If you make parts, assemblies or electronics that end up in something the Department of Defense buys, even three tiers down the supply chain, the Cybersecurity Maturity Model Certification is now a term of the contract rather than a someday project. Since November 10, 2025, new DoD solicitations have been phasing in CMMC 2.0 requirements, and the primes are passing them down to every supplier that touches government information. For a lot of Oregon shops, the first sign is a questionnaire from a customer asking for a “CMMC level” and an SPRS score, and nobody in the building is sure what either one means.

Here’s what the program asks for, how to tell which level applies to you, and the order of operations that gets a 30-person manufacturer through it without a panic.

What CMMC 2.0 actually is

CMMC is the DoD’s way of checking that its suppliers protect two kinds of information. Federal Contract Information (FCI) is the ordinary paperwork of doing business with the government: purchase orders, invoices, delivery schedules. Controlled Unclassified Information (CUI) is the sensitive stuff: technical drawings, specifications, export-controlled data, anything marked as such by the customer.

The program has three levels.

  • Level 1 covers FCI only. It’s 15 basic practices, things like unique logins, patched systems and a firewall, taken from the FAR clause that has been in federal contracts for years. You self-assess annually and a company officer affirms it in the government’s SPRS system.
  • Level 2 covers CUI. It’s the 110 security requirements of NIST SP 800-171, and for most contracts it requires a certification assessment by an accredited third-party organization (a C3PAO) every three years, with an annual affirmation in between. A subset of lower-risk contracts allow a Level 2 self-assessment instead.
  • Level 3 adds requirements from NIST SP 800-172 for the highest-priority programs and is assessed by the government itself. Very few Oregon suppliers will need it.

The rule phases in over four years. Self-assessments arrived in solicitations first; third-party Level 2 certifications become a condition of award in the second phase, from November 2026; by late 2028 every applicable DoD contract carries the requirement. If a prime is asking today, it’s because their own flow-down obligations started already.

Which level is yours

The honest test is what information sits on your systems, not what you make. A machine shop that quotes from a drawing marked export-controlled or “CUI” and stores it on the office server is in Level 2 territory, regardless of size. A fastener distributor that only sees purchase orders and ship-to addresses is likely Level 1.

Three questions settle most cases:

  1. Do you receive technical data from the customer: drawings, specs, test procedures, ITAR or EAR-controlled files? If yes, assume CUI and Level 2 until the contract says otherwise.
  2. Does your DFARS 252.204-7012 clause already require NIST 800-171? Then Level 2 is a formalization of what the contract already expected.
  3. Does the customer’s flow-down letter name a level? Believe the letter, then confirm with your contracts contact at the prime.

If you can’t find the answer in your contracts, your prime’s supplier quality or compliance group can tell you. Ask early; the people who wait are the ones who learn their level from a lost bid.

Why this lands on Oregon shops in particular

Oregon has a bigger defense supply chain than most people realize. The big names are visible, including Boeing’s fabrication plant in Gresham and Precision Castparts’ operations around Portland, but the chain beneath them is hundreds of small firms: machine shops in Tualatin and Clackamas, electronics assemblers in Washington County, optics and metals suppliers up and down I-5. Most have between ten and eighty employees, one person who “does IT” alongside another job, and a file server that has held customer drawings since the 2000s. That’s exactly the profile CMMC was written for.

The good news is that the state has help. The Oregon Manufacturing Extension Partnership runs cybersecurity and CMMC readiness programs for small manufacturers, and there are now accredited assessors in the region, so you don’t have to fly anyone in.

The order of operations

Firms that get through Level 2 cleanly tend to do it in this sequence.

1. Scope first. The single biggest cost driver is how much of your environment is “in scope.” If CUI lives on every laptop, the whole company gets assessed. If it lives in a controlled enclave, a separate secure environment where drawings are stored and worked on, the assessment shrinks to that enclave. For most small manufacturers the enclave approach is the difference between a manageable project and a rebuild. This is also where the Microsoft 365 question comes up: standard commercial tenants can hold FCI; CUI with export-control markings usually points to the government-cloud editions, and you want that decision made before anything migrates.

2. Gap assessment against the 110 requirements. Someone goes through NIST 800-171 line by line and marks each requirement as met, partially met or not met, with evidence. The output is a System Security Plan (SSP) describing how each requirement is satisfied, and a Plan of Action and Milestones (POA&M) for the gaps. Your SPRS score comes from this: start at 110, subtract points for each unmet requirement.

3. Close the technical gaps. This is the part an IT provider does: multi-factor authentication everywhere, endpoint detection and response with someone watching it, centralized logging you can actually search, patching on a schedule with proof, encryption on laptops and backups, least-privilege access, network segmentation between the shop floor and the office, and an incident response plan that has been rehearsed once. None of it is exotic. All of it has to be documented.

4. Operate it for a while before the assessment. Assessors look for evidence that controls run, not that they were switched on last week. Three to six months of logs, patch reports and access reviews makes the assessment short.

5. Assess, certify, affirm. The C3PAO assessment itself is usually a few days. After certification, an officer affirms continued compliance every year, which is why the operating discipline in step 4 matters more than the certificate.

From a standing start, a small manufacturer with CUI should budget nine to eighteen months for the whole arc. Shops that already met the 2017 DFARS requirement honestly are much closer than that.

Who does what

Two different skill sets are involved, and it helps to be clear about them. The technical controls, the logging, the enclave, the day-to-day operation of all of it is IT work, and it’s the kind of thing a managed IT provider should already be doing for you in some form. The gap assessment, the SSP and POA&M, the SPRS submission and the assessment preparation are compliance work, with their own vocabulary and their own paperwork standards. We handle the first for our manufacturing clients through our cybersecurity services and work alongside a specialist compliance partner on the second, so the shop gets one plan instead of two vendors pointing at each other.

The short checklist

  • Find the clause: does your contract carry DFARS 7012, 7019, 7020 or 7021?
  • Decide your level based on whether CUI touches your systems.
  • Inventory where CUI actually lives today, including email, personal OneDrives and the quoting software.
  • Choose a scoping strategy; an enclave is usually the right one.
  • Run a gap assessment and produce the SSP, POA&M and SPRS score.
  • Close the technical gaps and start generating evidence.
  • Book the assessment only when the evidence is a few months deep.
  • Put the annual affirmation on the calendar now.

CMMC is not a reason to dread the next bid. For most Oregon suppliers it’s the same security program they should have had anyway, written down carefully enough that a customer can trust it, and the firms that get there first tend to find that the primes notice.