QuotedPartAnswers · Updated 2026-10-30
What does CMMC mean for a small machine shop?
Price one of your own parts: Drop a STEP model or PDF drawing — about 90 seconds, no account.
Your part priced in about 90 seconds, no account.
CMMC is the Department of Defense’s way to assess required protection of contractor information systems. If your contract involves only Federal Contract Information (FCI), Level 1 uses 15 basic practices; if the system processes, stores or transmits Controlled Unclassified Information (CUI), Level 2 uses the 110 requirements of NIST SP 800-171, with the assessment route set by the contract. The contract and data markings decide the scope. Worked example: a shop that spends 12 hours mapping systems at an illustrative $90/hour internal cost has $1,080 of scoping labor before any technology or assessment expense.
See how QuotedPart connects to your workflow with its API, MCP server, autonomous quoting and shop-specific learning.
Scope the information and the systems
List every place defense information enters, lives and leaves: email, shared drives, estimating software, CAD/CAM workstations, backups, print rooms, subcontractors and customer portals. Mark which records are FCI, which are CUI and which are ordinary commercial data. A small enclave can reduce scope, but only if the process truly keeps CUI out of ordinary systems.
Ask the prime which clauses flow down and whether the specific RFQ contains CUI. A logo or customer name is not a classification. A CUI banner, contract clause or written direction needs a controlled path; an unmarked commercial drawing does not become CUI because the end customer is defense.
| Question | Why it changes the plan |
|---|---|
| What data arrives? | FCI, CUI and commercial data have different requirements |
| Which systems touch it? | Those systems and connected services may be in scope |
| Who needs access? | Least privilege and personnel controls affect the process |
| What does the contract require? | Assessment, affirmation and timing are contract-specific |
| What leaves the shop? | Outside processors and cloud services need review |
Understand Level 1 and Level 2 without guessing dates
The CMMC rule distinguishes Level 1 protection for FCI from Level 2 protection for CUI. Level 1 is a self-assessment against 15 practices. Level 2 assesses the NIST SP 800-171 requirements; depending on the contract, it may be a self-assessment or a third-party assessment. Do not rely on a blog for phase-in dates—read the solicitation and the current rule.
The worked scoping example is intentionally simple: 12 hours to inventory systems and interviews at $90/hour is $1,080. Add policy writing, technical changes, monitoring, training and any assessment quote from your actual plan. This page does not estimate a CMMC certification price.
Make quoting part of the control process
An estimator should know where a controlled drawing may be opened, how it can be shared with an authorized processor and how the final quote is stored. A public upload link, personal mailbox or unmanaged backup can expand scope or violate the contract. Record access, keep revisions and report incidents through the responsible person.
If the shop cannot meet the contract’s handling requirement, say so before receiving more data. A quoting tool can support a controlled process but cannot create your system security plan or make an unsupported certification claim.
What to do next
Name a CMMC owner, ask the prime for the exact flowdown, map data and systems, and write down the boundary. Then fill the gaps in order of contract risk. Keep evidence with the system boundary and review it when a new quoting service, subcontractor or customer file type is introduced.
Illustrative scoping assumptions
- • 12 hours of system and data mapping; internal cost assumption $90/hour.
- • No technology, policy, assessor or certification cost is inferred.
| Measure | Value |
|---|---|
| Mapping labor | 12 h |
| Internal cost | 12 × $90 = $1,080 |
| Other CMMC costs | Not estimated; obtain current quotes |
Sources and limits
Claims are dated where they can change. Product calculations are examples from the stated inputs, not a promise about a customer's quote. Competitor wording is attributed to the source shown.
- The CMMC Level 1 assessment guide describes Level 1 as protection of Federal Contract Information using 15 practices; Level 2 addresses CUI and the requirements of NIST SP 800-171. — source (checked 2026-10-30)
- 32 CFR Part 170 sets the CMMC program requirements and assessment/affirmation framework; the applicable contract determines which level and assessment route applies. — source (checked 2026-10-30)
Price one of your own parts
Drop a PDF drawing or a STEP file. QuotedPart reads the print, measures the model and prices it in seconds, on default shop rates you can change.
Your STEP file or PDF drawingDrop a PDF drawing, a STEP file or both
Free. No account, no email. Priced at our default US rates until you set yours.
Related QuotedPart guides
Answers
CMMC Level 1 or Level 2: which does my machine shop need?
A decision tree for job shops: Federal Contract Information only means CMMC Level 1 (15 requirements, annual self-assessment); Controlled Unclassified Information means Level 2 (110 requirements). Examples and how to find out from your contract.
Answers
What does CUI on a drawing mean for my machine shop?
CUI (Controlled Unclassified Information) on a print means the government has marked the data for protection. What the marking looks like, what a shop must do with it, and what changes in how you quote.
Answers
Does a machine shop need ITAR registration?
What DDTC says about registration for US manufacturers and why registration, export authorization and data handling are separate questions.
Answers
A customer cancelled an order part-way through: what can I charge?
Charge for what you've spent and what you can't recover, stage by stage: material, programming and setup, machining done, finishing. A cancellation schedule on a 100-piece bracket order and the clause wording to put in your terms.