CMMC 2.0 Compliance Checklist for Manufacturers (2026)

A CMMC 2.0 compliance checklist for manufacturers starts with what you hold. Basic contract data means Level 1's 15 practices. Controlled drawings or specs mean Level 2's 110 requirements, a security plan, an SPRS score, and an annual affirmation.

Walk the floor of a machine shop that does defense work and there's a decent chance you'll find the problem taped to a machine. A drawing with a CUI banner across the top, a little greasy, sitting where anyone on second shift can read it. That sheet of paper is in scope. So is the CAM workstation that built the program, the server that sent it to the machine, and maybe the control's memory too. A CMMC 2.0 compliance checklist written for an office never gets out there.

This CMMC checklist does. It's built from the compliance work Consilien does with manufacturers, and it follows the order an assessor will actually care about. Data first. Then machines, controls, the front gate, the paperwork, and the shops you send work out to.

Where does CMMC 2.0 stand for manufacturers in October 2026?

Phase II, the start of required third-party certifications, has been suspended since July 13, 2026. Everything before it still applies, including Phase I self-assessments, NIST SP 800-171 Rev 2, DFARS 7012 incident reporting, and your SPRS score.

Some quick definitions, because the acronyms pile up fast. CUI is controlled unclassified information, the government's label for sensitive data like export-controlled technical drawings. FCI, federal contract information, is the lighter category, things like order quantities and delivery dates. SPRS is the Supplier Performance Risk System, the DoD database where your self-assessed security score lives and where contracting officers look it up, usually before they award anything, so a missing or stale score can quietly cost you a bid.

Phase I began on November 10, 2025, when the CMMC acquisition rule took effect and contracts started requiring self-assessments. Phase II was supposed to add certifications by an outside assessor starting November 10, 2026. The Department of War paused it in July, and a reform task force delivered its recommendations to the department's CIO around September 11, per Covington's September update. As of today that report isn't public, and no restart date has been announced.

None of that touches the clause you probably already signed. DFARS 252.204-7012 has required the NIST 800-171 controls since the end of 2017, along with a 72-hour incident report to DoD. The suspension paused the auditors. Not the obligation. If the difference between those two clauses is fuzzy, DFARS 252.204-7012 vs. CMMC lays it out.

Step 0: Is your shop Level 1 or Level 2?

If you only receive FCI, you're Level 1, with 15 basic practices and an annual self-assessment. If any contract sends you CUI, usually as a drawing, model, or spec, you're Level 2, and all 110 NIST 800-171 requirements apply.

In a machine shop, CUI almost always shows up as technical data. A model from the prime's portal. A drawing with ITAR or EAR export markings. A spec sheet with a distribution statement in the corner.

Overmarking is common, and it doesn't get you off the hook. PreVeil's guide for CAD users is blunt about it. A drawing that arrives with a CUI marking gets treated as CUI, even if the marking looks wrong. Take the question to the prime. Don't settle it yourself. Derived work is murkier. A CAM program built from a controlled model carries the part geometry, so the safe working assumption is that the G-code is CUI too, and that's how this checklist treats it.

Want a fast answer for your own shop? Pull the last 10 purchase orders from defense primes, search each one for "252.204-7012," and look through the attached drawings for CUI banners in the header or the title block. Two hits and you're a Level 2 shop, whatever anyone told you at the last trade show.

Phase 1 checklist: where does controlled data actually live in a plant?

Follow one controlled drawing from the RFQ to the shipping dock and write down every place it lands, including the stops nobody thinks of as IT, like the clipboard hanging on the machine and the bin next to the plotter. That path is your assessment scope. If it won't fit on one whiteboard, the scope isn't settled yet.

The usual stops, roughly in the order a part moves:

• The estimator's inbox, where the RFQ package arrives. Then whoever it got forwarded to.
• CAD and CAM workstations running SolidWorks, Mastercam, or similar.
• Shared drives and the job attachments inside your ERP, whether that's JobBOSS, E2, ProShop, or a homegrown Access database nobody admits to owning.
• The DNC server, the box that sends programs from the office network out to the machines.
• Machine controls that keep programs in memory. Fanuc, Haas, and Mazak controls all can.
• USB sticks and old RS-232 cables used to load the machines that predate networking.
• Printed drawings and paper travelers, the job packets that ride along with each order.
• CMM programs, inspection reports, and first-article packages built to AS9102.
• Phones. Operators photograph setups, and those photos sometimes show the drawing.
• The trash and the recycling bin.

