CMMC Compliance for Aerospace Suppliers: Levels, Scope, ITAR/CUI, and the Right Path in 2026

By The Defense Compliance Report Editorial Team — an independent trade publication on CMMC 2.0 and DIB compliance

Published: May 27, 2026 · Last verified: June 9, 2026

Editorial research — not legal, contractual, or compliance advice, and not formally reviewed by a CMMC Subject Matter Advisor. Verify scope and applicability with a Registered Practitioner before you act.

CMMC compliance for aerospace suppliers starts with the one question almost everyone gets backwards: what does your contract actually require — not what does “aerospace” require. There’s no rule that says “aerospace shop, therefore Level 2.” There’s a clause in a solicitation, a data type flowing into your systems, and a status the government wants to see in a database before you can win the award. Get those three straight and the fog clears fast.

Here’s the bottom line. If a Department of Defense (DoD) contract or subcontract requires a CMMC status, and your systems process, store, or transmit Controlled Unclassified Information (CUI)— and in aerospace, the technical data a prime hands you is often CUI once it’s marked or identified under the contract, frequently export-controlled on top of that — your planning baseline is CMMC Level 2, measured against NIST SP 800-171 Revision 2 and its 110 security requirements. Whether your Level 2 requires a self-assessment or a third-party C3PAO certification is set by the solicitation, not your revenue, employee count, or how long you’ve been making aerospace parts.

The rest of this page is the part that saves you money: the expensive failures in aerospace CMMC are almost never exotic security controls. They’re scoping mistakes — calling everything CUI, calling nothing CUI, treating ITAR compliance as if it covers cybersecurity, or writing off a 1998 CNC controller as “out of scope” without proving it. We read the rules, cross-checked the clauses against the Federal Register and the eCFR, and built the tables below so you don’t have to start from scratch.

Last reviewed June 2026

In short: for aerospace suppliers, the contract clause — not the word “aerospace” — sets your CMMC level. If your systems process, store, or transmit Controlled Unclassified Information, your baseline is CMMC Level 2 against NIST SP 800-171 Revision 2 and its 110 security requirements; the solicitation decides whether that Level 2 is self-assessed or a C3PAO certification.

Which CMMC path applies to your aerospace shop?

Use this to place yourself before you read further. It’s a starting hypothesis, not a determination — your contract and your data flows decide the real answer.

Does CMMC compliance actually apply to your aerospace shop?

CMMC applies because of a contract requirement and the data you handle, not because your company makes aerospace parts. If a DoD solicitation or subcontract requires a CMMC status, and the systems you’ll use to perform that work process, store, or transmit FCI or CUI, you need the required CMMC status for those systems. The narrow carve-out is for contracts and orders solelyfor commercially available off-the-shelf (COTS) items — not a blanket exemption just because your company catalog includes standard parts.

The trigger is the clause, not the industry label. Since the acquisition rule took effect on November 10, 2025, the requirement shows up in the solicitation through the DFARS clauses, and through November 9, 2028 a program office or requiring activity decides case-by-case whether to apply CMMC to a given procurement. Here’s how to read what landed in your contract.

Most aerospace suppliers don’t go looking for this. It finds them. A prime flows down a clause in a new purchase order. A customer’s supplier portal asks for your Supplier Performance Risk System (SPRS)score — SPRS being the DoD database where your CMMC status and affirmations are recorded for award eligibility. A drawing package arrives marked CUI. Or a single line in a solicitation says “Level 2 (C3PAO)” and the clock starts.

Which CMMC level do aerospace suppliers usually need?

If you handle only FCI, Level 1 may be the required path. If you handle CUI, Level 2is the normal planning baseline — but the solicitation determines whether that Level 2 is a self-assessment or a C3PAO certification. Level 3is reserved for the most sensitive programs and requires Final Level 2 C3PAO status first, followed by a government assessment. None of these is decided by your headcount or revenue; they’re decided by your data and your contract.

