CMMC Compliance for Machine Shops: What’s in Scope, What Level You Need, and What It Costs

By The Defense Compliance Report Editorial Team — an independent trade publication on CMMC 2.0 and DIB compliance

Last verified: June 9, 2026 · Published: May 27, 2026

General information for the defense industrial base — not legal, contractual, audit, or compliance advice. Not affiliated with DoD, The Cyber AB, DCMA DIBCAC, NIST, or any U.S. government agency. Your solicitation, contract, subcontract, and contracting officer guidance control what applies to you.

If one of your primes just said “CMMC is coming” — or a new solicitation showed up with cybersecurity language you’ve never had to read before — here’s the two minutes to spend before you call a single vendor.

Here’s the part nobody tells you, and the reason this page exists: your CMMC cost is really your scope cost.Map where CUI actually enters and moves through your shop, and you can often wall it off — instead of dragging every CNC, every workstation, and every backup into the assessment boundary. Below, we’ll show you exactly which parts of a machine shop touch CUI, what you can keep out of scope, what it really costs, and who to talk to first.

We’re an independent trade publication on CMMC 2.0 and DIB compliance, and everything here is checked against the primary sources — the Federal Register, 32 CFR Part 170, the DFARS clauses, NIST, the DoD CIO’s CMMC materials, and the Cyber AB — and dated so you can verify it yourself.

Last reviewed June 2026

In short: a machine shop usually becomes a CMMC Level 2 problem the moment it receives, stores, processes, or transmits Controlled Unclassified Information — typically defense drawings, CAD/CAM files, or specifications. Shops touching only Federal Contract Information may need just Level 1, and shops handling no DoD FCI or CUI may not be in scope yet.

Find your likely path in one screen

Not sure which row is you? Our Find My CMMC Path tool asks a handful of questions about how your shop quotes, programs, and ships work — no file uploads, no CUI — and points you to your likely level and the right kind of help to call first.

Do machine shops need CMMC compliance?

CMMC stands for Cybersecurity Maturity Model Certification — the Department of Defense program that verifies contractors protect defense information. A machine shop needs it when a DoD contract, subcontract, or prime flow-down requires a CMMC status because the shop handles FCI or CUI. FCI-only work points to Level 1; work involving CUI usually points to Level 2, and the assessment type — self-assessment or third-party — is dictated by the solicitation or subcontract under 32 CFR Part 170.

Most shops don’t get a memo that says “you are now subject to CMMC.” They get a purchase order with a clause, or a portal that asks for an SPRS score, or a drawing with a marking in the corner they’ve never had to think about. The trigger is almost always upstream: a prime says flow-down is coming, or a solicitation arrives with CMMC and DFARS language.

You’re usually a subcontractor — and the requirement flows down to you

Here’s the rule most shops get wrong: you are typically a subcontractor, and CMMC flows down to you directly. The regulation is explicit. Under 32 CFR §170.23, CMMC applies to prime contractors and subcontractors at every tier that will process, store, or transmit FCI or CUI in performance of the work, and primes are required to flow it down. What you specifically owe depends on what you touch.

DCR Level Decision Card — subcontractor flow-down (32 CFR §170.23):

That answers a question we hear constantly — “the prime holds the DoD contract, so don’t they handle the compliance?” No. If they send you controlled data, you carry your own obligation.

What CMMC level does a machine shop need?

For machine shops, the practical decision is between Level 1, Level 2 (Self), and Level 2 (C3PAO). Level 1 covers FCI with 15 basic safeguarding requirements from FAR 52.204-21 and an annual self-assessment. Level 2 covers CUI with the 110 security requirements in NIST SP 800-171 Revision 2, organized into 14 control families, assessed either by self-assessment or by a C3PAO depending on the contract. Level 3 adds 24 selected requirements drawn from NIST SP 800-172 and is assessed by DIBCAC. Most precision and job shops will never see Level 3.

