Do You Need CMMC? A Small Manufacturer's Guide to the 2026 Rules

If you make anything that ends up in the defense supply chain — even as a third-tier subcontractor who never talks to the government directly — CMMC may now decide whether you can win and keep contracts. And the most common question we hear from small shops is the right one: do I even need this? The short answer: if you handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on a Department of Defense contract, yes, regardless of your size.

This guide covers who's actually in scope, what the levels require, the dates that matter, and what non-defense manufacturers should do instead.

The rule is real and in effect

The CMMC (Cybersecurity Maturity Model Certification) Program Final Rule codifies the program at 32 CFR Part 170. It was published in the Federal Register on October 15, 2024 and took effect December 16, 2024 (Federal Register). The companion DFARS contract clause (252.204-7021) that puts CMMC requirements into solicitations became effective November 10, 2025, on a phased rollout — so the requirement is now appearing in real contracts, not sitting on the horizon.

The rule applies to "defense contractors and subcontractors that will process, store, or transmit FCI or CUI in performance of a DoD contract" (Federal Register). The "and subcontractors" part is what catches small manufacturers off guard: flow-down means a requirement on the prime becomes a requirement on you, even if you're several tiers down.

Who's actually in scope

Two questions determine it:

1. Do you touch FCI or CUI? FCI is government contract information that isn't public. CUI is more sensitive controlled information. If the answer is "neither," you may be out of scope — but confirm it against your actual contracts and what your prime sends you, because a single drawing or spec marked CUI changes the answer.
2. What does your contract or prime require? The level (1, 2, or 3) and the assessment type (self vs. third-party) follow from the data and the solicitation.

Don't self-exempt on the assumption that "we're too small." Size isn't the test; data and contracts are. The most expensive mistake is discovering you're out of scope after losing a bid for not being certified — or, worse, attesting to compliance you don't have, which carries False Claims Act exposure.

What Level 2 requires

CMMC Level 2 is built on the 110 security requirements of NIST SP 800-171 (Revision 2) — access control, multi-factor authentication, encryption, audit logging, incident response, configuration management, and the rest. Depending on the contract, Level 2 requires either a self-assessment or a third-party assessment by a C3PAO every three years, with an annual affirmation.

If you've seen a cyber-insurance application, this list will feel familiar — the 800-171 control families and the controls underwriters score are largely the same. (For the scoring mechanics and the related SPRS picture, see our companion guide on the NIST 800-171 self-assessment and SPRS score, and the broader CMMC timeline and Level 2 steps.)

The OT problem most shops share

There's a manufacturing-specific wrinkle that sits underneath both CMMC and plain risk: operational technology on the same flat network as IT. When the machines, the scheduling system, and the email all share a segment, one phished workstation can reach the shop floor. Carriers ask about this directly, and "same flat network" is a failing answer. Segmentation before you apply is the single control that most often moves a manufacturer's application — and its CMMC posture — from "decline" to "qualify."

If you have no defense work

CMMC simply doesn't apply — but don't read that as "low risk." The loss in manufacturing isn't usually a data breach; it's the line going down. Ransomware that reaches production turns a security incident into a revenue incident, and Verizon's 2026 DBIR found ransomware in 48% of breaches (Verizon DBIR). For a non-defense manufacturer, the same controls CMMC is built from — MFA, managed detection and response, OT/IT segmentation, tested immutable backups — are the right program, just driven by cyber-insurance requirements, customer security attestations, and downtime risk instead of a federal rule.

What to do next

Whether you're chasing certification or just trying not to lose a week of production, the path starts the same way: find out where you actually stand. The Cyber Insurance Readiness Sprint maps your environment against the NIST 800-171 / CMMC control set (and the cyber-insurance questionnaire) in a fixed-scope, seven-business-day engagement, and tells you the gap honestly — including whether you're even in CMMC scope. See the Manufacturing & Industrial security page for how the program runs day to day.

The bottom line

If you handle FCI or CUI on a DoD contract — at any tier — CMMC is in effect and applies to you now, and Level 2 means the 110 controls of NIST 800-171. If you have no defense work, the same controls still protect the thing that actually costs you money: uptime. Either way, the move is to find your real scope and close the gaps before a contract or a carrier forces the issue.

Not sure whether CMMC even applies to your shop? Book a CMMC scope and gap assessment.