Your business needs CMMC if it holds, or wants to bid on, a Department of Defense contract or subcontract where your own computers will process, store or send Federal Contract Information or Controlled Unclassified Information, and the contract calls for a CMMC level. If you only sell commercially available off-the-shelf items, the rule carves those purchases out. If you are a subcontractor, the requirement reaches you through your prime. The quickest way to know is to read your contract and ask your customer two questions, both listed below.
This guide is written for machine shops, fabricators, parts suppliers and service companies around Anniston, Oxford and the rest of Calhoun County that do work connected to Anniston Army Depot or to larger defense contractors. I have checked every specific here against the published rule (32 CFR part 170) as of November 11, 2026. The program is under review right now, which I explain below, so treat your contract as the final word.
What CMMC is
CMMC stands for Cybersecurity Maturity Model Certification. It is the Department of Defense’s way of checking that companies in its supply chain protect the government information they are given. The security requirements themselves are mostly not new. What CMMC adds is proof: a recorded assessment and a signed statement that you meet them.
The two kinds of information that decide everything
- Federal Contract Information (FCI) is information the government provides or you create under a contract that is not meant for public release. Think of contract details, delivery schedules and ordinary correspondence about the work.
- Controlled Unclassified Information (CUI) is more sensitive information that law or policy says must be safeguarded, such as technical drawings and specifications that have been marked as controlled.
Which one you handle sets your level. If you are unsure, do not guess: ask whoever sends you the work.
The three levels
| Level | Protects | Requirements | How it is assessed |
|---|---|---|---|
| Level 1 | FCI | 15 basic safeguarding requirements, the ones in FAR clause 52.204-21 | Self-assessment every year, with an affirmation |
| Level 2 | CUI | The 110 requirements of NIST SP 800-171 Revision 2 | Self-assessment every three years, or an assessment by an accredited third-party organization (a C3PAO), as the contract specifies. Affirmation every year. |
| Level 3 | CUI on the highest-priority programs | Level 2 plus 24 requirements selected from NIST SP 800-172 | Assessed by the government |
Most small suppliers land at Level 1 or Level 2. A few details from the rule that matter in practice:
- Self-assessment results are entered in the government’s Supplier Performance Risk System, known as SPRS.
- Someone senior in your company signs an affirmation that the requirements are met and stay met. That signature is a statement to the government, so it has to be true.
- Level 1 is all or nothing: the rule does not allow a plan of action for unmet items. At Level 2, a limited plan of action can earn a conditional status, and the open items have to be closed within 180 days.
Where the program stands right now
The rule phases CMMC in. Phase 1 is the self-assessment phase: Level 1 and Level 2 self-assessments in the solicitations and contracts that call for them. Phase 2 was the step that would have added third-party Level 2 certification as a condition of award.
On July 13, 2026 the Department announced that it was suspending Phase 2 and the later phases and reviewing the program. It said the Phase 1 self-assessment requirements stay in place. The older duties did not go anywhere either: DFARS clause 252.204-7012 still requires contractors that handle covered defense information to implement NIST SP 800-171 and to report cyber incidents. As of this writing I have not found a published restart date for Phase 2, so I am not going to give you one. Anyone quoting you a firm certification deadline today should be able to show you where it is written.
What that means for a small supplier: the pause is about who checks your work, not about whether the work is required. If your contract involves CUI, the 110 requirements still apply to you.
How to find out if it applies to you
- Read the contract or purchase order. Look for FAR 52.204-21 (basic safeguarding of FCI), DFARS 252.204-7012 (safeguarding covered defense information) and DFARS 252.204-7021 (the CMMC clause). Subcontracts often include them by reference in the terms and conditions.
- Ask your customer what you are receiving. “Does any of the information you send us count as CUI, and is it marked?”
- Ask which level they expect. “What CMMC level will you require from us, and by when?” Primes are responsible for flowing the requirement down, and many send suppliers a questionnaire.
- Trace where the information goes. Email, a shared drive, the computer beside the CNC machine, a personal phone, a home laptop. Every place it lands is in scope.
Where to start, in order
- Shrink the scope. The fewer computers and people that touch contract information, the less there is to secure and document. Many small shops keep it on a few dedicated machines.
- Do an honest gap check against the 15 requirements (Level 1) or the 110 (Level 2). Mark each one met, partly met or not met, with evidence.
- Fix the basics first. Multi-factor sign-in, individual accounts with no shared logins, current updates, endpoint protection, controlled physical access, and removing access the day someone leaves. Our 15-point security self-check covers the same ground in ten minutes.
- Write it down. Level 2 expects a System Security Plan that describes how each requirement is met, plus policies people actually follow.
- Record the result and keep it true. Enter the self-assessment in SPRS, sign the affirmation, and review it every year or when something changes.
Common mistakes
- Assuming a subcontractor is exempt. The requirement follows the information, not the size of the company.
- Forwarding controlled drawings to a personal email account or an unmanaged phone.
- Treating a consumer file-sharing or email account as acceptable for CUI without checking that it meets the government’s cloud requirements.
- Buying a product that claims to make you compliant. Tools help, but the requirements are about how your company operates.
- Signing an affirmation based on a hopeful guess.
What we do, and what we do not
Operation Buildup offers CMMC compliance consulting, scoped and quoted separately from managed IT: gap analysis for Level 1 and Level 2, System Security Plan and policy documentation, help putting the controls in place, and a readiness review before an assessment. We are consultants. We are not a certifying body, the decision in any third-party assessment belongs to the assessor, and we will never promise you a certification. What we can promise is a clear picture of where you stand and a plan in plain English.
See cybersecurity and CMMC consulting, cybersecurity in Anniston or IT for manufacturers, or ask us about your contract.