Do You Actually Handle CUI?
Start with your contracts and purchase orders. 204-7021 clauses, and check whether drawings carry CUI or distribution statement markings. If you machine parts from prints your customer marks as controlled, you handle CUI.
If you make commercial parts and receive only publicly releasable data, you may only hold Federal Contract Information, which has a lighter bar. Ask your primes in writing what data they consider CUI on each program, because assumptions here are expensive in both directions.
- DFARS 252.204-7012 in the PO or contract flow-downs
- Drawings with CUI or distribution statement markings
- Whether the prime requires a CMMC level in the solicitation
- Federal Contract Information versus CUI, which differ in scope
Scope Decisions That Control Cost
Assessment scope covers systems that store, process or transmit CUI, plus the security protection assets around them. A small shop can often reduce scope by keeping CUI drawings in one controlled location, limiting who can access them, and moving program files to CAM machines inside the boundary. The shop floor is the hard part: if operators view drawings on terminals, or CNC controls pull programs from a shared server, those paths come into scope.
Decide deliberately what is in the enclave rather than discovering it during assessment.
Typical Gaps in Machine Shops
Common findings are shared logins at floor terminals, no multi-factor authentication for remote access, email that carries drawings without approved handling, USB drives moving programs between CAM and machines, no documented system security plan or incident response plan, and no record of who has access. Your ERP matters too: if quotes and job travelers contain CUI, the ERP and its backups are in scope. Address access control, audit logging, media handling and a written plan first, since those are visible quickly to an assessor.
Try it here, free
DFARS 252.204-7012 Compliance Self-Assessment
A 10-question self-assessment covering the full DFARS 7012 clause: NIST 800-171 implementation, SPRS, incident reporting, cloud requirements, and flowdown.
How AI Tools Fit the Boundary
Any AI tool that reads CUI drawings or ERP records with CUI is part of the scope, which makes consumer chatbots and general cloud AI services a problem unless they are authorized for CUI and flow down correctly. A private AI running open-weight models on your own hardware, inside the same boundary and with logged access, avoids sending data out. Netray builds that kind of deployment, but certification remains your responsibility, and the AI is one more system to include in your system security plan.
When to Hire Help and When to Wait
A shop with a CUI contract in hand or a prime asking for evidence should start now, as remediation takes months. A shop with no defense work and no plans for it can wait and spend nothing. Many Manufacturing Extension Partnership centers offer CMMC readiness support at modest cost, and Registered Practitioners can perform gap assessments.
Start with a gap assessment against NIST 800-171 and a scope diagram, then decide whether an enclave or a broader remediation makes sense.
Frequently asked questions
Does my small machine shop need CMMC Level 2?
If you handle CUI under a Department of Defense contract, usually yes, to the extent your contract specifies. If you only receive publicly releasable drawings, a lower level may apply. Check your contract clauses and ask your prime in writing what they consider CUI. A qualified assessor can confirm.
How much does CMMC cost a small machine shop?
It varies widely with scope, existing IT maturity and whether you build an enclave. Costs include remediation, tools, documentation, and assessment fees. Narrowing scope is the largest lever. Request a gap assessment first, then price remediation against it. Avoid estimates that do not reflect your actual systems.
Can I use ChatGPT or cloud AI with CUI drawings?
Only if the service is authorized to handle CUI and meets the required safeguarding and flow-down requirements. Most consumer AI tools are not. Safer options are AI that runs on your own infrastructure inside your assessed boundary. Confirm with your compliance advisor before putting any controlled data into an AI tool.
If you want AI over your ERP and drawings without expanding your CUI scope, we can describe an on-prem design for your assessor to review. Bring your scope diagram and we will fit it in.