Table of Contents
Most Cybersecurity Maturity Model Certification (CMMC) guidance quietly assumes your company runs on laptops, cloud apps, and an IT department.
Then there are manufacturing businesses with a plant full of CNC machines, a legacy enterprise resource planning (ERP) system, technical drawings shuttling between engineering and the shop floor, and a production schedule that doesn't pause for security projects.
Manufacturers make up a huge share of the defense supply chain, yet CMMC can land on them harder than almost anyone else. The requirements weren't written differently for factories, but factories have to satisfy them in environments no office-based contractor ever deals with.
This guide covers CMMC for manufacturing specifically: which level your shop likely needs, how to scope a plant so production equipment stays out of the assessment, the challenges unique to manufacturing environments, and a realistic path to readiness.
TL;DR
- CMMC applies to manufacturers the same as every DoD supplier, but factories carry unique burdens: operational technology, legacy systems, and production schedules that can't pause for security projects.
- Most defense manufacturers land at Level 2, because technical drawings and specifications with military application are controlled technical information, the most common form of CUI in a shop.
- Scoping is the biggest cost lever. CMMC's asset categories let properly separated production systems stay out of the assessment, while a CUI-contaminated ERP can drag the whole company in.
- The path runs from mapping where technical data flows, through deliberate segmentation and remediation planned around production, to documentation that matches how the shop actually works.
- MotherBear gives defense manufacturers and their consultants one place to track requirements, store evidence, and keep the SSP and affirmation records current while the plant keeps running.
Why CMMC Hits Manufacturing Differently
The program itself is simple to summarize: the Department of Defense (DoD) requires contractors handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) to prove their cybersecurity, at a level matched to the data, as a condition of winning and keeping DoD contracts.
Start with what manufacturers hold. Technical drawings, technical specifications, process instructions, and tooling data with military application are exactly the sensitive information adversaries target, because stealing a blueprint is cheaper than reverse-engineering a part.
That makes defense manufacturers a priority target for cyber attacks, and it makes most of them manufacturers handling CUI, whether the files arrive marked or get generated in-house during a job.
Then there's where that data lives. Manufacturing operations mix conventional IT with operational technology (OT).
Machine controllers, industrial equipment, test rigs, and legacy systems that predate modern security and can't simply be patched, agented, or replaced without threatening production.
An office contractor secures laptops. A manufacturer secures laptops plus a shop floor that was never meant to be on a network, and often is anyway.
Finally, there's who does the securing. Manufacturing has historically run lean on cybersecurity staff, since the business makes physical things and IT existed to keep machines connected, not to repel intrusions.
CMMC arrives in that culture with documentation-heavy cybersecurity standards, and the collision between the two is what the rest of this guide is about.
What CMMC Level Do Defense Manufacturers Need?
The CMMC model in its current form, CMMC 2.0, sorts the defense industrial base into three levels, and for manufacturing organizations the answer is almost always one of the first two.
Shops that touch only FCI, the contract-related information not intended for public release, sit at Level 1.
The compliance requirements are 15 basic practices drawn from the Federal Acquisition Regulation (FAR), verified through an annual self-assessment posted to the Supplier Performance Risk System (SPRS).
A machine shop that receives purchase orders and delivery schedules under a defense contract but never receives technical data often lives here.
The moment controlled technical information enters the workflow, and for most defense work it does, Level 2 applies.
That means the 110 security controls of NIST 800-171, the standard from the National Institute of Standards and Technology built to protect CUI, plus a System Security Plan (SSP) documenting the security environment, and for nearly all manufacturers, a CMMC audit by a third-party assessor every three years.
Export-controlled data and International Traffic in Arms Regulations (ITAR) material point the same direction: if your shop cuts, forms, coats, or assembles anything from a controlled drawing, plan for Level 2.
Two practical notes for manufacturers reading their situation.
First, don't wait for a solicitation to declare your level. The phased rollout of CMMC implementation is already placing requirements on new defense contracts.
Existing contracts pick them up as options renew, so the effective date that matters is your next award, not full implementation in 2028.
Second, when a prime contractor hasn't told you your level yet, the safest planning assumption for any shop handling drawings is Level 2, because that's where the flow-down almost always lands.
Scoping a Manufacturing Environment: What's In and What's Out
Scoping determines what an assessor examines, and in a factory it determines cost more than any other decision. The CMMC scoping rules sort every asset in your facility into categories, and the categories get very different treatment.
