CMMC

CMMC has three levels. Level 1 applies to contractors handling Federal Contract Information and covers a set of basic safeguarding requirements, verified by an annual self-assessment. Level 2 applies to contractors handling Controlled Unclassified Information and aligns with the 110 security requirements in NIST SP 800-171, verified either by self-assessment or by a third-party assessment depending on the contract. Level 3 adds requirements for a small set of the most sensitive programs and is assessed by the government.

The program rule took effect at the end of 2024, and the DFARS rule that puts CMMC requirements into contracts began a phased rollout in late 2025. On July 13, 2026, a DoD CIO memo suspended the Phase 2 requirements until further notice, pending a review by a CMMC Reform Task Force, and a September 2026 class deviation (2026-O0025 Rev 3) told contracting officers to remove or modify CMMC requirements. That is the status as of October 2026; check the DoD CIO's site for anything newer.

The suspension doesn't remove what CMMC was built to verify. DFARS 252.204-7012, NIST SP 800-171 Rev 2, and SPRS self-assessment scores still apply where they're in your contracts. For a small machine shop, the practical question is still what information you receive from customers, especially drawings marked as CUI, and what your contracts require.

CMMC assesses your whole environment: computers, networks, email, file storage, physical access, and policies. No single application makes a shop CMMC compliant. Traveler's Shop Server ($4,250) and Shop Server Defense ($6,500) keep the shop system on hardware in your building, so there's no third-party cloud holding CUI. The box is still in your CUI scope, and the Defense edition is designed to ship with an 800-171 control mapping that says what it covers and what stays your job. Work with a qualified consultant or assessor for your specific situation.