Already know your level? See our breakdown of CMMC Level 2 self-assessment vs. C3PAO so you know which path your contract is putting you on. Still not sure? Use the Find My CMMC Path tool to get to a starting point.

What counts as CUI in a machine shop?

In a machine-shop context, CUI most often appears as Controlled Technical Information (CTI) — technical information with military or space application that is subject to controls on access, use, or dissemination. DFARS 252.204-7012 lists examples including engineering drawings, specifications, standards, process sheets, manuals, technical reports, data sets, studies, and software code. A shop should still confirm markings, contract language, and customer direction before treating any file as CUI or not.

CUI is not a vibe. It’s a category the government defines and, ideally, marks. Don’t assume every document in your shop is CUI, and don’t assume none of it is. The disciplined move is to ask — in writing.

How to tell — look for these signals, in roughly this order of reliability:

• DFARS 252.204-7012 in the contract or PO.The strongest signal that covered defense information obligations are in play. It doesn’t automatically make every file in your shop CUI — you still confirm the specific package by its markings — but if 7012 is in your contract, treat CUI as part of the job until you’ve confirmed otherwise.
• A distribution statement on the drawing. Statement A is essentially public. Statements B through Fmean controlled — that’s your CUI flag.
• CUI markings— a banner and category marking (for example, “CUI//SP-CTI”) in the headers and footers.
• Contract attachments, CDRLs, or data-delivery and CUI-marking instructions — Contract Data Requirements Lists, delivery instructions, or written customer/contracting-officer direction that expressly identify CUI or the required CMMC level.
• Export-control language— “ITAR-controlled,” “export-controlled,” references to the U.S. Munitions List. This changes your cloud decision.
• A DD Form 254— a contract security classification specification. Treat this one as its own flag: if you get a DD 254, do a focused security review, because the contract carries specific security and handling requirements that go beyond an ordinary CUI marking.

What should a machine shop ask its prime before spending money?

Before you buy tools or hire a provider, ask the prime or customer to confirm in writing whether the RFQ package, drawings, generated CAM/G-code, inspection records, and outside-processor work are in scope, and exactly which CMMC level and assessment type are flowed down. Written answers reduce both over-scoping (building a six-figure environment you didn’t need) and under-scoping (mishandling marked data you didn’t realize you had).

This single step has saved shops more money than any tool purchase. Copy the template below.

Which machine-shop systems are actually in scope?

A system is in scope when it stores, processes, transmits, or protects CUI. The CMMC scoping rules at 32 CFR §170.19sort your environment into five categories — CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets, and Out-of-Scope Assets — so “the office network” is rarely the whole boundary.

The reason this taxonomy is your friend: the smaller your CUI footprint, the fewer assets carry the heavy requirements. That’s the whole game.

Now trace the data path: Customer portal / RFQ → estimating → CAD → CAM → controlled transfer → CNC → CMM/inspection → ERP/QMS → delivery package. How we built this matrix: we cross-checked the scoping categories in 32 CFR §170.19, the covered-defense-information and CTI definitions in DFARS 252.204-7012, the DoD/NARA CUI Registry, and the Cyber AB CMMC Assessment Process (CAP v2.0), then mapped them to a real machine-shop workflow.

The Machine-Shop CUI Pathway & CMMC Scope Matrix

Are your CNC machines in scope for CMMC?

CNC machines are not automatically all in scope. A CNC machine becomes a scope question when it stores, processes, transmits, or is reachable from systems that handle CUI — for example, when it receives a G-code program derived from a controlled drawing. Legacy controllers and embedded-Windows machines may be treated as Specialized Assets under 32 CFR §170.19, handled through segmentation, documentation, and access control rather than full control implementation on the machine itself.

Now the pivot, and it’s genuinely good news: scope is a design decision.You don’t have to turn every machine into a hardened endpoint. A controller that can’t be patched can be treated as a Specialized Asset — you segment it onto its own network, document it, restrict who and what can reach it, and keep CUI off it where you can. A controlled transfer station replaces the free-for-all USB habit. The CAM file stays inside the same walled pathway as the drawing it came from.

