CMMC for Manufacturers: A Space Coast Shop Floor Guide

The Space Coast is a defense supply chain that a lot of people drive past without noticing. L3Harris has its headquarters in Melbourne. Northrop Grumman, Collins Aerospace, Embraer, Blue Origin and SpaceX all have a big presence here. Behind each of them sits a long tail of small manufacturers: machine shops, cable and harness houses, composite shops, coating and finishing operations, electronics assemblers. Many of them have twenty employees, one IT person (who is also the quality manager), and a stack of controlled drawings arriving from primes every week.

Most CMMC guidance is written for office environments: laptops, email, a file server, a cloud tenant. A manufacturer’s reality is different. You’ve got a shop floor full of machines that run old operating systems, can’t be patched, and weren’t designed with security in mind at all. This post is about how CMMC and NIST SP 800-171 handle that reality, and how to scope a shop so compliance doesn’t swallow the business.

Where things stand right now

A quick status check, because the program has moved a lot this year. In July 2026, DoD suspended Phase 2 of CMMC, and in September a class deviation directed contracting officers to remove third-party assessment requirements from solicitations and contracts. Self-assessments continue.

None of that changes your underlying obligation. If your contracts include DFARS 252.204-7012, you’re required to implement all 110 requirements in NIST SP 800-171 for any system that handles covered defense information, and that clause hasn’t been amended. Paragraph (m) requires your prime to flow it down to you, including on subcontracts for commercial products. If you’re receiving controlled drawings, you’re almost certainly under it already. I covered the clause in detail in DFARS 252.204-7012 in Plain English.

Your drawings are probably CUI

The first question for any manufacturer is what you’re actually protecting.

Most of what flows into a defense machine shop is Controlled Technical Information. The CUI Registry defines it as technical information with military or space application that’s subject to controls on access, use, reproduction, release or disclosure. A lot of it is also export controlled. Under ITAR, at 22 CFR 120.33, technical data includes information needed for the design, production, manufacture, assembly, testing or modification of defense articles, and specifically names blueprints, drawings, plans and instructions.

Look at where that information goes after it arrives. The drawing lands in an email inbox. Someone saves it to a shared drive. A programmer opens it in CAM software and generates a toolpath. The program gets moved to the machine, by network, USB stick or a DNC server. An inspector pulls up the drawing at the CMM. Every one of those stops is a place the controlled information lives.

My view, and you should confirm it with your prime, is that a CNC program generated from a controlled drawing should be handled as controlled too. It encodes the geometry and tolerances of the part. A regulation doesn’t name G-code specifically, but the logic of the technical data definition covers it, and an assessor is likely to see it that way.

The category that saves manufacturers: Specialized Assets

Here’s the part most shop owners don’t know about, and it’s the biggest relief in the CMMC rule for manufacturers.

The CMMC program rule, 32 CFR 170.19, sorts the assets in your assessment scope into categories. One of them is Specialized Assets, which covers operational technology, industrial IoT, test equipment, government-furnished equipment, and restricted information systems configured to government requirements. The rule defines operational technology as programmable systems or devices that interact with the physical environment, or manage devices that do. That describes a CNC mill, a PLC, a robot cell, a laser cutter, a CMM and a reflow oven.

For Level 2, Specialized Assets aren’t assessed against all 110 requirements. You have to do four things with them:

• List them in your asset inventory.
• Document how you handle them in your System Security Plan.
• Show them on the network diagram of your assessment scope.
• Manage them under your own risk-based policies, procedures and practices.

That’s it. The assessor reviews how the SSP treats them, and doesn’t test them against the other CMMC requirements.

That’s why the Windows 7 controller on your 2009 machining center isn’t automatically a compliance failure. It can’t run modern endpoint protection or take current patches, and the rule recognizes that. What it can’t be is invisible. If it’s not in your inventory, your SSP and your diagram, you’ve got a problem, and if it’s sitting on the same flat network as your office PCs, you’ve got a bigger one.

How I’d scope a small shop

The goal is to make the part of your business that touches CUI as small and well-defined as you can, and to build walls around the machines that can’t defend themselves.