That last one isn't a joke. A printed controlled drawing in an open dumpster is a disposal failure under requirement 3.8.3, which covers destroying media before it leaves your control. Paper counts as media. A locked shred bin by the plotter costs less than one assessor's afternoon.

Phase 2 checklist: how do you classify every machine and system?

Put every asset into one of the five categories in 32 CFR 170.19. CNC machines, PLCs, and test equipment usually count as Specialized Assets. They're documented and managed under your policies, but not tested against the other requirements.

That's straight from the regulation's table, and it's better news than plenty of shops expect. You don't have to put multi-factor login on a 2009 Haas. You do have to list it, explain how it's handled in your system security plan (SSP, the document that says how you meet each requirement), and show it on your network diagram.

Specialized doesn't mean ignored, though. A CNC machine on the same flat network as the front office pulls everything around it into one big scope, because nothing separates it. Two moves pay off fast. Put the machines on their own network segment, so the only way in is through the DNC server. And find every remote-support connection the machine builders installed, the cellular modem in the cabinet or the remote-desktop tool on the CMM PC, because requirement 3.1.12 says those sessions need to be monitored and controlled. Plenty of those connections were set up by a field tech years ago and never written down anywhere.

Phase 3 checklist: which controls look different on a shop floor?

The 110 CMMC 2.0 requirements are the same for every company. On a plant floor, a handful of them run into habits an office never has. Shared logins, USB sticks, and paper are the big three.

• Shared shift logins. If first and second shift both sign in to the CAM station as "cam1," you can't tell who did what, and requirements 3.5.1 and 3.5.2 say you have to. Give everyone their own account.
• Multi-factor login (MFA) for network access, including anyone who reaches the ERP from home. Requirement 3.5.3. In a May 2026 survey of 302 defense contractors, only 63% had MFA in place, per CyberSheath's report as covered by SecurityWeek.
• USB sticks. Requirement 3.8.7 controls removable media. Requirement 3.8.8 bans portable storage with no identifiable owner. The unlabeled stick in the toolbox drawer fails 3.8.8 on sight.
• Paper. Requirement 3.8.1 protects media "both paper and digital." Drawings go back in a controlled bin at end of shift.
• Encryption that's FIPS-validated, meaning tested and certified under the federal standard for encryption modules, wherever it protects CUI (3.13.11). Consumer file-sharing apps usually aren't.
• Logs. Sign-ins and file access on CUI systems get recorded and kept (3.3.1).
• An incident plan that includes the 72-hour DoD report and keeping images of affected systems for 90 days, both from DFARS 7012.

Then there's the gap between "we bought it" and "we turned it on." An MFA license nobody ever enforced on the ERP still scores as "not met," and so does a logging tool that's installed but sends its records to a server nobody checks. For the full list by domain, see the 110 controls explained.

Phase 4 checklist: which physical controls can't wait for a POA&M?

Six Level 2 requirements can never go on a POA&M, the plan that lets you fix gaps after the assessment. Three of the six are physical: escorting visitors, logging physical access, and controlling keys and badges. Plants trip on them first.

The list comes straight from 32 CFR 170.21. An office with a locked suite and a receptionist barely notices these. A plant has a dock door open half the day.

Picture a source inspector from a prime walking the aisle between machines. Where's their line of sight? If they can read another customer's controlled drawing from the walkway, you've got an escort problem and a media problem in the same 10 feet. The cheap fix is boring. Route visitors down one aisle, keep drawings face-down or in holders, and write the route into the SSP.

Phase 5 checklist: how do the SSP, POA&M, SPRS score, and affirmation fit together?

The SSP describes how you meet each requirement. The POA&M lists what's still open and when it closes. Your SPRS score comes from both. And a senior official signs an affirmation every year saying it's all true.

Scoring starts at 110 and subtracts weighted points for each requirement that isn't met, which puts the range at −203 to 110 under the scoring method in 32 CFR 170.24. For conditional Level 2 status, the rule wants a score of at least 88, which is 80% of 110. No open item can be worth more than 1 point, except encryption that's in place but not FIPS-validated. None of the six from Phase 4 can be open. And everything closes within 180 days or the status expires.

• SSP written and covering all 110 requirements, the specialized assets from Phase 2 included.
• POA&M with an owner and a date on every open item.
• Score calculated honestly and posted in SPRS, with the assessment date.
• Affirmation signed by someone who actually read the SSP.

The score and the signature are where it gets expensive. In June 2026, LOGZONE, a Navy logistics contractor in Huntsville, agreed to pay $507,144 to settle False Claims Act allegations, DefenseScoop reported. The company had submitted a perfect self-assessment score of 110 in 2021. A 2024 review by the government's own assessment center scored it at negative 170. Not a manufacturer, but the arithmetic works the same way on a plant floor, and Baker Donelson notes that this exposure didn't go anywhere when Phase II was suspended.