This is exactly what one Arizona manufacturer found. As documented in a NIST Manufacturing Extension Partnership (MEP) case study, embeddedTS initially believed it would have to “harden” its entire facility — a cost-prohibitive path. A structured gap assessment instead pinpointed where FCI and CUI actually lived, and the result was a streamlined, lower-cost plan that protected the data without rebuilding the whole company. That’s the difference between scoping and panicking.

Can a machine shop shrink CMMC scope with a CUI enclave?

Yes — if the enclave genuinely contains where CUI is stored, processed, transmitted, and protected. A CUI enclave is a separate, controlled environment that walls CUI off from the rest of the business, and it can reduce assessment scope and cost. But it only works if employees stop copying drawings, models, G-code, and inspection packages back into general email, ERP attachments, uncontrolled shares, USB drives, and shop-floor systems. An enclave reduces scope; it does not, by itself, satisfy all 110 Level 2 requirements.

The enclave strategy — practitioners call it “shrinking the box” — is the highest-leverage cost lever a small shop has. The fewer systems that ever touch CUI, the fewer systems an assessor has to evaluate, and the smaller your remediation bill.

A recent concrete example: JD Machine, a precision component manufacturer in Ogden, Utah, announced its CMMC Level 2 certification in January 2026. Per the company’s announcement, it met the 110 controls by keeping its existing Microsoft 365 tools and adding a FedRAMP-authorized data-security platform plus on-premises infrastructure — focusing on controlling the datarather than rebuilding everything. (One company’s publicly announced outcome, not a typical or guaranteed result — but a useful illustration of the strategy.)

What does CMMC Level 2 actually require for machine shops?

CMMC Level 2 maps to the 110 security requirements in NIST SP 800-171 Revision 2, organized into 14 control families. For machine shops, the demanding parts are usually identity and access control, media protection (including paper and shop-floor data), audit logging, configuration management, incident response, supplier flow-down, and producing evidence that controls actually work in the real shop environment — not just policies on paper.

A policy binder is not compliance. An assessor confirms that controls are implemented, through documentation, interviews, and testing.

The two artifacts everything hangs on are the System Security Plan (SSP)— your documented description of scope, systems, and how each requirement is met — and the POA&M— your plan to close any remaining gaps. If you build nothing else first, build these two. See our CMMC Level 2 requirements guide.

The DFARS clauses in your contract, decoded

Four DFARS clauses drive defense cybersecurity obligations, and they predate the CMMC clause. DFARS 252.204-7012 requires safeguarding covered defense information and cyber-incident reporting (effective 2016). DFARS 252.204-7019 and 252.204-7020 (both 2020) require a current NIST SP 800-171 self-assessment score posted in SPRS and give DoD assessment rights, with flow-down to subcontractors. DFARS 252.204-7021 is the CMMC requirement clause, effective November 10, 2025.

DCR Clause-to-Action Table:

The takeaway shops miss: even if the CMMC clause (7021) isn’t in your contract yet, the 7012/7019/7020 stack may already obligate you to a NIST SP 800-171 self-assessment and a posted SPRS score — that obligation has existed since November 2020. Many shops are non-compliant on requirements they already had. For more, see our guides to the SPRS score.

Do machine shops need GCC High, AWS GovCloud, or a CUI enclave?

No single platform is automatically required. If CUI touches a cloud service, the controlling requirement is FedRAMP Moderate authorization — or documented FedRAMP Moderate equivalency — for that service, plus your own configuration, customer responsibility matrix (CRM), and System Security Plan. In the Microsoft stack, GCC may support some CUI use cases when configured appropriately, while export-controlled CUI (such as ITAR data) typically drives GCC High, Azure Government, or an AWS GovCloud-style choice. No license, by itself, makes the shop compliant.

