CMMC for Machine Shops: What Level 1 Actually Means for Your Shop

Quick clarification before anything else, because the letters trip people up: this is about CMMC — the Cybersecurity Maturity Model Certification the Department of Defense now requires — not the CMM (coordinate measuring machine) on your shop floor. Different thing entirely. If a prime contractor or a contract clause just put "CMMC" in front of you, this is for you.

Here's what Level 1 actually means for a machine shop, in plain terms, without the consultant markup.

First: are you even Level 1?

Don't skip this, because for machine shops it's the question that matters most. Your level depends on the kind of government information you handle.

• If you only handle ordinary contract information — purchase orders, delivery schedules, part quantities, the back-and-forth emails about a job — that's Federal Contract Information (FCI), and you're Level 1.
• If you handle Controlled Unclassified Information (CUI), you're Level 2, which is a heavier requirement.

Where this gets real for a shop is drawings and specs. An ordinary, unmarked drawing can be FCI. But a drawing or technical data package marked as controlled — often labeled CUI or controlled technical information — is CUI, and that pushes you to Level 2. A lot of defense manufacturing involves exactly that kind of marked technical data, so check before you assume.

The simple test: look at what your primes actually send you and how it's marked, and check your contract for clauses about handling controlled information. If everything you touch is unmarked contract info, you're Level 1. If marked technical data comes in the door, you're likely Level 2. If you're not sure which side you're on, sort that out first — it changes everything else.

The rest of this assumes you've landed on Level 1.

Where FCI actually lives in a shop

You don't have a data center, and Level 1 doesn't expect one. In a typical shop, the government contract information lives in a handful of ordinary places:

• The office computer where quoting and paperwork happen
• Email
• Wherever you keep job files — a shared folder, a cloud drive, a CAD/CAM workstation
• Maybe a shared computer out on the floor

That's your world for CMMC purposes. Naming it shrinks the problem: you're not securing an enterprise, you're securing a few computers and your email. The fewer places FCI lives, the less you have to think about — so it's worth keeping contract files corralled rather than scattered across every machine in the building.

What Level 1 asks, in shop terms

The 15 Level 1 requirements come down to a short list of practical habits:

• Everyone gets their own login. No single shared password on the front-office or shop-floor PC.
• Antivirus is on and updating. The protection built into your computers usually covers it.
• Keep software patched. Turn on automatic updates for Windows and your main programs.
• Control who gets in — both to the systems and to the building areas where FCI is handled.
• Don't toss old drives or computers without wiping or destroying them first. Deleting files isn't enough.
• Be careful how job files get shared outside the shop. Lock down loose public links and external sharing.

None of that requires deep technical skill. Most of it is settings and habits, plus writing down what you do.

"Do I need special machine shop CMMC software?"

Short answer: almost certainly not. There's no required "CMMC software" for a machine shop, and you don't need to rip out the tools you already run. The email, file storage, and antivirus you use day to day can meet Level 1 if they're set up correctly — and the commercial versions you already pay for are fine, since Level 1 doesn't require any special government edition. The work is configuring and documenting what you have, not buying something new.

You don't need a consultant or an IT department

Level 1 is self-assessed. You work through the requirements for your own shop, a senior person — likely you — affirms the results, and you submit them to a government system called SPRS. There's no outside auditor for Level 1, which means there's no auditor a consultant could satisfy on your behalf. For a shop handling FCI, this is something you can do yourself.

The bottom line

If your machine shop is a Level 1 contractor, CMMC is achievable with the computers and people you already have. Confirm your scope first — especially whether any marked technical data makes you Level 2 — then work the 15 requirements one at a time, fix the small gaps, and document it.

That's far less daunting when the requirements are laid out plainly, one question at a time.

See exactly where you stand on CMMC Level 1.

CMMCheck walks you through every Level 1 requirement as plain-English yes / no / not-sure questions — no consultant, no jargon — and hands you a clear report showing what's done and what's left.

→ Start your Level 1 self-assessment at cmmcheck.com