“Aerospace means Level 2” is usually directionally right but frequently imprecise. The CMMC Final Rule (32 CFR Part 170) defines four distinct statuses, and DFARS 252.204-7025 will name exactly one in your solicitation.

How does CMMC flow down — to you, and to your subcontractors?

Aerospace suppliers usually sit in the middle of a chain: you receive CUI from a prime, and you may pass CUI to your own lower-tier shops. The required CMMC status follows the information — not the company. For a prime contract, the DoD solicitation sets the level. For a subcontract, the prime flows down the correct level based on the FCI or CUI your systems will process, store, or transmit (32 CFR §170.23).

In practice that means three things. First, if you’re a subcontractor, your required level can differ from your prime’s — you can be Level 1 if you only receive FCI, even when the prime holds Level 2. Second, the flow-down stops where the data stops: a sub that never receives FCI or CUI isn’t pulled into CMMC at all. Third, the responsibility runs both directions — you’ll need to identify which of your own suppliers receive controlled data, flow the right clause to them, and track their CMMC status just as your prime is tracking yours.

Are your drawings actually CUI — and are they export-controlled?

In aerospace, drawings, models, specifications, and process data from a defense prime are the data types most likely to be CUI in your environment — specifically controlled technical information (CTI)— and they frequently carry an export-controlled marking because the underlying technology is regulated under ITAR(the International Traffic in Arms Regulations, 22 CFR Parts 120–130) or the EAR(Export Administration Regulations). But the controlling question is never “is this aerospace data?” It’s whether the specific artifact is marked, identified, or handled in a way that brings it into CUI scope under your contract.

DFARS 252.204-7012 defines “controlled technical information” and lists examples: engineering drawings and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses, and computer software executable code and source code. If a prime hands you a technical data package containing those items and they’re marked CUI, they’re in scope. But not everydocument in your building is automatically CUI — a generic material cert or an internal quote may not be.

When something is unmarked or ambiguous: read your contract markings, confirm the category against the National Archives CUI Registry, and ask your prime. And one ITAR concept you can’t skip — the deemed export: releasing ITAR-controlled technical data to a foreign person, even a foreign-person employee in your U.S. facility or a cloud administrator located abroad, can be a regulated export. That single fact drives your biggest infrastructure decision, two sections down.

What’s actually in scope on an aerospace shop floor?

CMMC Level 2 scope is defined by where CUI lives, and 32 CFR §170.19 sorts every asset into one of five categories: CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets, and Out-of-Scope Assets. For aerospace shops, the genuinely hard part is the shop floor and the engineering bench, because a single CUI drawing spawns derivative data — toolpaths, setup sheets, inspection results — that lands on machines people forget to inventory. Misclassifying those is the most expensive scoping mistake aerospace suppliers make.

This is our editorial application of §170.19 — not a determination. Classification is fact-specific; confirm each call in your System Security Plan (SSP) and with your assessor.

GCC High, AWS GovCloud, or an encrypted enclave?

CMMC does not require any specific cloud. The real drivers are DFARS 252.204-7012, which requires that a cloud service handling CUI meet the FedRAMP Moderate baseline (or DoD-recognized equivalency), and ITAR, which requires that export-controlled technical data not be exposed to foreign persons. For aerospace suppliers handling export-controlled CUI, that practically leaves three paths: a U.S.-sovereign cloud such as Microsoft 365 GCC High or AWS GovCloud; a FIPS-validated end-to-end encryption enclave; or staying on commercial Microsoft 365 / Google Workspace, which only works if you truly handle FCI and no CUI.

What does CMMC compliance cost an aerospace supplier?

