put into public AI tools.

The CMMC team. The people preparing for a CMMC assessment, usually the IT or security lead, the compliance owner and the senior manager who signs the affirmation, need the requirements in depth: what NIST SP 800-171 asks, how to scope the environment that handles CUI, how to assess risk and document controls, and how to organise a security programme with a recognised framework. The pack gives them Training on CMMC 2.0 and NIST SP 800-171, NIST Cybersecurity Framework (CSF) 2.0 Training, ISMS Risk Assessment & Statement of Applicability and ISO/IEC 27001:2022 Implementation Training. Many suppliers find that building an ISO/IEC 27001 management system around the CMMC requirements makes the controls easier to run and keep running.

The quality team. Quality engineers and supplier quality staff need the methods primes expect: how to implement the quality management system, how to find root causes and close corrective actions properly, how to analyse failure modes, and how to evaluate and audit suppliers. The pack gives them ISO 9001:2026 Implementation Training, Root Cause Analysis & CAPA, FMEA: Failure Mode and Effects Analysis and Supplier Evaluation & Second-Party Audits.

Internal auditors. Both quality and security programmes need internal audits before the external assessment. The pack gives your auditors the ISO 9001 and ISO/IEC 27001 internal auditor courses, with ISO 19011, the international guidance on auditing management systems.

How the courses work

• Online and on demand. Learners study on a computer, tablet or phone, 24/7, at their own pace. Each course page shows the total learning time, including module quizzes, exercises and the final exam, so supervisors can plan it around production.
• Built from real classroom training. The content is the same as Sterling's classroom training, built by industry experts, domain specialist trainers and globally renowned auditors with 30+ years in ISO and GRC. Each course page has a sample video.
• Practical examples. The examples come from working organisations, including manufacturers and engineering firms, so people recognise the situations they meet.
• A real final exam. Each course ends with an assessed final exam. Awareness courses need 70% for the certificate; practitioner courses, which lead to a Certificate of Competence, need 60%. The retake rule is explained on each course page.
• A certificate anyone can verify. Each person who completes a course receives a certificate with a QR code. Learners can share a badge on LinkedIn.
• 12 months' access. Each course, and each pass, gives 12 months' access.

Courses or a pass: the cheapest way to buy

Each role card shows the courses that role needs, the price one by one, and a pass when it is close to or cheaper than the courses. We mark the cheaper option as best value and never show a saving that is not real.

The Awareness Pass costs US$99 and opens all 65 awareness courses for 12 months. For the other roles, the card shows at today's prices whether the listed courses or a pass is cheaper, and marks that option as best value.

In a small supplier, one person often carries security, quality and audit. For that person, the All-Access Pass opens all 16 courses on this page, and every other course in the catalogue, for US$499 for 12 months.

A pass also removes a decision people tend to put off. Once a learner holds a pass, adding a course for a new customer, a new regulation or a new job costs nothing more for the rest of the 12 months, and that is often when the second and third courses get taken.

When you train 11 people or more, every price drops by 20% per person, and by 30% from 51. You can mix plans in one order.

Evidence for primes and assessors

Sterling Academy gives you three kinds of evidence for a CMMC assessment, a prime's supplier audit or a certification audit.

The first is the certificate for each person: named, dated, tied to a specific course and final exam, and verifiable by QR code.

The second is the company console. Your administrator invites people, assigns each person only the courses their role needs, and sees who has started, who is in progress, who has stalled and who has finished.

The third is the report. You can download training records and keep them with your System Security Plan evidence, your quality records or your audit file.

A training plan for a CMMC assessment

Scope first. Decide which people handle CUI or federal contract information, or support the systems that do. Those people are your first group for awareness training.

Train everyone in scope. Assign the every-employee courses to all of them, including engineers, buyers, shipping staff and anyone with access to contract documents. Awareness and training records are among the first things an assessor asks for.

Train the CMMC team before the gap assessment. The team takes the CMMC and NIST SP 800-171 course and the related courses before it starts the gap assessment, so the System Security Plan and the plan of action are built on a correct reading of the requirements.

Train the senior manager. The person who affirms compliance should understand what they are affirming. The CMMC course gives them that understanding, and the certificate shows it.

Audit before the assessor does. Internal auditors complete their courses and review the controls before the assessment.

Keep it current. Use the console every year to see whose training is due, and train new hires before they get access to CUI.

Training gaps assessors and primes often find

Training that is generic, not CUI-specific. General security awareness is a start, but people also need to know how CUI is identified, marked and handled in your company.

Insider threat left out. NIST SP 800-171 includes awareness of insider threat indicators. Many generic courses skip it.

Shop-floor staff without records. Production staff who see drawings and specifications are often left out of security training. If they handle contract information, they need it.

Corrective actions that treat symptoms. Primes reject corrective action responses that do not show a real root cause. Training in root cause analysis and CAPA for quality engineers raises the standard of every response.

Supplier controls weak. Primes expect you to control your own suppliers, and CMMC requirements flow down to subcontractors that handle CUI. Training in supplier evaluation and second-party audits helps you do that well.

What a prime's supplier audit looks at

Before CMMC, and alongside it, primes audit their suppliers directly. The details differ from prime to prime, but the training questions are similar.

Competence for the job. The auditor picks a few people, often an inspector, a machinist, a buyer and a quality engineer, and asks what competence their job needs and how you know they have it. A role-to-course matrix and a certificate for each person answer that directly.

Problem solving. The auditor reviews recent nonconformities and corrective actions and asks how the root cause was found. Teams trained in root cause analysis and CAPA give answers that hold up.

Risk thinking. For design and process, the auditor looks for failure mode and effects analysis, or a similar risk method, used before problems happen, not after.

Control of suppliers. The auditor asks how you select, evaluate and monitor your own suppliers, and whether you audit the important ones. Supplier quality staff trained in evaluation and second-party audits make this part of the audit straightforward.

Information protection. Increasingly, the auditor also asks how drawings, specifications and contract data are protected, and whether staff are trained on it. The every-employee courses and the CMMC team courses cover that.

Internal audit. The auditor reviews your internal audit programme and asks who did the audits and how they were trained. Internal auditor certificates for ISO 9001 and ISO/IEC 27001 answer the second question.

Security and quality: one management system approach

Defence suppliers often treat cybersecurity and quality as separate projects with separate teams. They share more than they seem to. Both need defined responsibilities, documented procedures, trained people, internal audits, corrective action and management review. ISO 9001 and ISO/IEC 27001 use the same management system structure, and the NIST SP 800-171 requirements fit inside an ISO/IEC 27001 system as its controls.

Building one management system for both saves effort, keeps documents consistent and means one internal audit programme covers both. The courses on this page are designed with that in mind: a quality engineer who has taken the ISO 9001 implementation course and a security lead who has taken the ISO/IEC 27001 course are working from the same structure, and the internal auditor courses for both use the same method.

Services beyond training

Sterling's expert and experienced consultants help defence and aerospace suppliers achieve ISO 9001 and ISO/IEC 27001 certification and get ready for CMMC and NIST SP 800-171, simply and faster: gap assessments, documentation, internal audits and support through the assessment. Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years.

If a prime is asking for your CMMC status, ask for a team proposal below. A Sterling consultant replies within one working day.

Talk to a Sterling consultant