CUI Assets and Engineering Systems
Anything that processes, stores, or transmits CUI is fully in scope: the engineering systems holding drawings and CAD files, the file servers where job packets live, the workstations where programmers open technical data, and the email accounts through which it arrives.
These face the complete set of technical requirements and get assessed in full.
Security Protection Assets
The systems defending your CUI assets, like firewalls, backup platforms, the Security Information and Event Management (SIEM) platform if you run one, and identity systems, count as security protection assets.
They're in scope too, because a control is only as trustworthy as the machinery enforcing it.
Contractor Risk Managed Assets
Assets that could touch CUI but aren't intended to, and are managed by policy to prevent it, fall into the contractor risk managed assets category.
They get lighter treatment: documented in the SSP and reviewed rather than fully assessed, provided your policies genuinely hold.
Specialized Assets: Where Production Systems Land
The specialized assets category is where most production systems sit. It covers your operational technology, plus Internet of Things (IoT) devices, test equipment, and any government property in the facility.
The treatment is pragmatic: document them in the SSP and asset inventory, but they aren't assessed against every requirement, a concession to the reality that a machine controller can't run endpoint protection.
Out of Scope Assets
Anything that can't touch CUI, because it's physically or logically separated from CUI networks, is out of scope entirely. An air-gapped CNC machine or an assembly robot on an isolated network doesn't join your assessment.
This is why segmentation is the manufacturer's most powerful scoping tool: every machine you can honestly separate is one you don't have to secure, document, or defend.
One warning deserves its own paragraph: the ERP system. Load CUI into your ERP and the entire system, its hosting provider, and everyone with access can join your assessment scope.
Many shops keep CUI out of the ERP deliberately, storing job-related FCI there but routing drawings and technical data through a contained environment instead. Decide where CUI is allowed to live before it decides for you.
The Unique Challenges of CMMC in Manufacturing
Four problems show up in nearly every shop's compliance effort, and none of them trouble office-based contractors much.
Legacy Systems and Operational Technology
The machine controller running your five-axis mill may be on an operating system that stopped receiving patches a decade ago, and the vendor may void support if you install anything on it. OT wasn't built for modern cybersecurity practices, and it can't be retrofitted the way a laptop fleet can.
The workable answers are architectural: isolate what can't be secured, monitor the boundary around it, and document why. That's also why the specialized-asset and out-of-scope categories from the previous section matter so much.
Business Continuity vs Security Changes
In an office, a patch window is an inconvenience. On a production floor, downtime is measured in missed deliveries and contract performance risk.
Every security change, from patching to network segmentation to multi-factor authentication (MFA) rollouts, has to be planned around production schedules, which stretches remediation timelines and demands sequencing an office contractor never thinks about.
Assessors don't grade intentions, so the schedule pressure can't become a reason to skip the work, only to plan it earlier.
Tribal Knowledge vs Documented Practice
Many shops run on experience: the programmer knows how removable media moves between the office and the machines, the foreman knows who's allowed in the tool crib.
CMMC requires that knowledge written down as policies and procedures that match reality, because an assessor verifies documents against observed practice.
Strong security posture with weak documentation still fails. For shops that have been through ISO 9001, the discipline is familiar, and the quality-system muscle transfers better than most expect.
Third-Party Suppliers
A manufacturer's compliance doesn't end at its own walls. Heat treaters, platers, coating houses, and outside processors who receive drawings inherit the requirements along with the data, and your primes will eventually ask how you verify them, just as they verify you.
Shops that flow only the minimum necessary data to outside processors, or keep drawings in-house and send dimensioned instructions instead, shrink both their risk and their suppliers' burden.
A Manufacturer's Path to CMMC Readiness
CMMC readiness in a plant follows the same arc as anywhere else, but the order of operations matters more because scope decisions made early control every cost that follows.
Step #1: Map Where Technical Data Actually Flows
Trace a job from quote to shipment: where the drawing arrives, who opens it, which systems store it, how the program reaches the machine, what travels with the parts.
Most shops discover CUI in places nobody planned, like personal email forwards, USB sticks in machine programming, and shared workstations on the floor. You can't scope what you haven't mapped.
Step #2: Shrink the Boundary Deliberately
Before buying anything, pick the systems where CUI belongs and segment accordingly.
