Overview#
Supplier Certificate Lifecycle Management gives defence programme managers a single classification-controlled record of every quality and security certificate a supplier holds, with automated lapse alerts and a tamper-evident audit trail.
Defence programmes depend on suppliers holding the right accreditations at the right time. A prime contractor or ministry has to know, across every tier of a programme, which suppliers carry a valid aerospace quality certificate, which hold the correct special-process accreditation, and which are about to lapse. This capability holds all of that as structured certificate records gated behind the EU_RESTRICTED boundary. Each record names its standard, its scope, its issuer, and its issue and expiry dates, and resolves to a single live status so a programme manager can see at a glance whether assurance is intact.
Renewals slip, and a slipped renewal in an EDF or PESCO-funded programme can open a compliance gap. This capability closes that gap automatically. A background watcher alerts the programme owner ninety days and then thirty days before any certificate lapses, while a time-limited four-eyes waiver lets governance accept a short, controlled exposure when a renewal is genuinely delayed. Because certificates live in the same platform as supplier risk scores, corrective actions, and tier-graph relationships, the whole assurance picture stays in one place and stays attributable.
Last Reviewed: 2026-06-01 Last Updated: 2026-06-02
Key Features#
- Named Standards Coverage: Certificates are recorded against AS9100D, NADCAP, AQAP 2110, and ISO/IEC 27001, with an open-ended OTHER category for any further accreditation a programme tracks, so the record speaks the same language as the auditors and primes who rely on it.
- Atomic Supersession on Issue: Issuing a certificate for a supplier, standard, and scope combination supersedes the prior active certificate for that same combination in a single transaction, so there is never an ambiguous moment with two active certificates or a gap between them.
- Ninety and Thirty Day Lapse Alerts: A background watcher scans active certificates on a recurring schedule and fires a structured warning ninety days before expiry and again thirty days before expiry, giving programme owners two clear windows to act before assurance lapses.
- Idempotent Alerting: Each threshold writes a dedicated gate marker once it has fired, so a recurring scan never double-alerts on the same certificate at the same threshold, keeping the alert stream clean and trustworthy.
- Waiver-Aware Suppression: When an approved, in-date waiver covers a certificate or its parent supplier, expiry warnings are suppressed and the suppression is logged, so a sanctioned delay does not generate noise while remaining fully reconstructable.
- Revocation with Mandatory Reason: A certificate can be revoked only with a non-empty reason, and the revocation captures a fingerprint of the record before and after the change, so every revocation is attributable and verifiable.
- Filtered Listing and Expiry Windows: Programme teams can list every certificate a supplier holds filtered by status, and pull every certificate due to expire within a chosen number of days, so triage and renewal planning need no manual reconciliation.
- Classification-Gated, Tenant-Isolated Access: Every read and write enforces a minimum EU_RESTRICTED clearance and is scoped to a single tenant, so certificate records never cross the programme security boundary or leak between organisations.
Use Cases#
Defence Prime Contractors#
A prime managing a multi-tier aerospace programme confirms that every subcontractor on a critical path holds a current AS9100D or NADCAP accreditation, lists each supplier's certificates by status, and receives the ninety and thirty day warnings before any of them lapse. The spreadsheet tracking that normally precedes a milestone review is replaced by a single live view.
Defence Ministries and Procurement Authorities#
A ministry runs several programmes from one platform, each isolated by tenant, and maintains an authoritative certificate position for every approved supplier. Procurement officers pull the certificates expiring within a chosen window across a programme to plan renewals before they affect eligibility.
Programme Quality and Assurance Teams#
Quality teams use the per-supplier certificate roster and the expiry-window list to triage suppliers whose accreditation is lapsing, well ahead of any contractual deadline, and process a controlled waiver when a renewal is delayed rather than letting a gap go unmanaged.
Programme Security and Governance Officers#
A governance officer relies on the EU_RESTRICTED gate to keep certificate detail visible only to cleared personnel, on the four-eyes waiver path to ensure a delayed renewal is accepted by two parties rather than one, and on the before and after fingerprints to demonstrate to auditors that no certificate record has been altered outside the controlled lifecycle.
Integration#
Customers connect through the platform's governed REST and GraphQL endpoints, secured with OAuth2 and JWT-based authentication and scoped per tenant. Certificates and waivers are exposed as normalised entities, so a prime's own programme management system or a ministry's procurement suite reads and writes against a consistent model rather than a bespoke schema. Read operations cover the per-supplier certificate roster filtered by status and the expiry-window listing; write operations cover issuing a certificate, revoking one with a reason, and the four-eyes waiver request and approval flow.
Role gates apply across the board. Writing a certificate requires a manager role and above, while revocation and waiver governance require an administrator role, so privileged actions are reserved for the right people. The lapse warnings are produced by a scheduled scan that runs on a recurring platform timer, and the structured warning events feed downstream consumers such as the audit pipeline and operator notifications, so client systems stay aligned without polling. Because certificates sit alongside supplier risk scores, corrective actions, and tier-graph relationships in the same platform, a customer plugs in one assurance surface rather than stitching several together, and gets a complete supplier picture from a single round of calls.
Open Standards#
- AS9100D: the SAE International aerospace quality management system standard for design, development, and production, recorded as a held certification standard per supplier.
- NADCAP: the Performance Review Institute special-process accreditation programme for aerospace and defence, tracked as a named certificate standard.
- AQAP 2110: the NATO Allied Quality Assurance Publication under STANAG 4107, covering quality assurance requirements for design, development, and production, stored as a certificate standard and underpinning the contractual audit obligations the audit trail evidences.
- ISO/IEC 27001: the information security management system standard, recorded as a recognised certificate standard on a supplier.
- STANAG 4107: the NATO Standardisation Agreement that establishes the AQAP series, named as the parent agreement for the AQAP 2110 certificate standard.
- EU_RESTRICTED: the information classification level defined under EU Council Decision 2013/488/EU within the EUCI framework, enforced as the minimum clearance for every certificate read and write, matching the EDF and PESCO baseline used across the defence supply chain stack.
- SHA-256: the FIPS 180-4 secure hash used to fingerprint each certificate row before and after a change for tamper-evident audit.
- OAuth2 and JWT: the RFC 6749 authorisation framework and RFC 7519 bearer token format securing every endpoint.
- ISO 8601: the date-time representation used for issue, expiry, and warning timestamps.
Security and Compliance#
Access control is fail-closed. A caller must belong to a tenant and hold at least EU_RESTRICTED clearance, and a record missing the clearance field is treated as unclassified rather than defaulted upward, so an under-cleared caller is denied rather than served. Tenant isolation is enforced on every certificate query, so one organisation can never read or alter another's certificate position.
Every issue and revoke is recorded with the actor, the tenant, the classification context, and SHA-256 fingerprints of the record before and after the change, forwarded to a security information and event monitoring pipeline for tamper-evident, verifiable history. Revocation always requires a non-empty reason, so every revocation is attributable. Writes are reserved for a manager role and above, and revocation and waiver governance for an administrator role, so privileged certificate actions follow least privilege.
The lapse-warning watcher writes its threshold gate before it records a warning, so it fails closed rather than claiming an alert that did not land, and it never double-fires on a recurring schedule. Waiver suppression is logged so an auditor can always reconcile why an expected warning was withheld. Together these properties provide the tamper-evident audit trail required for programme audits and for the contractual quality assurance obligations that AQAP 2110 places on defence suppliers.