Get ready for CMMC and NIST 800-171, explained in plain English

CMMC, the Cybersecurity Maturity Model Certification, is the Defense Department’s program for verifying that contractors protect federal contract information and controlled unclassified information. It doesn’t so much create new security rules as check that the existing ones are actually in place, using three levels tied to the kind of data you handle. The program rule took effect in December 2024, and CMMC requirements began appearing in defense contracts on November 10, 2025.

Where CMMC stands today

NIST SP 800-171 is the list of 110 security requirements for protecting controlled unclassified information. DFARS 252.204-7012 has required defense contractors handling CUI to follow it for years, largely on the honor system. CMMC is the verification layer on top: it sets how compliance is assessed and reported. If you meet NIST SP 800-171 Revision 2, you’ve met the substance of CMMC Level 2.

How we help

Level 1 covers federal contract information: 15 basic safeguarding requirements, self-assessed every year. Level 2 covers controlled unclassified information: the 110 requirements of NIST SP 800-171 Revision 2, assessed every three years either by your company or by an accredited third-party assessor, depending on the contract, with an annual affirmation. Level 3 adds 24 requirements from NIST SP 800-172 for the most sensitive programs and is assessed by the government.

See the levels

Federal contract information is information the government provides or generates under a contract that isn’t meant for public release, like contract details and delivery schedules. Controlled unclassified information is more sensitive information that must be safeguarded, such as certain technical drawings, specifications and export-controlled data. FCI points to Level 1 and CUI points to Level 2. CUI should be marked by the government or your customer; if you’re not sure what you have, ask before you assume.

Does CMMC apply to you?

Yes, when they handle FCI or CUI for a defense contract. DFARS 252.204-7021 requires primes to flow CMMC requirements down to subcontractors at the level that matches the information the subcontractor will handle. That means a machine shop or component supplier several tiers down can need Level 2 for the parts of the work that involve CUI.

Talk to us about your contracts

Not directly, because CMMC is a Defense Department program. But many commercial customers now ask suppliers about the same kinds of controls in their own security questionnaires, and cyber insurance carriers ask about many of them too. The work that prepares you for NIST SP 800-171 pays off either way.

Manufacturing IT support

Yes. The pause covers Phase 2, the step that would have made third-party certification a condition of award starting November 10, 2026. Phase 1 continues: applicable contracts can still require Level 1 or Level 2 self-assessments, and during the pause those are the only CMMC levels new contracts can require. The Defense Department’s review closed in September 2026, and as of early October its recommendations hadn’t been published and no new date had been set.

Where CMMC stands today

Quite a bit. If your contract includes DFARS 252.204-7012, you must protect CUI under NIST SP 800-171 and report cyber incidents within 72 hours. Contracts with DFARS 252.204-7019 require a current NIST SP 800-171 assessment score in SPRS. Contracts with CMMC requirements need the specified self-assessment and an annual affirmation. And primes can still set their own requirements for suppliers.

How we help

SPRS, the Supplier Performance Risk System, is where defense contractors post their NIST SP 800-171 assessment scores and CMMC status. If your contracts include DFARS 252.204-7019 or CMMC requirements, you need a current score there. Scores run from 110, with every requirement met, down into negative numbers for missing requirements, so an honest score with a plan to improve it beats an inflated one.

SPRS score support

Real. A self-assessment score and an annual affirmation are statements to the government, and the Justice Department uses the False Claims Act to pursue contractors who misrepresent their cybersecurity. In September 2026, a major aerospace supplier agreed to a $2 million settlement over alleged NIST SP 800-171 failures. The safest position is an accurate score, a documented plan to close gaps, and proof that the plan is moving.

Talk to us about readiness

Yes. The pause moved a deadline, not the security requirements. Your contracts still require NIST SP 800-171 where CUI is involved, primes are still asking, and when third-party assessments return, the companies that kept going will be ready first. Use the time to scope your controlled data, close the biggest gaps and get your documentation in order.