DCR Cloud Decision Evidence Block:

Don’t let a vendor sell you GCC High if all you have is standard CUI — it typically carries a meaningful licensing and migration premium over Commercial (often roughly 30–50% more per user per market estimates). But if your drawings are export-controlled, the U.S.-person access restriction usually points you to GCC High or GovCloud. Read our GCC High for CMMC breakdown and AWS GovCloud for CMMC, then get matched with a provider category before you commit to a license.

What does CMMC really cost a machine shop?

There is no single machine-shop CMMC price because scope drives cost — user count, CAD/CAM systems, CNC transfer paths, cloud tools, ERP exposure, legacy systems, current maturity, and assessment type all matter. DoD’s published rulemaking estimate for a small entity is $37,196 over three years for a Level 2 self-assessment and affirmation, and $104,670 over three years for a Level 2 certification assessment and affirmation. Those are assessment and affirmation burden estimates, not turnkey remediation prices.

DoD figures from the CMMC program rule’s Regulatory Impact Analysis; cover assessment and affirmation burden only — treat as a floor, not a turnkey quote. Market ranges compiled from published 2026 provider and industry cost analyses; directional planning figures, not quotes. Last verified June 9, 2026.

How long does CMMC take — and why November 10, 2026 is the deadline that matters

Plan on roughly 6 to 18 monthsfor Level 2 readiness, depending on starting maturity and scope. The date that matters for most shops is not Phase 1 — it’s Phase 2, which begins November 10, 2026, when CMMC Level 2 (C3PAO) certification becomes the standard for applicable contracts under 32 CFR §170.3(e). With a limited pool of authorized assessors and assessment lead times that industry reporting describes as months to more than a year, a shop starting today is cutting it close for Phase 2.

• Phase 1 (Nov. 10, 2025 – Nov. 9, 2026): Level 1 and Level 2 self-assessments appear as conditions of award. DoD can require Level 2 (C3PAO) on select contracts at its discretion.
• Phase 2 (begins Nov. 10, 2026):Level 2 (C3PAO) certification becomes the standard for applicable contracts. For contracts that require it, a self-assessment will not be enough — you’ll need a current Level 2 (C3PAO) status.
• Phase 3 (begins Nov. 10, 2027): Level 2 (C3PAO) extends to more contracts; Level 3 (DIBCAC) is introduced for high-priority programs.
• Phase 4 (begins Nov. 10, 2028): Full implementation across applicable contracts.

A realistic timeline by where you’re starting:

• 0–30 days: Gather clauses, map CUI, send the prime-clarification email, run an initial gap check.
• 30–90 days: Make the scope decision (enclave vs. broader remediation), draft the SSP, select tools/providers.
• 90–180 days: Remediate, collect evidence, train staff, sort out supplier flow-down.
• 180+ days: Assessment prep, C3PAO scheduling, POA&M closeout.

Which type of CMMC provider does a machine shop need?

Most machine shops should not start with a C3PAO unless they are already assessment-ready. The usual sequence is readiness and scoping first, then implementation or managed compliance, then evidence workflow, and only then a C3PAO if the contract requires Level 2 certification. This is where shops waste money: they call an assessor first, when they actually need a roadmap.

Your first 30 days: what to do before you spend a dollar

The first 30 days should not start with buying software. They should start with collecting clauses, identifying CUI, mapping where that data enters and moves through the shop, separating CUI from general systems where possible, and choosing the right provider category for your actual stage. Mapping before buying is what prevents both an over-built environment and a non-compliant one.