CyberSheath's survey put the average score across the defense base at +51 in 2026, up from +33 a year earlier, while the share who were very confident in that number fell from 89% to 65%. Only 1% of respondents said they were completely ready for certification. A higher number nobody can prove is worse than a lower number you can.

If the SSP and POA&M are where your project stalls, CMMC SSP and POA&M development covers how those documents get built and maintained.

Phase 6 checklist: what do you owe the shops you send drawings to?

Under DFARS 252.204-7021, CMMC requirements flow down to every subcontractor, at any tier, that will handle FCI or CUI. The level they need matches the data you send them. Your plater, heat treater, and outside machine shop are in the chain.

Picture a 60-person aerospace job shop. It anodizes nothing in-house, sends heat treating across town, and farms out 5-axis overflow to a smaller shop two exits down. That's three suppliers who may be holding controlled data on your behalf, and your SPRS score says nothing about theirs, even though a leak at any one of them traces straight back to the drawings you sent.

• List every outside processor and subcontractor who receives drawings, models, or specs.
• Send each one only what the job needs. A plater may need a part number, a spec callout, and a quantity. Not the full model.
• Check their CMMC status and SPRS posting before you send CUI, not after.
• Replace email attachments with a secure transfer method you control.
• Put the flow-down clause in the PO.

And the same logic runs uphill. Your prime's certification doesn't cover your shop. CMMC for defense subcontractors goes deeper on tier-2 obligations.

Should you build an enclave or bring the whole plant into scope?

An enclave makes sense when a small share of your people touch CUI. Bringing the whole company into scope makes sense when defense work is most of the business and drawings are everywhere.

An enclave is a separate, locked-down environment, such as a PreVeil workspace or a Microsoft GCC High tenant (Microsoft's government cloud built for defense data), where only the people who handle CUI work with it. Everyone else stays on regular Microsoft 365. Fewer people and systems in scope mean less to assess.

Manufacturing adds a wrinkle. The enclave has to reach the floor. If the DNC server still pulls programs from a regular shared drive, the enclave stopped at the office door and the drawings went around it. Check that path before you buy anything.

Roughly how the decision breaks:

• If defense work is a minority of revenue and 5 people handle drawings, build an enclave.
• If defense is most of the work and engineering, quality, and the floor all touch CUI, scope the whole company, usually in GCC High.
• With ITAR-controlled data, your cloud options narrow to environments built for U.S.-person-only access, such as GCC High or an ITAR-capable enclave.
• FCI only? Skip this section. Level 1 doesn't require a government cloud.

Consilien worked through this exact call for a mid-sized aerospace supplier with a narrow CUI footprint, and a scoped PreVeil enclave instead of a full GCC High rollout was the better fit for them.

How long does CMMC Level 2 take, and what does it cost?

Plan on 12-24 months from gap analysis to a final certification decision, per Coalfire. DoD estimated about $104,670 over 3 years for a small company's Level 2 certification, and that figure leaves out the cost of fixing gaps.

The DoD number comes from the final CMMC program rule. It covers planning for the assessment, the assessment itself, reporting, and 3 years of affirmations. What it doesn't cover is the work before any of that, because DoD treats the 800-171 controls as something contractors have owed since 2017, so in the government's math that spending already happened years ago. Network segmentation, new licenses, a secure file transfer tool, and the hours to write an SSP all sit outside that $104,670.

For a sense of ongoing spend, CyberSheath's respondents reported an average of $155,000 a year on DFARS compliance. Treat that as a market average. A 40-person shop with a tight enclave can land far below it. A plant with 30 networked machines and no segmentation won't.

Time goes where you'd guess. Scoping the floor, segmenting the machines, and running the controls long enough to produce evidence. Assessors want proof something has been operating, not a policy signed last Tuesday. Plants in the Los Angeles area that want someone walking the floor with them can look at CMMC compliance in Los Angeles.

Where to start this week

Pull the 10 purchase orders. Walk one drawing from inbox to shipping dock. Count how many visitors went onto the floor last month and whether anyone signed them in. Then look up the date on your SPRS score, because if it's older than 3 years it's already stale.

Compliance is its own engagement at Consilien, separate from managed IT, and it usually starts with a CMMC gap assessment that scores where you actually stand against the 110. If you want a second set of eyes on your scope before you commit to an enclave or a GCC High migration, speak to a CMMC expert.