A defense Newco is cleared by Day One or it is not a Newco.

ITAR, EAR, and the controlled data perimeter.

A defense business that touches defense articles, defense services, or technical data on the United States Munitions List operates under the International Traffic in Arms Regulations administered by the Directorate of Defense Trade Controls. A business that touches dual use items on the Commerce Control List operates under the Export Administration Regulations administered by the Bureau of Industry and Security. The Newco needs an active DDTC registration, an EAR compliance program, and a controlled data enclave on Day One. A controlled drawing that lands in a non compliant SharePoint on Day One is a controlled drawing that triggers a voluntary disclosure obligation.

Export licenses, Technical Assistance Agreements, Manufacturing License Agreements, and Distribution Agreements all carry counterparty consents and a notification cadence with DDTC. Some assign with consent. Some have to be refiled by the Newco under its own DDTC registration. A foreign person on the Newco's engineering team requires a fresh deemed export analysis the day the carve-out closes.

Empowered Official designation, technology control plans, and screening obligations against the Consolidated Screening List all carry across with the operating model. The Newco's trade compliance lead has to take responsibility from Day One. The plan should reference the broader cross-border TSA considerations playbook.

CMMC, NIST 800-171, and the CUI enclave.

Cybersecurity Maturity Model Certification at Level 2 applies to any defense contractor that processes, stores, or transmits Controlled Unclassified Information. NIST SP 800-171 controls have to be in place on Day One, the System Security Plan has to reflect the Newco's environment, and the SPRS score has to remain compliant for award eligibility. A Newco that operates on the seller's shared tenant is a Newco that cannot demonstrate a clean boundary for assessor review.

A GCC High or compliant equivalent tenant carries Microsoft 365 in a FedRAMP High boundary with US sovereign cloud hosting. A defense Newco that stays on Commercial M365 risks DFARS 7012, 7019, and 7020 noncompliance from sunrise. The cutover sequence has to land identity, mail, file shares, collaboration tools, engineering data management, and email archives inside the compliant boundary before the Newco accepts CUI from a customer or supplier.

Plans of Action and Milestones, incident response procedures with seventy two hour DOD CYBER reporting, and FIPS validated cryptography on every endpoint all sit inside the day one posture. The pattern overlaps with the broader carve-out cybersecurity Day One playbook.

Novation, contract assignment, and the FAR flowdowns.

Federal prime contracts cannot assign by operation of law. The Anti Assignment Act and FAR Subpart 42.12 require a novation agreement, a tri party agreement among the government, the seller, and the Newco. The Administrative Contracting Officer reviews the novation package, the government decides whether to recognise the successor, and the timeline routinely runs six to eighteen months. A Newco that bills against a prime contract before novation lands is a Newco that has invited an Anti Assignment Act dispute.

During the novation window the seller continues as the contracting party and the TSA carries the operational performance, the invoicing pass through, and the cost accounting flow. The Newco operates under the seller's CAGE code, the seller's CAS Disclosure Statement, and the seller's indirect rate structure until the Defense Contract Audit Agency or the Defense Contract Management Agency accepts the Newco as a successor.

Subcontract awards under prime contracts carry the full set of FAR and DFARS flowdowns, equal opportunity clauses, limitation on subcontracting, small business plan compliance, and counterfeit electronic parts detection. Every flowdown carries across with the contract. The pattern overlaps with the broader carve-out customer contract assignments playbook.

Facility clearances and personnel security.

A Facility Security Clearance issued by the Defense Counterintelligence and Security Agency cannot transfer to a new corporate entity. The Newco files a fresh DD Form 441, a Standard Practice Procedures manual, an Insider Threat Program, and a Foreign Ownership, Control, or Influence package. A defense Newco with foreign private equity investors faces a FOCI mitigation arrangement, typically a Special Security Agreement, a Voting Trust, or a Proxy Agreement. The mitigation has to land before any classified work flows under the new ownership.

Cleared personnel under the DOD CAF carry their clearances with them. The Newco's Facility Security Officer files JPAS or DISS updates, recertifies the personnel security roster, and runs a periodic reinvestigation cadence inside the new entity. Industrial security letters, classified contract DD Form 254 amendments, and SCIF accreditation for any sensitive compartmented work all sit inside the documented handoff.

An interim Facility Clearance under DCSA carries specific eligibility tests. A Newco that operates on an interim clearance navigates a documented timeline. A Newco that operates without any clearance is a Newco that cannot bid the work that defines its enterprise value. The pattern overlaps with the broader Day One regulatory filings playbook.

AS9100, configuration management, and the engineering data backbone.

AS9100 quality management certification carries through change of ownership with a documented notification, a desk audit, and a surveillance visit. The certificate body, the auditor, and the next surveillance cadence all need a clean handoff. NADCAP accreditation for special processes such as heat treatment, non destructive testing, chemical processing, and welding carries its own audit cycle and a separate transfer protocol. A defense supplier that drops NADCAP between surveillance audits is a supplier locked out of every major prime's approved supplier list.

Product Lifecycle Management on Siemens Teamcenter, PTC Windchill, Dassault ENOVIA, or Aras Innovator carries every active drawing, model, bill of material, engineering change order, and configuration baseline. The Newco needs a working PLM on Day One with the active program data inside the controlled enclave. A configuration mismatch between the Newco's PLM and the prime's data exchange is a configuration mismatch that grounds delivery.

First Article Inspection records under AS9102, source inspection records, government source inspection waivers, and DCMA quality assurance letters all carry with the contract. The plan should reference the broader TSA exit data migration strategy playbook.

Closing the TSA and the compliance exit.

A clean aerospace and defense TSA exit closes four records. Every export license, every novation package, every clearance, and every quality certification sit under the Newco's identity with a documented compliance owner. The CUI enclave runs inside a CMMC compliant boundary with a current SPRS score. Engineering data, PLM, and ERP run on the Newco's instance with a clean cutover record. Cost accounting, indirect rates, and DCAA correspondence flow through the Newco's own structure with no stranded balances on the seller.

Open items, typically a small set of pending novation packages, in flight export license modifications, and FOCI mitigation milestones, sit under a short post-close services agreement with a hard end date. The seller's cooperation on legacy contracting officer requests and historical incurred cost submissions is documented. A DCAA audit or a DCSA security review during the post-close window deserves a coordinated response on both sides.

Specialist support across the aerospace and defense carve-out is part of the TSA Pre-Signing Review service when the buyer wants the regulatory exposure and the cutover budget quantified before signing. The work coordinates with the Newco's CFO, the Facility Security Officer, the Empowered Official, and the seller's contracts and security teams.

More on industry specific carve outs.