CMMC for Small Manufacturers: A Plain-English Guide

If you’re running a small defense manufacturing company, CMMC is no longer a future problem. As of November 10, 2025, cybersecurity certification requirements are live in new DoD solicitations. If you bid on or perform DoD contracts, this affects you — and the window to act without losing business is closing.

This guide explains what CMMC requires for small manufacturers, which level applies to your shop, what it realistically costs, and where to start.

What Is CMMC?

CMMC stands for Cybersecurity Maturity Model Certification. It’s the Department of Defense’s program to verify that contractors actually protect sensitive government data — rather than just self-reporting that they do.

The program has three levels:

• Level 1 — 17 basic cybersecurity practices. Annual self-attestation. No third-party auditor required.
• Level 2 — 110 practices mapped to NIST SP 800-171. Third-party assessment by a certified assessor (C3PAO). Required for most manufacturers handling technical data.
• Level 3 — Advanced security for critical programs. Government-led assessment. Rare; applies to a small subset of the Defense Industrial Base.

Most small manufacturers handling engineering drawings, specifications, or test data need Level 2.

Does CMMC Apply to Your Shop?

If your contracts involve Controlled Unclassified Information (CUI) — which includes technical drawings, engineering specs, design data, and anything the DoD marks as sensitive — you need Level 2 certification.

Not sure if you handle CUI? The National Archives CUI Registry lists every category. In practice: if a foreign adversary would benefit from seeing the data you work with, assume it’s CUI.

Federal Contract Information (FCI) — routine contract data like schedules and invoices — triggers a lighter requirement: Level 1 self-assessment only.

Use our CMMC readiness assessment to determine your level in under 10 minutes.

The Timeline: Where We Are Now

• December 16, 2024 — 32 CFR Part 170 final rule effective. CMMC program officially established.
• November 10, 2025 (Phase 1 — Active Now) — CMMC Level 1 and Level 2 self-assessments are conditions of award on applicable new contracts. Affirmations required in SPRS.
• November 10, 2026 (Phase 2) — Third-party C3PAO certification becomes broadly mandatory for prioritized Level 2 acquisitions.
• November 10, 2028 — Full rollout complete across all DoD contracts.

Phase 1 is live. Contracting officers can already require CMMC compliance as a condition of award on new solicitations. See our CMMC Phase 2 enforcement guide for what changes in November 2026 and how to prepare.

What Does Level 2 Actually Require?

CMMC Level 2 maps to the 110 security requirements in NIST SP 800-171, evaluated across 320 individual assessment objectives covering access control, audit logging, configuration management, incident response, media protection, and multi-factor authentication.

You also need documented artifacts: a current System Security Plan (SSP), Plans of Action & Milestones (POA&M), asset inventory, network diagrams, training records, and incident response procedures. Missing documentation alone will fail an assessment — even if your technical controls are solid.

For detail on the specific contract clauses governing these requirements, see our DFARS clauses guide.

What Does It Cost?

Cost is the first question every CEO asks — and the honest answer is: more than most small manufacturers expect.

Based on industry data and DoD cost analysis:

For a small manufacturer (1–100 employees) reaching Level 2:

Component	Low	High
Gap assessment	$5,000	$15,000
Technology/infrastructure	$20,000	$100,000
RPO consulting	$15,000	$50,000
C3PAO assessment	$30,000	$100,000
Internal labor	$10,000	$50,000
Year 1 Total	$80,000	$315,000
Ongoing annual	$25,000	$60,000

Industry surveys show most small manufacturers expect to spend up to $50,000 — but more than half say costs above $100,000 would make compliance unworkable. The gap between expectation and reality is a problem many shops discover far too late.

The math usually justifies it. For a manufacturer with $1.5M in annual DoD revenue, a $120,000 compliance investment protects $4.5M over a three-year contract cycle — payback under two months of DoD revenue.

Use our CMMC cost guide to build a more precise estimate for your situation.

The Assessor Bottleneck

There are roughly 97 certified C3PAOs serving an estimated 80,000 contractors needing assessment — a structural supply crunch. Assessment fees are projected to double by late 2026 as demand outstrips supply.

Companies that started in late 2025 are locking in lower fees and shorter wait times. Companies starting in mid-2026 will face premium pricing and may miss Phase 2 windows.

For guidance on finding and evaluating an assessor, see our how to find a C3PAO guide.

Where to Start

If you’re not sure where your shop stands, that’s the first thing to fix. Most manufacturers haven’t done a formal gap assessment — which means they don’t know how far they are from audit-ready or what it will cost to close the gap.

Start here: Take our free CMMC assessment →

It covers the 20 questions most relevant to small manufacturers and gives you a working picture of your readiness gap in under 10 minutes.

---

Frequently Asked Questions

Do small manufacturers really need CMMC, or is this only for large primes?

CMMC applies to any company in the DoD supply chain handling FCI or CUI — regardless of size. 73% of the Defense Industrial Base is small businesses. If you’re a sub-tier supplier, your prime contractor is also required to flow CMMC requirements down to you under DFARS 252.204-7021. For a detailed breakdown of how this works, see our CMMC for subcontractors guide.

How long does CMMC Level 2 certification take for a small manufacturer?

Industry consensus is 6–12 months for a company with baseline security already in place. Starting from scratch — no documentation, no SSP, no formal policies — typically runs 12–18 months. Companies aiming to bid on new contracts in 2027 need remediation underway now, before Phase 2 enforcement locks in.

Can we handle CMMC compliance ourselves without hiring a consultant?

Technically yes, but it’s difficult in practice. Level 2 requires 110 controls, 320 assessment objectives, and documentation most small shops have never maintained. Most manufacturers either engage an RPO (Registered Practitioner Organization) or work with an MSP that specializes in defense. See our how to choose a CMMC consultant guide before you hire anyone.

What happens if we’re not compliant when a contract renews?

You won’t be eligible for award. Under Phase 1, contracting officers can require CMMC as a condition to exercise option periods on existing contracts — meaning non-compliance can end relationships you’ve held for years, not just block new bids. There is also False Claims Act exposure if a company affirmed compliance in SPRS inaccurately; the DoJ Civil Cyber-Fraud Initiative has been active since 2021 pursuing exactly these cases.

---

Ready to see where your shop stands? Start your free CMMC assessment →