The CMMC Requirements Small Manufacturers Find Hardest, and What to Do About Them

The direct answer: the CMMC requirements that give small manufacturers the most trouble are not the ones defense contractors generally struggle with. They are the four where the 110 requirements of NIST SP 800-171 Rev 2 collide with production reality: configuration management and flaw remediation on equipment that cannot be patched, media protection for CUI that arrives as CAD files and travelers, access control on systems designed around shared accounts, and FIPS-validated cryptography on machines that cannot support it.

Every one of these is a scoping problem before it is a control problem.

The patching constraint is real, and it is not a waiver

A CNC controller running a vendor-locked operating system, a coordinate measuring machine whose software is validated as a unit, a press with an embedded controller the manufacturer will not support if modified. In each case, normal patch cadence is either impossible or commercially unacceptable.

This does not remove the requirement. It changes how the requirement is met. The workable pattern is segmentation plus compensating control: isolate the equipment onto its own network segment, tightly restrict what may reach it, monitor the boundary, and document the constraint and the compensating measures in the System Security Plan. An assessor is looking for managed and documented risk. An undocumented gap is the problem, not the constraint itself.

CUI in manufacturing does not look like CUI in an office

In most defense contractors, CUI lives in documents and email. In a machine shop it lives in the drawing package, the CAD or CAM file, the router or traveler that follows the job, the first article inspection report, and often a print taped to a machine.

That distribution is what makes media protection genuinely hard. Removable media is frequently how files reach equipment that is deliberately not networked. The requirement is not "ban USB drives," which is often impossible without stopping production. It is control, marking, and accountability over the media that carries CUI, with sanitization before reuse or disposal.

Manufacturers who handle this well usually did one thing first: they mapped where CUI physically travels through the plant, including on paper. That map is what makes the boundary decision possible.

Shared accounts on the floor

Production systems are often built around a shared operator login because shifts rotate and stopping to authenticate costs cycle time. CMMC Level 2 expects individual accountability, and the requirements around identification, authentication, and least privilege assume you can attribute action to a person.

Where individual accounts are genuinely infeasible on a machine, the path is again compensating: physical access control to the cell, logging at the network and file-transfer layer rather than the machine layer, and documented justification. Where they are feasible and merely inconvenient, assessors tend not to be sympathetic.

Segment the plant, shrink the assessment

The manufacturers who get through CMMC Level 2 without disproportionate cost are almost always the ones who stopped treating the plant network as one flat environment. A segmented design, with a defined enclave where CUI is received, processed, and staged, can take the majority of production equipment out of scope entirely.

This is the same architectural discipline that IT and OT convergence demands for other reasons, which is why it tends to pay for itself beyond the contract. For the broader OT framing, see IEC 62443 vs NERC CIP and Industrials and OT.

Where this sits today

Phase 1 of the CMMC rollout is live as of July 13, 2026, which means Level 1 or Level 2 self-assessment at award. Phases 2 through 4 are on hold, including the expansion of third-party C3PAO assessment that had been scheduled for November 10, 2026. The 110 requirements are unchanged. A manufacturer that uses this window to fix scoping and segmentation will be in materially better shape than one that waits for the phase schedule to resume.

Related reading: CMMC Level 2 Requirements for Small Business and NIST 800-171 vs CMMC.

How Z Cyber approaches this

Z Cyber works as a cybersecurity operating partner. For manufacturers that means the scoping and segmentation decision is led by a named Executive Security Advisor who has seen the tradeoff between assessment surface and production disruption, the program state lives in Glance so the SSP matches the plant as it actually runs, and remediation is delivered rather than recommended and left. We advise and implement. The manufacturer accepts the risk and owns the decision. See Defense and Government.