Work this list in order:

1. Gather the paperwork. Contracts, POs, RFQs, flow-down letters, CUI markings, and any SPRS requests. Put them in one place.
2. Identify who opens customer technical data. Estimators, programmers, quality — anyone who receives drawings.
3. Map the data path.RFQ → estimating → CAD/CAM → CNC transfer → inspection → shipment. Draw it.
4. Mark which systems store, process, or transmit CUI. Use the five §170.19 categories above.
5. Send the prime-clarification email (the template is above). Get answers in writing.
6. Decide your scope strategy— enclave, managed compliance, or broader remediation.
7. Build or refresh your SSP and asset inventory.
8. Run a gap assessment before you hire a C3PAO.
9. Create a supplier/outside-processor flow-down plan.
10. Set a 90-day remediation plan with owners and dates.

The biggest CMMC mistakes machine shops make

The most expensive machine-shop CMMC mistakes are under-scoping CUI (missing controlled drawings), over-scoping the whole business, buying tools before mapping data, treating CNC machines as either fully in scope or fully invisible, confusing readiness with certification, and hiring a C3PAO before evidence is ready. Inflating your SPRS score also carries real legal exposure under the False Claims Act.

• “We don’t have CUI”— said without ever checking the drawings, specs, or flow-down. Check first.
• Letting CUI sprawl through email, ERP attachments, and shared drives until the whole network is in scope.
• Treating CNC machines as all-in or all-out.Many are Specialized Assets — segment and document, don’t ignore.
• Mistaking a policy binder for implementation. Assessors test, interview, and ask for evidence.
• Hiring the assessor first. Readiness and remediation come before the C3PAO.
• Using a generic MSP with no CUI/CMMC experience. The shared-responsibility gaps surface during assessment.
• Sending CUI to outside processors without flow-down clarity.
• Pasting controlled drawings into public AI tools or unapproved quoting apps. That’s an uncontrolled transmission of CUI.

What if your shop only has one defense customer?

A single defense customer can still trigger full Level 2 obligations if the shop handles CUI, but the business decision is different. The right question isn’t only “what does CMMC require?” — it’s “is this defense revenue worth the scope, remediation, operating cost, and customer-concentration risk?” As the rules take effect, some small suppliers are reaching exactly that decision point.

If defense work is a small slice of your revenue and it brings full Level 2 (C3PAO) obligations, you have a real decision to make. Two honest paths:

What you should not do is freeze. Map your CUI, get a real scoped number, and decide with eyes open. See our CMMC cost for small defense contractors breakdown, then use a readiness match for a scoped estimate.

Public case studies: shops and manufacturers that documented a CMMC path

Small and mid-size shops are working through CMMC — typically with outside help and a tightly scoped CUI environment. These are individual, publicly reported outcomes — not typical or guaranteed results, and not all are completed certifications.

The common thread isn’t budget. It’s sequence: scope first, get the right help, wall off CUI, then assess.

CMMC compliance for machine shops: FAQ

Which provider category fits your situation

• RPO/RP (Registered Provider Organization / Registered Practitioner) — if you need to map where CUI enters your shop, scope CNC and specialized assets, and build readiness before any assessment.
• MSSP / MSP (Managed Security Service Provider)— if you need someone to run and sustain the IT and security controls a small shop can’t staff internally.
• CUI enclave— if you can wall off drawings, CAD/CAM, and specs so the whole floor isn’t dragged into scope.
• GRC platform— if you need to keep your SSP and control evidence in one system of record.
• C3PAO (Certified Third-Party Assessment Organization) — engage for a Level 2 (C3PAO) certification once you’re assessment-ready. You don’t need a C3PAO yet if you’re FCI-only, still scoping, or have only a Level 2 (Self) requirement.

Related guides

• CMMC Managed Enclaves: Scope Reduction Guide
• CMMC Compliance for Manufacturers
• CMMC for Engineering Firms
• CMMC Level 1 vs Level 2: Which One Applies?
• CMMC Level 2 Cost: What Small Contractors Actually Pay
• CMMC for Small Defense Contractors
• CMMC Gap Assessment: What to Expect
• CMMC External Service Provider Requirements
• GCC High for CMMC: When You Need It and When You Don’t
• The CMMC Phases and What They Mean for Your Contracts