If you’re buying machined parts for a DoD program, your supplier’s cybersecurity posture is now a contractual requirement — not a preference. CMMC (Cybersecurity Maturity Model Certification) determines whether a machine shop can handle Controlled Unclassified Information (CUI), which includes most defense-related engineering drawings, specifications, and technical data.
Quick Summary: CMMC 2.0 has three levels. Level 1 (self-assessment, 17 practices) covers shops handling Federal Contract Information (FCI) only. Level 2 (third-party assessment, 110 practices per NIST SP 800-171) is required for shops handling CUI — which includes most ITAR-controlled technical data. Level 3 (government-assessed, 130+ practices) covers the most sensitive programs. Most aerospace machine shops need Level 1 or Level 2. If your supplier can’t tell you which level they hold or are pursuing, that’s a red flag.
What Level Does a Machine Shop Actually Need?
| CMMC Level | Who Needs It | What It Covers | Assessment Type |
|---|---|---|---|
| Level 1 | Any DoD contractor handling FCI | 17 basic cyber hygiene practices (antivirus, passwords, access control) | Annual self-assessment |
| Level 2 | Contractors handling CUI (most ITAR technical data) | 110 practices per NIST SP 800-171 Rev 2 | Third-party assessment (C3PAO) for critical programs; self-assessment for non-critical |
| Level 3 | Contractors on the most sensitive programs | 130+ practices including NIST SP 800-172 enhancements | Government-led assessment (DIBCAC) |
Most machine shops making defense parts receive CUI in the form of engineering drawings, material specs, and inspection requirements. That puts them at Level 2 for contracts that flow down DFARS 252.204-7012.
What Does CMMC Cost a Machine Shop to Implement?
The compliance cost falls into two buckets:
IT infrastructure. Encrypted file storage, multi-factor authentication, network segmentation, endpoint detection, audit logging, and incident response planning. For a small-to-mid-size shop, standing up a CMMC Level 2 compliant IT environment typically runs $20,000–$100,000+ depending on starting point, plus $5,000–$15,000/year in ongoing maintenance and monitoring.
Assessment cost. A third-party C3PAO assessment for Level 2 runs $15,000–$50,000 depending on scope. Self-assessment (for non-critical CUI contracts) is cheaper but still requires documentation and a senior official affirmation submitted to SPRS.
These costs get distributed across the shop rate, same as ITAR overhead.
Frequently Asked Questions
Is CMMC the same as NIST 800-171? CMMC Level 2 is based on NIST SP 800-171, but adds the third-party assessment requirement. A shop could be “NIST 800-171 compliant” (self-declared) without being CMMC Level 2 certified (independently verified). The assessment is the difference.
When does CMMC become mandatory? The CMMC final rule took effect December 2024. Phased implementation began in 2025, with full rollout expected to be complete by 2028. New DoD contracts are increasingly including CMMC requirements in solicitations now.
Can a shop without CMMC still bid on defense work? For contracts that don’t flow down CUI requirements, Level 1 self-assessment may suffice. For contracts with DFARS 252.204-7012 (most ITAR work), Level 2 is required. Without it, the shop is ineligible.
Written by James Wright, CEO of Accurate Machine & Tool.
Sources
[1] eMachineShop — quality assurance and compliance overview, emachineshop.com
[2] NIST SP 800-171 Rev 2 — Protecting Controlled Unclassified Information in Nonfederal Systems
[3] CMMC 2.0 Model — U.S. Department of Defense, cyberdefensereview.army.mil