If you cannot find information about a compliance topic, please contact us for free support.
CMMC for Aerospace Subcontractors
The DoD’s supply chain security requirements flow down from primes like Lockheed Martin, Boeing, Northrop Grumman, and Raytheon to every tier of the aerospace supply chain.
CMMC stands for Cybersecurity Maturity Model Certification, the DoD’s mandatory cybersecurity verification program for the defense supply chain.
This guide explains what Tier 2, Tier 3, and lower-tier aerospace suppliers need to know about CMMC for Aerospace compliance.
How CMMC Flows Down the Aerospace Supply Chain
When the DoD awards a contract to an aerospace prime contractor, that contract includes CMMC requirements. The prime must then flow down these requirements to subcontractors who handle Federal Contract Information or Controlled Unclassified Information.
Flow-down refers to the contractual requirement for prime contractors to pass security obligations to their subcontractors.
The Flow-Down Chain:
- DoD contract requires CMMC Level 2 from prime contractor
- Prime contractor adds CMMC requirement to Tier 1 subcontracts
- Tier 1 suppliers add CMMC requirement to Tier 2 subcontracts
- Requirements continue flowing to every tier handling CUI
This means a small machine shop making fasteners for an aircraft component must achieve the same CMMC certification as the prime contractor if that shop handles CUI.
Determining Your CMMC Level as a Subcontractor
Your required level depends on the information you handle, not your position in the supply chain.
Level 1: FCI Only
If you only handle Federal Contract Information—purchase orders, delivery schedules, pricing—without receiving technical specifications or CUI, Level 1 may suffice. This includes suppliers providing:
Understanding CMMC for Aerospace is crucial for all stakeholders involved in the defense supply chain.
- Commercial off-the-shelf items
- Standard hardware without specifications
- General services without technical data
Level 2: CUI Handling
Most aerospace subcontractors need Level 2 because they receive technical drawings, specifications, or other CUI. Signs you handle CUI include:
- Drawings marked with distribution statements
- Specifications containing technical parameters
- ITAR-controlled technical data
- Manufacturing processes specified by customer
- Quality requirements beyond commercial standards
ITAR stands for International Traffic in Arms Regulations, export control regulations governing defense articles and technical data.
Key Indicator: DFARS 252.204-7012
If your subcontracts include DFARS clause 252.204-7012 “Safeguarding Covered Defense Information and Cyber Incident Reporting,” you handle CUI and need Level 2.
Why Primes Are Requiring CMMC Now
Major aerospace primes have begun requiring CMMC certification from suppliers even before the DoD mandate takes full effect. This happens because:
Risk Transfer
Primes are liable for their supply chain’s security. A breach at a Tier 3 supplier can compromise the entire program and expose the prime to penalties.
Contract Readiness
New DoD contracts will require primes to verify subcontractor compliance. Primes need compliant supply chains before they can win new work.
Competitive Advantage
Primes with certified supply chains can respond faster to DoD opportunities. They prefer suppliers who are already compliant.
If your prime contractor is asking about your CMMC status, take it seriously. Non-compliant suppliers risk losing business to competitors who invest in compliance.
Unique Challenges for Aerospace Subcontractors
Complex Technical Data
Aerospace subcontractors often handle detailed technical data including 3D models, manufacturing specifications, material certifications, and test results. Protecting this data requires robust technical controls.
Long Program Lifecycles
Aerospace programs span decades. Information you receive today may require protection for 20+ years through development, production, sustainment, and eventual disposal.
International Supply Chains
Aerospace supply chains cross borders. CMMC requires protecting CUI from unauthorized foreign access, creating complications for companies with international operations or ownership.
Multiple Prime Relationships
Suppliers often serve multiple primes with different contract requirements. You may need to demonstrate compliance to several customers with varying expectations.
Capacity Constraints
Small aerospace suppliers often lack dedicated IT and security staff. Compliance competes with production demands for limited resources.
Compliance Strategies for Aerospace Subcontractors
Minimize Your Scope
Identify exactly which systems handle CUI and limit your compliance boundary to those systems. You do not need to apply CMMC controls to every computer in your facility.
Scope reduction strategies:
- Create dedicated workstations for CUI handling
- Isolate CUI storage from general file shares
- Separate CUI email from general business email
- Limit personnel with CUI access
Address Technical Data Protection
Implement specific controls for protecting technical drawings and specifications:
- Encrypted storage for all technical data
- Access controls limiting who can view drawings
- Audit logging showing who accessed what files
- Secure transfer methods for receiving data from customers
Plan for Long-Term Retention
CMMC requirements continue as long as you hold CUI. Implement sustainable practices you can maintain over program lifecycles:
- Document retention policies aligned with contracts
- Secure destruction procedures for obsolete data
- Records of CUI handling throughout program life
Leverage Managed Services
Small aerospace suppliers benefit from managed security services that provide required capabilities without internal staff:
- Managed endpoint detection and response
- Security information and event management
- Vulnerability scanning and patch management
- Security operations center monitoring
Document Everything
Create clear documentation of your security practices:
- System Security Plan covering all CUI systems
- Policies for handling technical data
- Procedures for receiving and storing drawings
- Evidence of control implementation
Timeline Pressure from Primes
Aerospace primes have begun supplier qualification processes requiring CMMC certification. Typical prime contractor requirements:
Supplier Portal Updates
Primes are adding CMMC status questions to supplier portals. You may need to certify your compliance status or provide assessment dates.
New Contract Language
New subcontracts increasingly include explicit CMMC requirements with compliance deadlines.
Supplier Audits
Some primes conduct their own supplier cybersecurity assessments before formal CMMC certification requirements take effect.
Bid Eligibility
Responses to new opportunities may require evidence of CMMC certification or assessment scheduling.
Cost Considerations
Compliance costs vary based on your starting point and scope size.
Typical Costs for Small Aerospace Suppliers:
- Gap assessment: $5,000 – $15,000
- Technology solutions: $15,000 – $50,000 annually
- Documentation development: $10,000 – $30,000
- C3PAO assessment: $15,000 – $50,000
- Ongoing compliance: $10,000 – $30,000 annually
Cost Reduction Strategies:
- Minimize scope to reduce systems requiring controls
- Use compliance platforms to streamline documentation
- Leverage managed services instead of building internal capability
- Join industry groups sharing compliance resources
Key Takeaways for Aerospace Subcontractors
CMMC requirements flow down from DoD through prime contractors to every tier of the aerospace supply chain. If you receive technical drawings or other CUI from aerospace customers, you need Level 2 certification.
Prime contractors have begun requiring CMMC certification from suppliers. Non-compliant subcontractors risk losing current business and becoming ineligible for future opportunities.
Start compliance efforts now. Most subcontractors need 6-12 months to achieve certification. Waiting until primes mandate compliance leaves insufficient time to prepare.
Free tools
Get to an honest number faster
You will run this more than once: after any material change to your environment, and again before every annual affirmation. Both are free, and both are yours to keep.
Neither is a certified assessment, and neither pretends to be.
Official sources
The audit is gone. The liability isn't.
Greypike runs the environment your CUI lives in and owns the compliance outcome that proves it's protected. If you are not certain your environment supports the score sitting in SPRS next to your CAGE code, that is the conversation to have.
Talk to Greypike about SPRS Attestation Assurance