Many manufacturers consolidate technical data into a contained enclave, whether a separate network segment, a virtual desktop environment, or a secure room, keeping the rest of the plant out of scope. Every system excluded honestly is remediation you never pay for.
Step #3: Gap-Assess and Build Remediation Plans
Measure the scoped environment against the cybersecurity requirements your level demands, then turn the findings into remediation plans with owners and dates.
Sequence remediation efforts around production schedules, hardest and longest items first, since assessor calendars and machine downtime both need booking ahead.
Step #4: Document How Work Actually Happens
Write the SSP and policies to match the shop floor, not a template. How technicians get access to maintenance laptops, how removable media is controlled, and who approves a new device on the network.
An assessment checks whether the written procedure matches what a technician actually does, and mismatches fail shops with otherwise solid security standards.
Step #5: Complete Your Assessment and Keep It Current
Level 1 shops finish with self-assessments posted to SPRS. Most manufacturers need the certification path: a Certified Third-Party Assessment Organization (C3PAO) assessment, results in the DoD's systems, and a status held before contract award.
Then maintain it to ensure compliance holds between assessments, because drifting controls and stale documentation undo the investment quietly.
The shops that struggle least are the ones that treat CMMC compliance as a program with an owner, not a project with an end date.
CMMC as a Strategic Advantage
The compliance burden is real, but so is the arithmetic on the other side. Primes are pruning their supplier lists right now, and every shop that drops out of the defense industrial base for lack of a status leaves work on the table for the shops that stayed in.
Being CMMC-compliant early doesn't just preserve existing contracts. It positions a manufacturer to absorb the volume that noncompliant competitors can no longer bid on.
The signal travels beyond defense work, too.
A verified security posture reassures every customer whose drawings and designs pass through your systems, defense or not, and commercial primes are increasingly asking suppliers CMMC-shaped questions even on non-government work.
The same controls that protect CUI protect your own process knowledge and your customers' intellectual property.
There's also a compounding effect. Shops that build the documentation discipline, the scoped environment, and the maintenance habits once find each subsequent requirement cheaper: renewals, new frameworks, customer audits.
The first climb is the expensive one. After that, compliance becomes a capability the sales team can mention instead of a cost the operations team dreads.
Treat CMMC Compliance as a Program, Not a Project, With MotherBear
For a manufacturer, the hard part isn't any single control. It's keeping the whole program current while the plant keeps running: requirements tracked, the SSP matching the floor, evidence collected, affirmations filed on schedule.
MotherBear is CMMC compliance software that gives defense manufacturers and their consultants a central place to build and store everything:
- Requirement status
- Evidence
- SSP documentation
- Remediation tasks,
- Records that support annual affirmations, organized by the scope decisions you worked hard to get right.
The shops that pass assessments aren't the ones with the biggest security budgets. They're the ones whose proof is organized.
Book a demo and see how MotherBear keeps a manufacturing CMMC program in one place.
FAQs About CMMC for Manufacturing
Does CMMC apply to commercial items?
Contracts solely for commercial off-the-shelf (COTS) items are exempt from CMMC. The exemption is narrow: modify the product for the DoD, or handle FCI or CUI in the course of the work, and the requirements apply.
A shop selling catalog parts unchanged is out; a shop machining to a customer's controlled drawing is in.
Which companies need to be CMMC-certified?
Any company in the DoD supply chain whose systems touch FCI or CUI, at any tier: primes, subcontractors, machine shops, electronics fabricators, coating houses, and the service providers with access to their systems.
For manufacturers, handling controlled technical information, such as defense drawings, is the most common trigger, which points to Level 2.
What is a certificate of compliance in manufacturing?
A certificate of compliance (CoC) is a quality document attesting that delivered parts meet the purchase order's specifications.
It has nothing to do with CMMC, which is a cybersecurity status covering your information systems. A shop can issue flawless CoCs and still be ineligible for defense work without the required CMMC status, so the two shouldn't be confused when a prime asks for "compliance."
Is CMMC now required?
Yes. CMMC requirements began appearing in new DoD contracts in November 2025 and expand in phases through 2028, with existing contracts picking them up as options renew.
The practical trigger is your next solicitation or renewal, not the 2028 endpoint, so a shop handling defense drawings today should already be working toward its level.