How working with us starts

Revision 3, published in May 2024, is the current NIST edition and reorganizes the requirements. But CMMC and defense contracts still use the 110 requirements in Revision 2, and the Defense Department hasn’t announced when that will change. Build your program to Revision 2 today, and we’ll help you map it to Revision 3 when it’s required.

How we help

It depends on where you start and how big your scope is. A company with modern Microsoft 365, multi-factor authentication and solid backups may need a few months to close gaps and finish its documentation. A company starting from scratch, or with controlled data spread across many systems, usually needs considerably longer. A readiness assessment gives you a realistic timeline before you commit to a date with a customer.

How working with us starts

The system security plan, or SSP, describes your environment and explains how each NIST SP 800-171 requirement is met. The plan of action and milestones, or POA&M, lists every requirement that isn’t fully met, who owns it and when it will be fixed. Both are required under NIST SP 800-171, and they’re the first documents a prime or an assessor will ask to see.

How we help

Follow the data. Start with the contracts and purchase orders that involve CUI, then trace where those drawings, specs and files go: email, file shares, the ERP, engineering workstations, machine programs, removable media and the suppliers you send them to. Most companies find CUI in more places than they expected, and also find it can be pulled back into far fewer.

Talk to us about scoping

Usually, and it’s often the smartest move. Instead of bringing your whole company up to NIST SP 800-171, you can keep controlled data in a separate, tightly controlled environment, such as Microsoft 365 GCC High or an isolated enclave, and limit it to the people and systems that need it. A smaller scope means fewer systems to secure, document and assess. We set up these environments for clients regularly.

How we help

They can, if they store or process CUI, like programs built from controlled drawings, or if they connect to systems that do. CMMC treats this kind of operational technology as a specialized asset: it has to be documented in your inventory and security plan and protected, though it isn’t held to every requirement. The usual approach is to put production equipment on its own network segment and control how files reach the machines. We help integrate equipment like CNC machines securely as part of readiness work.

How we connect production equipment

It depends on your scope, your starting point and how much of the work your team can take on. The biggest drivers are how many people and systems handle controlled data, whether you need a separate environment like GCC High, how many gaps the assessment finds, and whether you’re preparing for a self-assessment or a third-party assessment. We scope readiness as a project or compliance add-on, with every cost explained up front.

Talk to us about readiness

We find where controlled data lives, run a gap assessment against NIST SP 800-171, build your system security plan and plan of action, support your SPRS score, close the gaps, set up separate environments like Microsoft 365 GCC High or an isolated enclave when they make sense, provide policy and procedure templates, and keep you ready with ongoing monitoring and support during assessments.

How we help

No. Level 2 certification assessments are performed by accredited third-party assessment organizations, and Level 3 assessments by the government. We get you ready for those assessments, or for your own self-assessment, and keep you ready afterward. Keeping the people who prepare you separate from the people who assess you protects you.

Talk to us about readiness

Yes. We’ve helped numerous manufacturers, large and small, that supply defense primes get ready for NIST SP 800-171 and CMMC. Our CEO, Adam Crossley, worked at Sikorsky on the Navy Seahawk program before entering IT, so we understand the contracts, the flow-downs and the shop floor.

Manufacturing IT support

Yes. Readiness work can be scoped as a project on its own, alongside your internal IT team or another provider. Your IT person stays your front line while we handle the compliance-heavy pieces and the documentation, and co-managed arrangements are common.

How co-managed IT works

Yes. We help you read the clauses in your contracts and purchase orders, figure out what level and evidence your customer actually expects, and answer questionnaires honestly with proof behind every yes. Where the honest answer is no, we help you show a plan with dates.

Talk to us about your contracts

From our offices in Franklin, MA and Belmont, NC, we support defense suppliers across Eastern Massachusetts, Rhode Island and the Charlotte, NC area, including York County, South Carolina. Much of the documentation and review work can be done remotely, and onsite visits cover network closets, plant floors and assessment days.

Manufacturing IT in Massachusetts and Rhode IslandManufacturing IT in the Charlotte, NC area