# CMMC 2.0 for Small Manufacturers > Source: https://netray.co/resources/cmmc-2-0-for-small-manufacturers > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Knowledge Base ## Short answer CMMC 2.0 for small manufacturers explained: Level 1 vs Level 2, the 110 NIST SP 800-171 practices, scoping your shop floor, and where ERP and CAD data fit. ## Category ai-automation ## Content **Intro:** CMMC 2.0 for small manufacturers comes down to one question: does your contract involve Federal Contract Information only (Level 1, 15 basic safeguarding requirements, annual self-assessment) or Controlled Unclassified Information such as export-controlled drawings (Level 2, the 110 practices of NIST SP 800-171, with a third-party C3PAO assessment for most CUI contracts)? Most machine shops and fabricators that cut parts from prime-supplied drawings land in Level 2. The expensive part is rarely the paperwork. It is deciding where CUI lives in your shop and shrinking that footprint. **Sections:** #### Level 1 or Level 2: Read Your Contract, Not the Rumor **Body:** Your level is driven by the data in the contract, not your company size. If you only receive and generate Federal Contract Information (purchase orders, pricing, delivery schedules not marked as CUI), Level 1 applies and you affirm the 15 FAR 52.204-21 safeguards each year. If drawings, specifications or technical data arrive marked CUI, often alongside ITAR or EAR controls, you need Level 2. The solicitation or the DFARS clause set will state the required level, and your prime will usually flow down the same requirement. Ask your prime's contracts or supplier-quality contact directly which level applies to each part number family before you spend a dollar on tooling. **Bullets:** - Level 1: 15 safeguards, annual self-assessment, senior official affirmation - Level 2: 110 NIST SP 800-171 Rev 2 practices, self-assessment for some contracts, C3PAO assessment for most CUI work - Level 3 is for the most sensitive programs and is rare for small subcontractors #### Where the 110 Practices Hit a Shop Floor **Body:** The 110 practices sit in 14 families: access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity. On a shop floor the sharp edges are CNC controllers and CMMs with shared logins, USB sticks carrying G-code and models, wireless programming laptops, and vendors with remote access for machine service. Each one either gets brought inside the boundary with proper controls or gets walled off from CUI entirely. Walling off is cheaper for a small shop, and it is the heart of scoping. #### Scoping: Shrink the Boundary Before You Build It **Body:** A CUI enclave is a defined set of systems, people and spaces where CUI is allowed to live. Everything outside it never touches CUI. For a small manufacturer that often means a handful of engineering and quality workstations, a file server or hosted enclave for controlled drawings, and a small number of CNC machines that receive programs through a controlled transfer path. Your general office network, email for the sales team and most accounting systems stay out. The trade-off is operational friction: people must move controlled files through the enclave and not around it. Document that flow in your System Security Plan, then train people on why shortcuts become findings. **Bullets:** - List every system that stores, processes or transmits CUI, including backups - Separate CUI machines on their own VLAN and limit remote access - Decide whether ERP attachments, routers and travelers carry CUI and place them accordingly #### SSP, POA&M and the Evidence Assessors Ask For **Body:** Assessors look for three things: a System Security Plan describing how each practice is met, a Plan of Action and Milestones for gaps, and evidence the controls actually run. Under CMMC 2.0 a POA&M is allowed only for a limited set of lower-weighted practices, and you must close open items within a defined window after the assessment. Evidence is usually screenshots, configuration exports, access lists, training records, log samples, and signed policies. Small shops often fail on evidence, not on technology: the control exists but nobody can show last quarter's access review. Assign each practice an owner and a recurring calendar entry that produces one artifact. #### When a Full Level 2 Build Is Not Worth It **Body:** If a shop gets one or two CUI contracts a year worth less than the cost of an enclave and assessment, pursuing Level 2 itself can be the wrong call. Options include working through a prime or a partner that holds a compliant environment, limiting your scope to operations where the drawing is supplied only at the machine, or declining CUI work and focusing on commercial jobs. Government and MEP center programs, including the NIST MEP network, offer cost-shared assessment help for small manufacturers. Do the math with real contract revenue and a realistic three-year cost of ownership, because compliance is an ongoing operating cost, not a one-time project. **Cta:** If CUI handling is pushing you toward AI-free, spreadsheet-heavy quoting and planning, talk to Netray about on-prem AI that runs inside the same boundary you are already building. **Faq:** #### Does a 10-person machine shop need CMMC Level 2? **Answer:** Only if its contracts involve CUI. Company size does not change the requirement. A shop making parts from drawings marked CUI or export-controlled for a defense prime usually needs Level 2, while a shop handling only purchase orders and non-controlled drawings may need only Level 1. Confirm with each prime, because requirements flow down by contract. #### How long does CMMC Level 2 preparation take for a small manufacturer? **Answer:** Shops starting with little documentation commonly plan for six to eighteen months, depending on scoping, IT maturity and assessor availability. The biggest time sinks are writing the System Security Plan, collecting evidence and fixing identity and logging gaps. Narrow scoping shortens the effort considerably. #### Can a manufacturer use cloud services for CUI under CMMC? **Answer:** Yes, but external cloud providers that store, process or transmit CUI must meet FedRAMP Moderate or equivalent requirements, and you need a clear responsibility matrix from the provider. Many small shops use a government-community cloud enclave or keep CUI on-premises to simplify the boundary. ## Related Slugs - cmmc-compliant-ai-deployment - cui-enclave-architecture-defense - defense-manufacturing-compliance - itar-cmmc-ai-workloads-guide - on-prem-ai-defense-contractors ## Search terms CMMC 2.0 for small manufacturers, CMMC level 2 machine shop, CMMC compliance small business manufacturing, NIST 800-171 for machine shops, do I need CMMC, CMMC level 1 vs level 2, CMMC scoping manufacturing --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json