Level 1 or Level 2: Read Your Contract, Not the Rumor
Your level is driven by the data in the contract, not your company size. 204-21 safeguards each year. If drawings, specifications or technical data arrive marked CUI, often alongside ITAR or EAR controls, you need Level 2.
The solicitation or the DFARS clause set will state the required level, and your prime will usually flow down the same requirement. Ask your prime's contracts or supplier-quality contact directly which level applies to each part number family before you spend a dollar on tooling.
- Level 1: 15 safeguards, annual self-assessment, senior official affirmation
- Level 2: 110 NIST SP 800-171 Rev 2 practices, self-assessment for some contracts, C3PAO assessment for most CUI work
- Level 3 is for the most sensitive programs and is rare for small subcontractors
Where the 110 Practices Hit a Shop Floor
The 110 practices sit in 14 families: access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity. On a shop floor the sharp edges are CNC controllers and CMMs with shared logins, USB sticks carrying G-code and models, wireless programming laptops, and vendors with remote access for machine service. Each one either gets brought inside the boundary with proper controls or gets walled off from CUI entirely.
Walling off is cheaper for a small shop, and it is the heart of scoping.
Scoping: Shrink the Boundary Before You Build It
A CUI enclave is a defined set of systems, people and spaces where CUI is allowed to live. Everything outside it never touches CUI. For a small manufacturer that often means a handful of engineering and quality workstations, a file server or hosted enclave for controlled drawings, and a small number of CNC machines that receive programs through a controlled transfer path.
Your general office network, email for the sales team and most accounting systems stay out. The trade-off is operational friction: people must move controlled files through the enclave and not around it. Document that flow in your System Security Plan, then train people on why shortcuts become findings.
- List every system that stores, processes or transmits CUI, including backups
- Separate CUI machines on their own VLAN and limit remote access
- Decide whether ERP attachments, routers and travelers carry CUI and place them accordingly
Try it here, free
CMMC Level 2 Remediation Budget Calculator
Turn a gap count and CUI headcount into a first-year CMMC Level 2 budget, with a sweep showing how cost scales with the number of CUI users.
SSP, POA&M and the Evidence Assessors Ask For
Assessors look for three things: a System Security Plan describing how each practice is met, a Plan of Action and Milestones for gaps, and evidence the controls actually run. 0 a POA&M is allowed only for a limited set of lower-weighted practices, and you must close open items within a defined window after the assessment. Evidence is usually screenshots, configuration exports, access lists, training records, log samples, and signed policies.
Small shops often fail on evidence, not on technology: the control exists but nobody can show last quarter's access review. Assign each practice an owner and a recurring calendar entry that produces one artifact.
When a Full Level 2 Build Is Not Worth It
If a shop gets one or two CUI contracts a year worth less than the cost of an enclave and assessment, pursuing Level 2 itself can be the wrong call. Options include working through a prime or a partner that holds a compliant environment, limiting your scope to operations where the drawing is supplied only at the machine, or declining CUI work and focusing on commercial jobs. Government and MEP center programs, including the NIST MEP network, offer cost-shared assessment help for small manufacturers.
Do the math with real contract revenue and a realistic three-year cost of ownership, because compliance is an ongoing operating cost, not a one-time project.
Frequently asked questions
Does a 10-person machine shop need CMMC Level 2?
Only if its contracts involve CUI. Company size does not change the requirement. A shop making parts from drawings marked CUI or export-controlled for a defense prime usually needs Level 2, while a shop handling only purchase orders and non-controlled drawings may need only Level 1. Confirm with each prime, because requirements flow down by contract.
How long does CMMC Level 2 preparation take for a small manufacturer?
Shops starting with little documentation commonly plan for six to eighteen months, depending on scoping, IT maturity and assessor availability. The biggest time sinks are writing the System Security Plan, collecting evidence and fixing identity and logging gaps. Narrow scoping shortens the effort considerably.
Can a manufacturer use cloud services for CUI under CMMC?
Yes, but external cloud providers that store, process or transmit CUI must meet FedRAMP Moderate or equivalent requirements, and you need a clear responsibility matrix from the provider. Many small shops use a government-community cloud enclave or keep CUI on-premises to simplify the boundary.
If CUI handling is pushing you toward AI-free, spreadsheet-heavy quoting and planning, talk to Netray about on-prem AI that runs inside the same boundary you are already building.