How to Sell an Aerospace or Defense Supplier: Multiples, Buyers, and Diligence

An aerospace or defense supplier sells for more when its parts are specified into a program, hard to replace, and needed again as spares, and it closes faster when its compliance file is clean. Beyond ordinary financial diligence, buyers check AS9100 certification, ITAR registration and export classification, cybersecurity under DFARS 252.204-7012, how government contracts transfer, and, for a foreign buyer, review by the Committee on Foreign Investment in the United States (CFIUS). This guide covers what comparable sales show, what drives price, who buys, and what each regulatory step requires. It is general education; these rules change, and your own attorney decides how they apply.

What aerospace and defense companies have sold for: Bankerly’s deal data

Across 18 aerospace and defense deals in Bankerly’s transaction database, trailing EV/EBITDA ran from 9.3× at the 25th percentile to 13.0× at the 75th, with a median of 10.5×. The basis is disclosed deals with targets at or below $25M of EBITDA, as of October 2026. Disclosed deals skew larger and better-run than a typical owner-operated company, so the median is a reference point, not a price for your company.

Single deals scatter far wider than the quartiles. Five examples:

These multiples are price divided by the adjusted or underlying EBITDA each acquirer reported. Irvine Electronics, a U.S. electronics manufacturer serving mostly defense customers, sold at 3.5× adjusted EBITDA of $4.7 million, down from $8.4 million reported with a one-time Covid-related project in it. At the small end, PMGC Holdings paid $4.5 million for A&B Aerospace on about $610,000 of management-adjusted EBITDA, a multiple below the 25th percentile. The companies gave no reason for the price, and one deal is not a pattern; why multiples differ by size covers the general case. The full table is at M&A multiples by industry (sector page: aerospace and defense multiples), and how manufacturing businesses are valued covers the wider industrial range.

Sole-source and aftermarket parts, and the backlog buyers believe

Buyers first sort revenue by how hard it is to replace. A build-to-print shop makes parts to a customer’s drawings and can be re-bid; a company that owns the design, or is the only approved source, is a different asset. Crane’s January 2024 release on Vian Enterprises cited “sole-sourced and proprietary content on the highest volume commercial and military aircraft platforms” and “an order backlog exceeding $100 million.” TransDigm targets “proprietary commercial aerospace component businesses with significant aftermarket content” and says aftermarket sales, about 55% of its fiscal 2025 net sales, have historically been more stable than original-equipment sales.

The flip side is concentration. Air Industries Group, a public precision aerospace manufacturer, reported that four customers, two of them in one corporate group, made up about 75% of its 2025 net sales. Buyers ask for revenue by program, platform and prime, then for each program’s expected build life.

Backlog needs a definition before it means anything. Air Industries counts only funded orders: $136.8 million at year-end 2025. CPI Aerostructures reported $504.5 million of total backlog, of which $91.8 million was funded and the rest an estimate of future orders over each program’s life. It cautions that backlog is “not necessarily indicative of future revenues or the timing of such revenues,” and notes that the U.S. Government can generally terminate contracts without prior notice.

Contract type decides who carries cost growth. A firm-fixed-price contract places “maximum risk and full responsibility for all costs and resulting profit or loss” on the contractor (Federal Acquisition Regulation, FAR 16.202-1); a cost-reimbursement contract pays “allowable incurred costs, to the extent prescribed in the contract” (FAR 16.301-1). A sub-tier supplier’s purchase orders raise the same questions: who absorbs a material price increase, who can cancel, and what happens if control of the supplier changes, the subject of contracts that scare buyers.

Who is buying

Strategic buyers are the largest group by count: in Greenwich Capital Group’s first-quarter 2026 update, built on PitchBook data, they accounted for 65% of deal volume across 113 closed aerospace and defense transactions. They pay for what is hard to build, as strategic buyers and synergies explains.

Private equity builds groups from a first acquisition outward. Ventus Industrial Partners formed Aeron Defense in February 2026 with two purchases, General Tool Company and Magna Machine Company, and says it aims to build a group of manufacturing partners for the defense industry. Arlington Capital Partners created Forged Solutions Group in 2019 to address supply constraints in precision forgings and announced its sale in March 2026.

Independent sponsors find a deal first and raise the equity for it afterward, so a seller weighs certainty of funding alongside price (independent sponsors as buyers). A foreign investor taking ownership or control brings in the notices below.

A sale triggers ITAR notices, and drawings can count as exports

A company that manufactures defense articles must register with the State Department’s Directorate of Defense Trade Controls (DDTC), and 22 CFR 122.1 adds: “A manufacturer who does not engage in exporting must nevertheless register.” That covers a shop that machines controlled parts for a prime and never ships abroad.

A change of ownership triggers notices under 22 CFR 122.4. Within five days of the event, the registrant sends DDTC a written notice of changes including “Ownership or control,” and after a merger or acquisition the new entity reports firm names, registration numbers and licenses with unshipped balances, because “any license not the subject of notification will be considered invalid.” If a foreign person will acquire ownership or control, the registrant must also notify DDTC by registered mail “at least 60 days in advance,” a notice that does not replace export approvals. A foreign buyer therefore means two notices and a 60-day minimum.

Classification decides which regime governs a product: items the ITAR controls fall outside the Commerce Department’s Export Administration Regulations (15 CFR 734.3), so a buyer asks for each product family to be placed under one or the other, with the basis. A company unsure whether an item is on the Munitions List can ask DDTC for a commodity jurisdiction determination (22 CFR 120.12).

Drawings raise a second point: the ITAR treats releasing technical data to a foreign person in the United States as a “deemed export” (22 CFR 120.50), so a data room that a foreign bidder or foreign-national adviser can open is an export-control question as well as a confidentiality one. Sidley’s summary of DDTC’s compliance guidelines adds that diligence should test the target’s ITAR program, and that if a violation appears likely the parties should consider a voluntary disclosure before or immediately after closing.

