IT Compliance Challenges for OC Manufacturing and Aerospace Firms

Orange County manufacturers and aerospace suppliers face four compliance pressures in 2026: NIST 800-171 self-assessments under DFARS 7012, ITAR limits on technical data, prime-contractor flow-down, and SPRS scores they can defend. CMMC's Phase II pause changed none of them.

IT compliance for Orange County manufacturing and aerospace firms got confusing in July. The Department of War, the Pentagon's current name, suspended the second phase of CMMC four months before third-party certification was due to start. A lot of shop owners in Anaheim and Santa Ana read the headline and exhaled. Understandable.

The deadline moved. The liability didn't.

Every rule that made CMMC necessary is still written into your purchase orders, and only some of the fixes live inside managed IT services in Orange County. If a prime in Costa Mesa or Seal Beach sends your shop a controlled drawing, you're still bound to protect it under a federal security standard, you still owe the Defense Department a self-assessed score, and the Justice Department can still treat a score you can't back up as a false claim against the government. None of that waited.

So what actually changed? Less than the headlines suggest, and a lot less than the vendors still emailing you about a November 10 deadline would like you to believe. The fixes that don't live in managed IT are a separate compliance job, and knowing which is which saves money in both directions.

What did the CMMC Phase II suspension actually change?

It stopped third-party CMMC certification from becoming a contract requirement on November 10, 2026. It didn't remove a single security control. NIST SP 800-171, DFARS 7012 incident reporting, and SPRS self-assessments all remain in force.

CMMC, the Cybersecurity Maturity Model Certification, is the Defense Department's program for proving that contractors protect sensitive government data. Phase I began November 10, 2025, and it runs on self-assessments. Phase II was the step where an accredited outside assessor, called a C3PAO, would certify you before you could win certain contracts. That step is what paused.

On July 13, 2026, the department suspended Phase II and every later milestone and ordered a 60-day review by a new CMMC Reform Task Force. CSIS's analysis of the pause is clear that contractors must keep protecting controlled data and filing self-assessments in the meantime. The Task Force's report went to the department's CIO in September. As of Covington's September 21 update, it hadn't been made public. Still hasn't.

Read the left column again. The only thing paused is the outside assessor.

One more detail from that Covington update deserves attention from anyone running CNC machines. The CIO told a September conference, per press reports Covington cites, that the department is also reviewing risk in operational and manufacturing technology, the computers that run equipment rather than email. That's the plant floor. A reform that ends up asking more of shop-floor networks, not less, is a real possibility, and I wouldn't plan around the opposite. Watch that one.

Why is Orange County's supply chain getting more scrutiny, not less?

Primes buying from OC shops are growing. Fast. And their purchase orders carry security terms. A suspended federal deadline doesn't stop a customer from requiring proof before it sends you a drawing. Nothing does.

In August, the Orange County Business Journal's annual list counted 25,915 local jobs at the county's 32 largest aerospace and defense employers. Anduril in Costa Mesa grew its OC headcount 56% in a year, to 4,986, and now sits 49 people behind Boeing's Seal Beach hub. Fast-growing primes buy parts. Lots of them, from machine shops, harness builders, finishers, and electronics assemblers across aerospace manufacturing supply chains in Irvine, Huntington Beach, and Anaheim.

Those primes carry their own liability. So they push it down.

CSIS notes that primes have increasingly flowed Level 2 requirements to small subcontractors even when those subcontractors don't currently handle controlled data. A Kiteworks survey of 273 defense contractors reported by SecurityWeek in August found that 55% of Tier 2 and lower subcontractors reported losing bids over Level 2 requirements, compared with 31% of primes. Smaller shops lose more. That isn't a regulation. It's a sales problem, and it shows up as a supplier security questionnaire you can't finish, or a quote request that quietly stops coming.

Is your SPRS score something you could defend?

Only if every point is backed by evidence you could hand an investigator tomorrow. Filing a self-assessed score is a representation to the federal government, and failing to meet those controls has already produced a False Claims Act settlement with a small machine shop.

SPRS, the Supplier Performance Risk System, is where defense contractors post a score for how many of the 110 NIST controls they've put in place. A perfect score is 110, every missing control subtracts points from there, and the floor sits far below zero.