Cost depends far more on your CUI footprint, your starting maturity, your cloud path, and your assessment type than on your employee count. There is no public C3PAO rate card. The most authoritative numbers come from DoD’s own Regulatory Impact Analysis in the CMMC Final Rule (32 CFR Part 170): for a small entity, DoD modeled a Level 2 self-assessment at roughly $34,277 initially and $37,196 over three years, and a Level 2 C3PAO certification at about $101,752 initially and $104,670 over three years — including a modeled $31,234 C3PAO assessment engagement. Other-than-small entities run higher.

The aerospace-specific drivers that move the number: export-controlled data forcing a sovereign-cloud decision, shop-floor OT pulling more assets into scope, and multiple facilities or CAGE codes (the Commercial and Government Entity codes identifying each of your locations to DoD). The cheapest path to a defensible scope is usually a tight boundary plus an enclave, not a company-wide rebuild.

Level 2 self-assessment vs. Level 2 C3PAO: how do you know which applies?

The security requirements are identical — 110 NIST SP 800-171 Rev. 2 requirements either way. What changes is who verifies them. A Level 2 self-assessment is performed by your organization and submitted to SPRS; a Level 2 C3PAO assessment is performed by an authorized third party, whose results flow through the CMMC instance of eMASS(the government’s assessment system of record) and are then transmitted to SPRS. The solicitation’s DFARS 252.204-7025 entry tells you which one your contract demands.

What CMMC UID and SPRS evidence should you have before award?

Before award, DFARS 252.204-7025 requires you to have your current CMMC status and a current affirmation in SPRS for each in-scope system — and to provide the CMMC unique identifier (CMMC UID) for each. A CMMC UID is 10 alphanumeric characters assigned to each CMMC assessment and reflected in SPRS for each contractor information system; SPRS issues it once your assessment results are entered. Missing any of those for an in-scope system can make you ineligible for the award.

When does Level 3 actually apply — and which NIST version controls?

Level 3 matters when a contract requires enhanced protection for the most sensitive CUI on critical programs — not simply because a company works in aerospace. Under the current rule, Level 3 requires Final Level 2 (C3PAO) status first, then a government assessment by DCMA DIBCAC against 24 selected requirementsdrawn from NIST SP 800-172. Your Level 3 scope must sit inside your Level 2 scope, and any Level 2 POA&M items must be closed before the Level 3 assessment begins.

Does AS9100 or NADCAP cover any of this?

No. AS9100 (the aerospace quality management standard) and NADCAP(the National Aerospace and Defense Contractors Accreditation Program for special processes) govern how you make and inspect parts — not how you protect Controlled Unclassified Information. A disciplined AS9100 program is a genuine head start on the habitsCMMC rewards: configuration control, document management, audit readiness, evidence trails. But AS9100 or NADCAP certification doesn’t satisfy any of the 110 NIST SP 800-171 requirements by itself — any overlap has to be mapped and evidenced requirement by requirement.

Treat CMMC as a distinct cybersecurity obligation that runs alongside your quality system, owned by people who understand your IT and OT — not folded into a quality manual.

Your first 30, 60, and 90 days

The first move is not buying software or scheduling a C3PAO. It’s triage: collect the contract clauses, map where FCI and CUI flow, define a preliminary scope, confirm your SPRS and assessment status, and only then choose the provider category that fits the gap.

Which provider category should you talk to first?

Most aerospace suppliers should notstart with a C3PAO unless they are genuinely assessment-ready. If your scope, SSP, evidence, cloud responsibilities, OT treatment, subcontractor flow-down, or SPRS status is unclear, start with readiness or managed-compliance help first. There’s a conflict-of-interest line behind this, set by the Cyber AB’s assessment rules: an organization that prepared you generally cannot also be the C3PAO that certifies you where that creates an unresolved conflict — and during a certification assessment, the assessor cannot give you implementation advice or promise an outcome.

A useful authority signal as you shop: the CMMC Assessment Process is explicit that neither the Cyber AB, the CMMC training body, nor DoD personnel provide recommendations or facilitate introductions to C3PAOs — and a C3PAO can’t guarantee or promise a certification result. Understanding the categories yourself matters before you engage anyone.

