CMMC compliance for manufacturers and machine shops.
One customer sends a security questionnaire. Another requires ISO 27001 alignment. A third references NIST. A fourth is worried about export-controlled information. Four different asks, arriving from four different directions.
The requirements change. The work usually doesn't.
CMMC for manufacturers
Does your machine shop need CMMC?
If you make parts for the Department of Defense, or for a prime that does, you likely need CMMC once it shows up in your contracts. Level 1 applies if you only handle Federal Contract Information, such as purchase orders and delivery schedules. Level 2 applies if you receive Controlled Unclassified Information, which for most shops means the technical drawings, CAD models and specifications your customer sends you. Look for DFARS 252.204-7012 in your purchase orders and CUI markings on the drawings.
Where CUI usually hides in a manufacturing shop
- Engineering and quoting email inboxes
- CAD and CAM workstations
- CNC machines and the PCs that load programs onto them
- Shared drives and file transfer sites
- USB drives moving files to the shop floor
- Printed drawings on the floor and in job travelers
How we make CMMC manageable for a shop your size
Scope it small
Most of your people never touch CUI. We map exactly where drawings and specs go and draw the smallest boundary you can defend, so fewer machines and people are in scope.
Score it honestly
An SPRS score against all 110 NIST SP 800-171 requirements, with the math shown, so the number you post holds up if a prime or DoD asks for evidence.
Keep the evidence
Every requirement becomes a task with an owner and proof, reviewed by your named compliance manager. You keep running the shop. Your IT provider keeps running the systems.
Published prices: the Compliance App is $399 a month with expert review, Managed is $999 a month, and CMMC Level 1 only is $199 a month for companies up to 50 people.
If only your engineers touch CUI, a secure enclave keeps drawings in one locked-down workspace for $295 per user a month plus $4,500 setup. See all pricing
CMMC questions from manufacturers
Do machine shops need CMMC Level 1 or Level 2?
It depends on what your customer sends you. If you only handle purchase orders, schedules and other Federal Contract Information, Level 1 applies. If you receive drawings, models or specs marked CUI, Level 2 applies, which means all 110 requirements in NIST SP 800-171.
Are technical drawings CUI?
Often, yes. Drawings, CAD models and specifications from defense customers are commonly marked as CUI, frequently as controlled technical information. Check the markings and your contract clauses, or ask your customer.
Do CNC machines have to be in scope for CMMC?
If a machine or the PC that feeds it processes or stores CUI, it is in scope. Good scoping keeps CUI on as few systems as possible, which keeps the cost down.
Does the CMMC Phase 2 pause mean we can wait?
No. On July 13, 2026, DoD suspended Phase 2 third-party assessments, but DFARS 252.204-7012, NIST SP 800-171, your SPRS score and contract-required self-assessments still apply today.
Built for manufacturers and engineering firms
Whether you're answering a defense contractor, an aerospace customer, a prime manufacturer or a commercial enterprise buyer, the challenge is the same: prove you're managing security appropriately. Pick what's landed on you.
Notice how much of that repeats. Access control, training, vendor oversight, incident response and asset inventory appear in nearly every one of these — described in different language by each customer.
The problem isn't one framework. It's ten requirements asking for the same thing.
Manufacturers don't struggle because there are too many controls. They struggle because every customer uses different language for the same underlying work. Pick any of these three and see where they land.
Without a system, you do that work three times — once per customer, in their words. With one, you do it once and answer all three from the same completed task and the same piece of evidence.
Complete the work once
Instead of a separate checklist for every customer, framework and requirement, your organization works through one common set of tasks. Pick a task to see everything it satisfies.
The work happens once. The value gets reused everywhere. Same task, same evidence, answering a customer questionnaire, an ISO initiative, an export-control obligation and a prime flowdown at the same time.
Customer security reviews are becoming standard
Security requests now arrive before contracts are awarded and again before they're renewed. The answer is part of whether you win the work.
The questions you can't Google
Compliance software gives you a task list. It doesn't tell you whether your specific situation is a problem. Greypike includes compliance analysts — ask them the thing you'd otherwise guess at.
The same work, multiplied by however many customers you have
This is the whole argument, and it gets worse as you win more business. Set the number of customers asking you for security evidence this year.
Each block is the work done from scratch — gathering evidence, chasing owners, answering in that customer's language.
One solid block is the work. Every dashed one is a customer answered from evidence that already exists.
Your customers don't care how many requirements you manage. They care whether you can demonstrate a mature security program. Build it once and leverage it everywhere — including for the customer who hasn't sent their questionnaire yet.
Do it once. Answer everyone.
Your next customer questionnaire is already written and heading your way. Build the program once and it answers that one, the ISO initiative, the export-control obligation and the prime flowdown at the same time.