Scores are rising. Confidence in them isn't. The CyberSheath and Merrill Research 2026 State of the DIB Report, based on 302 contractors surveyed in May, put the average SPRS score at +51, a five-year high, up from +33 in 2025. Only 65% were very or extremely confident those scores were accurate, down from 89% a year earlier. Just 1% said they were completely prepared for certification.

Higher scores, lower trust. Think about that for a second.

In December 2025 the Justice Department announced that Swiss Automation, an Illinois precision machining company, agreed to pay $421,234 to resolve allegations that it didn't adequately protect drawings of parts it machined for Defense Department primes. The case started as a whistleblower suit. Who blew the whistle? Its former quality-control manager, who received $65,291. The settlement isn't a finding of liability, and the shop never had to sit through a CMMC assessment for any of it.

Who in your building knows exactly where the drawings go? Your quality manager does.

An SPRS score that nobody can walk through control by control is a signed statement waiting for someone to test it. How DFARS 7012 and CMMC fit together matters here, because 7012 is the clause that carried this obligation long before CMMC had a name.

CUI or ITAR: which data are you actually holding?

Frequently both. Same email attachment, even. CUI is controlled unclassified information that DFARS says you must protect with NIST 800-171. ITAR is the State Department's export-control regime, and it governs who may see defense technical data, not just how it's stored.

Take a bracket drawing for a defense program. It can carry a CUI marking and an ITAR export-control warning at once. Different agencies, and they don't coordinate.

Cloud email is where OC shops trip first. Microsoft's ITAR compliance documentation lists its government clouds, including the Office 365 GCC High and DoD tiers, as in scope. The commercial Microsoft 365 most small manufacturers run on isn't on that list. GCC High is Microsoft's separate government version of Microsoft 365, run in U.S. data centers by screened U.S. staff, and moving to it is a real migration with real licensing costs.

GCC High isn't the only path, though. ITAR's rules at 22 CFR 120.54 say that technical data sent or stored with qualifying end-to-end encryption isn't an export, which opens the door to encrypted tools that keep controlled files apart from the rest of the company. One mid-sized aerospace supplier with a narrow controlled-data footprint went with an enclave instead of a full GCC High move. An enclave, in this sense, is a walled-off workspace where only the people who handle controlled drawings work with them.

Which path fits depends on scope. And scope is where IT compliance for aerospace shops in Orange County runs away on cost.

Follow a single controlled drawing through a typical job shop, from the moment a buyer at the prime hits send to the day the finished part ships. It lands in an estimator's inbox. It gets opened in the quoting software, saved to a shared drive, converted into a machine program on a CAM workstation (the computer that turns a drawing into machine instructions), carried to the CNC on a USB stick, printed for the inspection lab, and filed with the shipping paperwork. Every one of those systems is now in scope. Pull that drawing into one controlled channel at the front door and the scope shrinks to a handful of machines and people. Leave it in general email and the whole company is in scope. Everything.

ITAR, CMMC, and NIST compared side by side covers the frameworks in more depth. For the IT side of export control specifically, see ITAR compliance IT services.

Where do AS9100 and NADCAP help, and where do they stop?

AS9100 and NADCAP already give an aerospace shop document control, revision control, training records, and the habit of proving things with evidence. They don't touch network design, access control, or logging, and that's where CMMC assessors spend their time.

AS9100 is the aerospace quality management standard. NADCAP is the industry accreditation for special processes like heat treating, plating, and nondestructive testing. If you've earned either one, your team knows how to write a procedure, follow it, and keep the record. That's a head start most commercial manufacturers don't have.

Then the overlap ends.

Quality auditors don't ask whether the CNC controllers sit on the same flat network as the front office, where anyone who gets into the receptionist's PC can reach the machines. They don't ask whether three shifts share one Windows login at the inspection station. Or whether CNC programs walk out to the machines on USB sticks that nobody tracks, scans, or collects at the end of a shift, which is how shop-floor malware tends to get in. NIST 800-171 asks about all of it.

Paper is the sneaky one. Travelers, the job packets that follow a part around the shop, often carry the controlled drawing with them. One full-scope metal finishing workshop had controlled data moving through paper travelers, contract workers, and the NADCAP cage, which forced a boundary that covered physical handling as well as the network. Digital-only guidance skips it.