The aerospace-specific mistakes that cause failed readiness

The biggest aerospace CMMC failures aren’t obscure technical controls. They’re scope decisions made on assumptions. Here are the seven we see most, with the fix for each.

1. “We’re ITAR compliant, so CMMC is covered.” They’re different programs. Separate your export-control obligations from your cybersecurity status and address both.
2. “All our aerospace data is CUI.” Maybe — but prove it per document, using contract markings, the CUI Registry category, and the DFARS 7012 definition, not a blanket assumption that inflates your scope and your bill.
3. “Only the original marked drawing matters.” The derivatives matter too: NC programs, setup sheets, printouts, inspection results, and the subcontractor packages you build from CUI.
4. “Our CNC machines are old, so they’re out of scope.” Document specialized assets and prove segmentation. Age isn’t an exemption; demonstrated management and separation are.
5. “The C3PAO will tell us what to fix.” A readiness review can validate scope, but the certification assessor is not your remediation consultant and cannot guarantee an outcome.
6. “Our MSP handles everything.”Require a Customer Responsibility Matrix, service descriptions, and admin-access mapping. Your provider’s access and evidence obligations are part of your assessment.
7. “Subcontractors are the prime’s problem.” If you flow CUI down, you carry flow-down obligations of your own under the rule. CMMC isn’t only an internal IT project.

Every one of these is a place to lose months. Every one is avoidable with scoping done first.

Which aerospace suppliers have publicly reached Level 2?

Aerospace and space manufacturers across sizes have publicly announced Level 2 — drawn from each company’s own announcement. These outcomes are company-stated and not a promise of your result. Confirm any provider’s current standing on the Cyber AB Marketplace before relying on it.

As of the Cyber AB’s March 2026 town hall, there were 103 authorized C3PAOs and 759 certified assessors, and roughly 1,000 organizationshad reached Level 2 — about 1% of the 80,000-pluscompanies DoD estimates will ultimately need it. The Aerospace Industries Association (cited by Reuters, Feb. 2026) put the aerospace small-business share at around 88%. The real bottleneck isn’t assessor availability — it’s readiness. Counting back from Phase 2 (November 10, 2026), the urgent move isn’t to panic-schedule an assessor — it’s to start getting ready now, because readiness is the long pole.

What we verified for this page

Frequently asked questions: CMMC compliance for aerospace suppliers

Need help deciding what type of CMMC provider you need?

Tell us your level, scope, and timeline, and we’ll match you with source-checked CMMC provider options.

Which provider category fits your situation

• RPO/RP (Registered Provider Organization / Registered Practitioner) — if you need to scope CUI and CNC/OT assets correctly, build the SSP, and prepare evidence before any assessment.
• MSSP (Managed Security Service Provider)— if you need to operate identity, logging, monitoring, and incident response and lack internal security operations.
• CUI enclave— if you can isolate export-controlled CUI and drawings into a U.S.-sovereign environment to reduce scope.
• GRC platform— if you need a system of record for control evidence and SSP data.
• C3PAO (Certified Third-Party Assessment Organization) — engage when the solicitation requires Level 2 (C3PAO) and you are assessment-ready. You don’t need a C3PAO yet if you only have a Level 2 (Self) requirement or are still remediating.

Related guides

• CMMC Level 1 vs Level 2 vs Level 3: Full Overview
• CMMC Level 2 Cost: What You Actually Pay
• The CMMC Phases and What They Mean for Your Contracts
• CMMC Managed Enclaves: Scope Reduction Guide
• CMMC Readiness Checklist
• CMMC Gap Assessment: What to Expect
• C3PAO Directory: Verifying Authorized Assessors
• CMMC Provider Categories
• CMMC Compliance for Manufacturers: Level, Scope & Cost
• CMMC Compliance for DoD Subcontractors: Flow-Down Guide