# CMMC Level 2 for Small Screw Machine and Swiss Turned-Parts Shops

> Source: https://netray.co/resources/cmmc-level-2-for-small-screw-machine-shops
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Knowledge Base

## Short answer

CMMC Level 2 for small screw machine and Swiss shops: when you need it, what CUI means for drawings, scoping an enclave, and realistic first steps and costs.

## Category

ai-automation

## Content

**Intro:** A small screw machine or Swiss shop needs CMMC Level 2 when its defense contracts or subcontracts involve Controlled Unclassified Information, such as export-controlled or distribution-restricted drawings, and Level 1 when it handles only Federal Contract Information. Level 2 maps to the 110 practices in NIST SP 800-171. The decisive question is scope: if CUI lives on a small, well-defined set of systems, compliance is far more manageable than securing every PC in the building. This guide covers how to determine whether you handle CUI, how to scope, and where AI tools must be kept inside that boundary.

**Sections:**

#### Do You Actually Handle CUI?

**Body:** Start with your contracts and purchase orders. DFARS clause 252.204-7012 and the newer 252.204-7021 flow down through primes to subcontractors, and a drawing marked with a distribution statement, export control warning or CUI marking is a strong signal. Many turned-parts shops receive only simple commercial prints for commodity fasteners or fittings, which may be FCI rather than CUI. Ask your customer in writing whether the technical data you receive is CUI. Do not assume, because both over-scoping and under-scoping are expensive mistakes. The prime is responsible for marking, and you are responsible for protecting what is marked.

#### Scope Small: Enclaves and Segregation

**Body:** The cheapest compliance path for a small shop usually isolates CUI into a defined environment rather than assessing the entire network. That might be a small number of workstations and a file store used only for controlled jobs, possibly a managed enclave from a service provider, with the shop floor handling only the data it needs. Machine programs derived from controlled drawings are often themselves in scope, so CNC controllers and program transfer methods matter. Map where CUI enters, where it is stored, who touches it and how it leaves. The map becomes your system security plan.

**Bullets:**

- Identify every system that stores, processes or transmits CUI, including CAM and machine controls
- Restrict access by role and require multi-factor authentication
- Control removable media and program transfer to machines
- Keep logs, backups and incident response procedures documented
- Include email and any cloud service holding controlled files in scope or exclude them deliberately

#### What Level 2 Assessment Looks Like

**Body:** CMMC 2.0 uses a tiered model, with Level 2 requiring either a self-assessment or a third-party assessment by a certified assessment organization, depending on the contract's sensitivity. Rule-making and phase-in under 32 CFR Part 170 and the DFARS clause mean timelines are staged, so check current requirements and your prime's expectations. Typical effort includes a gap assessment against the 110 practices, remediation, a system security plan, a plan of action for allowed gaps, and evidence collection. Costs vary greatly with scope and starting posture, and Manufacturing Extension Partnership centers can help small manufacturers with scoping and planning.

#### Keeping AI and ERP Tools Inside the Boundary

**Body:** Any tool that touches CUI inherits the compliance burden. Uploading controlled drawings to a public AI chatbot or a general cloud service that is not authorized for CUI can create a violation. If you want AI for quoting or document search on controlled work, deploy it where the data already lives, on your own hardware or in an environment authorized for CUI, with access controls and audit logs. Your ERP should be reviewed the same way: if quotes and travelers contain CUI, the ERP is in scope, which influences hosting choices. Netray's role is architecture that lets you meet your obligations, not certification of your shop.

#### When You Can Skip the Heavy Lift

**Body:** If you handle no CUI, you do not need Level 2, and the right move is to document that determination, keep basic cyber hygiene and meet FCI safeguarding. If defense work is a small slice of revenue, some shops decide to decline CUI-bearing work rather than fund compliance; others quote for it with the compliance cost built in. Make the choice deliberately, by customer and by revenue, because primes increasingly check supplier readiness before awarding work, and discovering the requirement after a PO arrives leaves little time.

**Cta:** If you want AI on controlled drawings, Netray can design a deployment that stays inside your CUI boundary so you can meet your own CMMC obligations.

**Faq:**

#### Does my small machine shop need CMMC?

**Answer:** If you perform work under DoD contracts or subcontracts that flow down DFARS cyber clauses, yes, at a level matching the information you handle. FCI generally maps to Level 1; CUI generally maps to Level 2. Ask your prime in writing which applies.

#### What is the difference between FCI and CUI for a machine shop?

**Answer:** FCI is non-public information provided under a government contract, such as contract terms. CUI is more sensitive information the government designates for safeguarding, which can include export-controlled technical drawings. CUI triggers the NIST SP 800-171 practices of Level 2.

#### How much does CMMC Level 2 cost a small shop?

**Answer:** It varies widely with scope, existing security posture and whether an assessment by a third party is required. Narrow scoping into an enclave usually reduces cost significantly. Get a gap assessment first, and ask your state MEP center what assistance is available.

## Related Slugs

- cmmc-compliant-ai-deployment
- itar-cmmc-ai-workloads-guide
- itar-compliant-ai-tools-manufacturing
- cost-accounting-standards-defense

## Search terms

CMMC level 2 small machine shop, CMMC requirements for subcontractors, CUI machine shop drawings, DFARS 252.204-7012 small manufacturer, NIST 800-171 machine shop, CMMC enclave small business

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json