Usually, the first fix is the network itself. Hixson Metal Finishing in Newport Beach has worked with Consilien since 2010, and Joel Poindexter, its IT manager, wrote on Clutch that a network upgrade "provided a reliable backbone to run our systems with greater performance." Unglamorous work. Segmentation, the practice of splitting a network so machines, offices, and guests can't reach each other freely, sits on top of exactly that kind of backbone. Without it, there's nothing to segment.

CMMC for aerospace manufacturers goes further on mapping a quality system to the 110 controls.

What happens when the one person who knows your setup retires?

Your compliance program walks out the door with them, unless it's written down. The county's own workforce data calls aerospace the local sector most exposed to retirements, which makes this a near-term risk.

April's 2026 Orange County Workforce Indicators Report, presented by the county's Workforce Development Board, found that 40.5% of the county's aerospace workforce is 55 or older, and that more than a third of the region's defense and aerospace talent is expected to retire within 10 years. That's not a slow trickle.

Now picture who holds the compliance knowledge at a 60-person shop in Fullerton. Probably the operations manager who set up the export-control procedures in 2014. Or the IT person who knows which three workstations are allowed to open controlled files and why. Maybe the quality manager who remembers which customer requires what. Frequently all three.

Where's the system security plan? That's the written document describing how each of the 110 controls is met in your environment, and an assessor reads it first. At some shops it exists. It's just three years old and lives in one person's head more than on paper.

I'd argue this is the cheapest compliance problem to fix and the one most often ignored. Not the most technical one. The cheapest. An evidence program, meaning dated proof that each control actually runs, turns one person's memory into something the next hire can pick up. Start there.

Which California rules don't apply to most OC manufacturers?

California's new CCPA cybersecurity audit rules mostly don't. They're triggered by large volumes of consumer data, and a B2B machine shop selling to primes rarely holds anything close to the threshold.

They took effect January 1, 2026. Per Alston & Bird's August 2026 summary, a business needs a formal cybersecurity audit if it earns half its revenue from selling or sharing personal information. The other trigger is clearing roughly $26.6 million in revenue while also processing personal information on 250,000 or more California consumers or households, or sensitive personal information on 50,000 or more. First audits are due April 1, 2028 for businesses over $100 million in revenue, 2029 for $50 million to $100 million, and 2030 for covered businesses under $50 million.

Employees count as consumers under the CCPA. Even so, a 300-person aerospace shop isn't coming anywhere near 250,000 people.

So if someone tries to sell your shop a CCPA cybersecurity audit, ask them to show you which threshold you cross. Then wait. A consumer products manufacturer with a big direct-to-consumer web store is a different story and should check. A contract machining house usually doesn't need to spend a dollar here.

Where does managed IT end and compliance work begin?

Managed IT keeps systems patched, monitored, backed up, and access-controlled, which produces much of the evidence an assessor wants to see. Compliance is the separate job of scoping, writing the security plan, tracking gaps, and proving each control.

At Consilien those are two different services with two different scopes. Separate contracts, too. Consilien is a managed IT and cybersecurity provider that serves businesses nationwide, including manufacturers and aerospace suppliers across Orange County, and its compliance services are sold on their own, not bundled into managed IT. We align IT management to our CIMS framework, so the day-to-day work is built to hold up when the compliance side asks for proof.

Skip most of this post if your shop builds only commercial products and no customer has ever put a DFARS clause in a purchase order. General IT for manufacturers will serve you fine. Same if you already have a compliance lead with a current security plan and a score they can walk through. You need a second opinion at most.

For everyone else, here's what's worth doing this quarter while the Task Force report is still pending:

• Pull the last 5 purchase orders from defense customers and read the clauses. Look for 252.204-7012, 7019, 7020, and any ITAR export-control markings on the drawings themselves, since those travel with the file long after the purchase order closes.
• Trace where controlled drawings landed over the past 90 days. Inboxes, shared drives, USB sticks, the printer in inspection.
• Rescore SPRS honestly, one control at a time, with someone who didn't write the original score.
• Who holds knowledge no one else has? Write down 3 things only one person in the building knows how to do.
• If the gaps look big, a CMMC gap assessment prices the work before a customer forces the timeline.

Manufacturing IT compliance and CMMC compliance services cover how CMMC compliance for OC suppliers gets scoped.

How long does the pause last? Nobody knows. The Task Force report could reset the clock any week. If you'd rather spend the time fixing scope than explaining a score, speak to a CMMC expert.