Software for CMMC Machine Shops: Keep CUI on Your Own Network
If your shop machines parts for defense primes, the drawings and specs that come with the PO are often marked Controlled Unclassified Information. That brings DFARS 252.204-7012 into your contracts. The clause points to the 110 security requirements in NIST SP 800-171 Rev 2, and where a contract calls for it, a self-assessment score posted in SPRS. CMMC is the program meant to verify all of that. As of October 2026, its Phase 2 requirements are suspended: a DoD CIO memo on July 13, 2026 paused them pending a program review.
The suspension doesn't switch off what sits underneath. 7012, 800-171, and SPRS scores still apply where they're in your contracts, and so does False Claims Act exposure for a score that doesn't match reality. Traveler's Shop Server is designed for one part of that problem: where your shop system lives. It puts the whole system on a box in your building, so job records and drawings don't go to a third-party cloud. It's $4,250 one time, or $6,500 for Shop Server Defense, the edition built for CUI work. Details and the free reservation form are at /shop-server.
“We were told we needed CMMC by a deadline, and now it's paused. I don't know what still applies.”
As of October 2026, CMMC Phase 2 is suspended, and a September 2026 class deviation (2026-O0025 Rev 3) tells contracting officers to remove or modify CMMC requirements. DFARS 252.204-7012, NIST SP 800-171 Rev 2, and SPRS self-assessment scores still apply where they're in your contracts. Work toward those and you aren't starting over when CMMC resumes.
“If I put CUI in a cloud ERP, the vendor needs FedRAMP Moderate or equivalent, and I have no way to check that.”
Under the DoD CIO's December 2023 FedRAMP equivalency memo, a cloud service that stores covered defense information needs a third-party assessment with full evidence and no open POA&Ms. A SOC 2 report doesn't qualify. A box you own on your own network isn't an external cloud provider, so that question doesn't come up for your shop system. The box is still in your CUI scope, so it has to meet your controls like any other computer that holds CUI.
“GCC High and the rest of the compliance stack cost more per user than my shop software.”
GCC High is reported at roughly $60 to $93 per user per month. The Shop Server is a one-time purchase with unlimited users: $4,250, or $6,500 for Defense. It doesn't replace your email or file-storage controls, but it keeps the shop system off a per-seat meter.
“I need evidence for my self-assessment, not a sales sheet.”
Shop Server Defense is designed to ship with a NIST SP 800-171 control mapping and an SSP template excerpt that set out what the box does and what stays your responsibility. It also adds a hardened configuration designed around FIPS-validated encryption, MFA, and audit logging. These are planned features of a pre-launch product, so ask to see the mapping before you rely on it.
“I don't want a vendor's support staff able to get into our data.”
Shop Server Defense support is designed to come from US persons only, and only when you grant access. Any remote access you allow can make that vendor an external service provider in your assessment scope, which is why the default is no access at all.
What applies to a small defense shop as of October 2026
On July 13, 2026, the DoD CIO suspended CMMC Phase 2 requirements until further notice and started a 60-day review by a CMMC Reform Task Force. Small-business cost was part of the reason: SBA data cited in coverage of the memo put the cost to small and mid-sized businesses above $7 billion a year. Class Deviation 2026-O0025 Rev 3, issued September 3, 2026, tells contracting officers to remove or modify CMMC requirements in solicitations and contracts.
What did not change: DFARS 252.204-7012 still requires you to safeguard covered defense information and report cyber incidents, NIST SP 800-171 Rev 2 is still the control set, and SPRS self-assessment scores are still required where a Level 1 or Level 2 self-assessment is in the contract. The DoD's own estimates for a small business show why the program is under review: about $104,670 over three years for a Level 2 third-party assessment, about $37,196 over three years for a Level 2 self-assessment, and about $5,977 a year for Level 1. Those figures cover the assessment only, not the work to get ready. Check dodcio.defense.gov for the current status before you plan around any date.
Where a shop system fits in your CUI scope
Your shop system holds the job records, travelers, and often the customer drawings themselves, which puts it squarely in scope. If it's a cloud service, the FedRAMP Moderate equivalency requirement applies to that provider. If it's on hardware you own, it doesn't, because there's no external cloud provider involved.
To be clear about the limits: the box is in your CUI scope, and you still own the controls around it. That means who has accounts, how the network is set up, physical access to the room it sits in, patching, backups, and your policies. Email, file shares, and the PCs your people use to open drawings are separate questions. The Shop Server is designed to be one well-documented asset in that environment, not a substitute for the program. No product makes a shop CMMC certified, and Traveler doesn't claim to.
Two editions, one software
The Shop Server ($4,250 one time, optional $59 a month continuity plan) is a silent fanless box with unlimited users and 12 months of updates, and it works with the internet unplugged. Shop Server Defense ($6,500 one time, optional $99 a month continuity plan) adds mirrored SSDs and a small UPS, an encrypted USB backup drive with keys you hold, a hardened configuration designed around FIPS-validated encryption, MFA, and audit logging, the 800-171 control mapping and SSP excerpt, and US-persons-only support.
Both run the same software as Traveler Cloud: quoting, travelers, floor tracking, material traceability, and the compliance suite. Traveler is in early access, with Cloud first and both Shop Server editions planned to ship after it. Reserving one at /shop-server is free, with no deposit.
Want this handled without the spreadsheet?
Traveler Cloud is quote-to-invoice for small machine shops at $109/month flat, unlimited users. It's in early access — leave your email and we'll bring you in by wave. No sales calls.
Free, no signup: 5-Year Cost: Cloud vs On-Prem Shop Software →
Straight answers
▸Is Traveler CMMC compliant?
No software is. CMMC assesses your organization's whole environment, and certification comes from an assessment of that environment, not of an application. Shop Server Defense is designed to support your NIST SP 800-171 controls by keeping CUI on hardware you own and documenting what the box does.
▸Does CMMC still matter if Phase 2 is suspended?
The obligations underneath it do. As of October 2026, DFARS 252.204-7012, NIST SP 800-171 Rev 2, and SPRS self-assessment scores still apply where they're in your contracts. CMMC itself is under review, so check the DoD CIO's site for current status.
▸Does an on-premise box take my shop system out of CUI scope?
No. If the box stores or processes CUI, it's in scope. What it avoids is the FedRAMP Moderate equivalency question that comes with putting CUI in an external cloud service.
▸If Traveler provides remote support, are you an external service provider?
Vendor remote access can make the vendor an ESP in your scope. That's why the Shop Server has no remote access by default, and Defense support is designed to come from US persons only, only when you grant it. Talk to your assessor about how you document any access you choose to allow.