Build a CUI enclave for the office side. Drawings, CAM work and anything else that holds controlled information should live in a defined environment, often a compliant cloud tenant plus a small number of managed workstations. Everyone else, including the front office and accounting, stays outside it. I explained why scoping decides your CMMC budget in an earlier post.

Segment the shop floor. Put the machines on their own network segment, with firewall rules that allow only the specific traffic they need, usually the DNC server or file-transfer path from the CAM workstation. No email, no web browsing, no route to the internet from a machine controller.

Control the transfer path. Decide exactly how programs get to the machines and document it. A dedicated DNC server inside the segment is better than USB sticks. If you must use removable media, use dedicated, inventoried drives that never leave the building, and write that down.

Handle remote vendor access deliberately. Machine builders often want remote access for diagnostics. That connection is a doorway into your shop floor. Keep it turned off by default, enable it for specific sessions, and log who used it.

Write it all into the SSP. For each Specialized Asset class, say what it is, where it sits on the network, what CUI it touches, and how you’re managing the risk. An assessor will forgive old equipment. They won’t forgive old equipment you didn’t know you had.

Don’t skip the boring IT basics

Segmenting the shop floor doesn’t excuse the rest of your environment. The workstations, servers, cloud services and people inside the CUI enclave are assessed against all 110 requirements. In small manufacturers the common gaps are the dull ones: shared logins on shop workstations, no multifactor authentication on email, no audit logging, no written incident response plan, and nobody who can say what’s in the asset inventory because there isn’t one.

There’s also a real legal risk to ignoring this. In December 2025, an Illinois precision machining company that worked as a subcontractor paid $421,234 to settle False Claims Act allegations that it received controlled drawings from its primes without meeting NIST 800-171. A whistleblower brought the case. I covered the enforcement side in The False Claims Act Exposure in Your SPRS Score.

Questions to ask your prime

Your prime knows things about the work that change your scope, and many small shops never ask. A few questions worth sending to your buyer or the prime’s supplier security contact:

• Which of the drawings and specifications you send us are CUI, and which categories?
• Are any of them export controlled under ITAR or EAR?
• What SPRS score or assessment status do you need from us, and by when?
• Do you have a secure file transfer method you’d prefer we use?
• What’s your process if we have a cyber incident involving your data?

Get the answers in writing. They help you scope correctly, and they’re useful evidence that you took your obligations seriously.

Free help that most shops don’t use

Manufacturers have resources office-based contractors don’t.

NIST SP 800-82 is the federal guide to operational technology security. Revision 3 was published in September 2023. NIST released the initial public draft of Revision 4 on 21 September 2026, with comments open through 30 November. If you run a shop floor and have opinions about what’s practical, this is a rare chance to tell NIST directly.

NIST IR 8183 is the Cybersecurity Framework Manufacturing Profile. Revision 2, updated for CSF 2.0, is still in draft, but it’s a useful way to think about security in terms of production goals rather than IT checklists.

FloridaMakes is Florida’s Manufacturing Extension Partnership center, part of the NIST MEP network, and it runs a cybersecurity training program aimed at small and mid-sized defense contractors. NIST MEP also has a cybersecurity resource page for manufacturers. These programs exist for exactly the size of company that can’t afford a full-time security staff.

Where to begin

If you’re a Space Coast shop with controlled drawings coming in and no plan yet, start here:

• Walk the shop floor and inventory every networked machine, controller and computer.
• Draw the network as it actually is, not as you wish it were.
• Trace where one controlled drawing goes from the moment it arrives to the moment the part ships.
• Decide where your CUI boundary should be, and what has to move to get there.
• Write it down in an SSP, including the Specialized Assets.

The primes around here aren’t going to stop sending drawings, and the requirements aren’t going away while CMMC gets sorted out. A shop that can show a clean, well-scoped environment is a shop that keeps winning the work.

---

Where to go next

• See where your shop stands with the CMMC readiness quiz. It takes about five minutes.
• Our CMMC guide for small contractors walks through scoping from the beginning.
• Need an SSP to document all of this? Start with our CMMC packets.
• Pricing is published, including the free Level 1 tier. See the pricing page.