Defense suppliers
CMMC Compliance IT for Defense Suppliers
Machine shops, engineering firms, and suppliers that work on defense contracts face CMMC requirements. We help with the IT side of CMMC compliance: scoping, controls, and documentation.
Our job is to help you get the technical controls in place and documented before an assessment.
- Serving Los Angeles
- Business IT since 1998
- Remote first, on-site when needed
The program
What CMMC compliance means for small suppliers
The Cybersecurity Maturity Model Certification program checks that defense contractors protect Federal Contract Information and Controlled Unclassified Information. Level 1 covers basic safeguarding of contract information. Level 2 aligns with the 110 security requirements in NIST SP 800-171 for companies that handle CUI.
The requirement appears in contracts, so the level you need depends on the information you receive. The first step is knowing exactly what data you have and where it lives.
IT work we help with
- Finding where contract information and CUI live
- Shrinking the scope to fewer systems
- MFA, encryption, and access controls
- Logging and monitoring
- System security plan support
- Plans of action for open items
This is technical IT guidance, not legal or contract advice.
Steps toward CMMC compliance
1. Scope
Identify which people, computers, and services touch contract data.
2. Gap review
Compare current IT to the required controls.
3. Fix
Put missing technical controls in place.
4. Document
System security plan, network diagrams, and policies.
5. Self-assess
Complete and record the self-assessment your contracts require, and stay ready for stricter levels.
6. Maintain
Keep controls working and evidence current.
How we work with suppliers
- ListenYour contracts, the data you receive, and how the shop runs.
- PlanA scoped plan with priorities and realistic timelines.
- BuildWe set up the controls and help with the documentation.
Practical CMMC compliance for shops and engineering firms
Many small suppliers mix shop-floor computers, CAD workstations, and office PCs on one flat network. That makes the whole company part of the CMMC scope. Separating the systems that handle contract data into a smaller, well-protected area can make compliance far more manageable.
Official sources
The rules are changing. In July 2026 the Department announced it was suspending the CMMC Phase II requirements while it reviews the program; Phase I self-assessment requirements remain in place. The department explains the current status on its CMMC program page, and the underlying requirements are published by NIST in SP 800-171. Requirements and timelines change, so check the current rules and your contracts.
Common gaps we see
- Shared logins on shop-floor computers
- Drawings emailed without encryption
- No MFA on email or remote access
- USB drives used to move files between machines
- No written system security plan
- Logs not kept or reviewed
Keeping production running
Changes are planned around production schedules, and machine-control computers are handled carefully so nothing interrupts the floor. Read our CMMC compliance basics post for a short overview, and see IT for aerospace offices and IT for manufacturers.
Documentation matters as much as technology
Assessors look for evidence. A system security plan describes how each requirement is met, network diagrams show where controlled information lives, and records show that controls are reviewed. Many small suppliers have reasonable security but almost no written proof. Our CMMC compliance work includes building those documents alongside the technical changes, so the paperwork matches what is actually in place.
Flowing requirements to subcontractors
If you share contract data with subcontractors, they may need to meet requirements too. We can help you understand which files go where and how to share them securely, using encrypted, access-controlled sharing instead of regular email attachments. Keeping CUI in one controlled location makes it much easier to show where it goes.
CMMC compliance FAQ
Which CMMC level do we need?
It depends on your contracts and the information you handle. Check the contract clauses and ask your prime contractor or contracting officer.
Can you certify us?
No. Certification assessments are done by authorized assessment organizations. We help you prepare.
Did CMMC go away?
No. In July 2026 the Phase II requirements were suspended for review, but Phase I self-assessment requirements remain. The underlying NIST 800-171 controls are still good practice and often appear in contracts.
Can we use Microsoft 365?
Some Microsoft cloud offerings are designed for defense contractors. We will help you review the options for your situation.
Related pages
IT for aerospace offices
Engineering and defense work.
IT for manufacturers
Shop floor and office networks.
CMMC compliance basics
An overview from our blog.
Cybersecurity
Controls that support CMMC.
Start your CMMC preparation
A short call to understand your contracts and data is the best first step.
On-site and remote IT since 1998.