AS9100 and cybersecurity: where DFARS 252.204-7012 and CMMC stand

AS9100D, published by SAE International, adds aviation, space and defense requirements to ISO 9001:2015. BSI, a certification body, requires a certified organization (citing AS/EN 9104/1) to notify it of significant changes, with “address, ownership, key management” among the examples, and to tell aviation, space and defense customers immediately if certification is lost. CPI Aerostructures says what is at stake: if it fails to maintain required approvals or certifications, “we could lose existing business or be unable to compete for future opportunities.” In a stock sale the certified company continues; in an asset sale the buyer’s entity is a different organization, a question to put to the certification body before signing (asset sale vs. stock sale).

On cybersecurity, DFARS 252.204-7012 requires a contractor to “provide adequate security on all covered contractor information systems,” subjects them to NIST SP 800-171, requires incidents to be reported “within 72 hours of discovery of any cyber incident,” and flows down to subcontracts that involve covered defense information. A sub-tier shop that receives controlled technical drawings from a prime may be inside it.

The Cybersecurity Maturity Model Certification program (32 CFR Part 170) sets three levels, and Level 2 is “identical to the requirements in NIST SP 800-171 R2.” On July 13, 2026, the Department of War announced it was suspending Phase 2 of the rollout, the step scheduled for November 10, 2026 that would have added third-party Level 2 assessments to applicable awards, and holds later milestones “in abeyance until further notice.” Self-assessments, DFARS 252.204-7012 and NIST SP 800-171 stay in force, and Morgan Lewis writes: “Inaccurate self-assessments or unsupported affirmations may still create contractual, administrative, and FCA exposure.” In a stock sale the buyer inherits what the company has attested to, so diligence compares its system security plan, remediation plans and Supplier Performance Risk System entries with how the network runs (cybersecurity and IT diligence prep). Dates here have moved before, so check the current status.

When the government or a foreign buyer has a say: novation and CFIUS

Federal law bars transferring a government contract: “41 U.S.C. 6305 prohibits transfer of Government contracts from the contractor to a third party.” The government may recognize a successor when the transfer covers all the contractor’s assets or “the entire portion of the assets involved in performing the contract” (FAR 42.1204(a)), but a stock purchase “with no legal change in the contracting party” needs no novation (42.1204(b)). Structure sets the workload: an asset sale of prime contracts brings a novation package that includes balance sheets of both parties “audited by independent accountants” (42.1204(f)). The agreement ordinarily has the seller guarantee the buyer’s performance (42.1204(h)), and if the government declines to recognize the buyer, the seller remains obligated and the contract can be terminated for default if the seller does not perform (42.1204(c)). Purchase orders from primes raise a separate question: what their own assignment and change-of-control clauses say. Set-aside awards add a step: status must be recertified within 30 calendar days of a merger, acquisition or sale that changes controlling interest (13 CFR 125.12).

A foreign buyer adds CFIUS, which reviews any transaction “by or with any foreign person that could result in foreign control of any U.S. business” (31 CFR 800.210). Critical technologies include defense articles and services on the Munitions List (800.215), and a deal involving a business that makes or develops them can require a mandatory declaration when a U.S. export authorization would be needed to send that technology to the foreign investor (800.401). The declaration is due thirty days before completion, and failing to comply can bring a civil penalty “not to exceed $5,000,000 or the value of the transaction, whichever is greater” (800.901). A full notice runs a 45-day review, a 45-day investigation as needed, and a 15-day presidential period as needed. Add DDTC’s 60 days and a foreign bidder means months in the timeline; whether a deal is covered is a question for counsel with CFIUS experience.

The Bottom Line

Buyers in this sector price the file along with the earnings. Product classifications, registrations, a documented NIST SP 800-171 posture, a contract map and a split of funded and unfunded backlog are what they commonly ask for; each one answered in advance is one fewer argument over price. Platforms such as Bankerly.ai are one way to organize that file and run the process, alongside investment banks, business brokers and your own counsel.

Sources

• Cornell LII: 22 CFR 122.1, registration
• Cornell LII: 22 CFR 122.4, registrant notifications
• Cornell LII: 22 CFR 120.50
• Cornell LII: 22 CFR 120.12
• Cornell LII: 15 CFR 734.3, scope of the EAR
• Sidley Austin: DDTC compliance program guidelines
• SAE International: AS9100D
• BSI: AS/EN 9100 scheme certification requirements
• Acquisition.gov: DFARS 252.204-7012
• Cornell LII: 32 CFR 170.14
• Morgan Lewis: Department of War suspends CMMC Phase II
• Cornell LII: 48 CFR 42.1204
• Cornell LII: 13 CFR 125.12
• Cornell LII: 31 CFR 800.210
• Cornell LII: 31 CFR 800.215
• Cornell LII: 31 CFR 800.401
• Cornell LII: 31 CFR 800.901
• CFIUS: overview
• Acquisition.gov: FAR 16.202-1
• Acquisition.gov: FAR 16.301-1
• TransDigm Group: Form 10-K, fiscal 2025
• CPI Aerostructures: Form 10-K, fiscal 2025
• Air Industries Group: Form 10-K, fiscal 2025
• Crane Company: Vian acquisition release
• PMGC Holdings: A&B Aerospace acquisition release
• Volex plc: Irvine Electronics acquisition announcement
• Greenwich Capital Group: Aerospace & Defense industry update, Q1 2026
• Washington Technology: Aeron Defense formed with two acquisitions
• Morgan & Westfield: independent (fundless) sponsors in M&A