CMMC Level 2 Certification for a Precision Machining Supplier
Certified at the C3PAO assessment, keeping the supplier on two prime contractors’ approved lists.
Client name withheld by agreement- Client
- Precision machining supplier to defense primes, 260 employees
- Region
- Cleveland, Ohio
- Year
- 2025
- Duration
- 22 weeks
- Scope
- 110 NIST SP 800-171 practices · 48 CNC machines · 1 GCC High tenant
- Practice
- AI, Cloud & Digital Trust
The challenge
What was at stake.
A precision machining supplier produces flight-critical components for aircraft and missile programs from technical drawings marked as controlled unclassified information. Drawings arrived by email, were printed on the shop floor and loaded onto 48 CNC machines over a flat network shared with the front office.
Two prime contractors told the company it needed CMMC Level 2 certification to stay on their supplier lists. Its IT was run by one administrator and a managed service provider, and its self-assessment score in SPRS was well short of what a certification assessment would accept.
What we did
The approach, step by step.
- 01
CUI followed from inbox to spindle
We traced each drawing from receipt through quoting, CAM programming, machining and inspection, and set an assessment boundary that kept payroll and sales systems out.
- 02
Email and files moved to GCC High
Engineering, quality and purchasing moved to a Microsoft 365 GCC High tenant with labeled CUI libraries, so drawings no longer travel through commercial email.
- 03
Shop floor separated
CNC machines and CAM workstations moved to their own network segment, with transfers allowed only from an approved programming station and removable media controlled by policy.
- 04
MSP responsibilities written into the plan
A shared responsibility matrix sets out which practices the managed service provider performs, with evidence the supplier can produce on request.
- 05
Mock assessment with the floor staff
We tested every assessment objective, including interviews with machinists and inspectors, before the C3PAO arrived.
Outcomes
What changed, in numbers.
- 110
- of 110 practices met
- 48
- CNC machines on a segmented network
- 2
- prime contractor approvals kept
- 22
- weeks from kickoff to certification assessment
Our machinists explained how they handle drawings as clearly as our IT lead did. The assessor told us that was rare.
Services delivered
Related engagements
More work in AI, Cloud & Digital Trust.
-
Boston, Massachusetts · 16 weeks
AI, Cloud & Digital Trust · 2024SOC 2 Type II with Evidence Built into ServiceNow Change RecordsAn unqualified Type II report with zero exceptions, and change-management evidence that now collects itself.
-
New York, New York · 20 weeks
AI, Cloud & Digital Trust · 2026 · OngoingISO/IEC 42001 and Adversarial Testing for a Commercial Underwriting AI PlatformDoctored broker submissions no longer steer risk rankings, and an AI management system is on track for its certification audit.
-
Pittsburgh, Pennsylvania · 22 weeks
AI, Cloud & Digital Trust · 2025Multi-Cloud Security Guardrails for a Regional Health SystemClinical imaging and analytics in two clouds under one set of guardrails, with no change to how radiologists read studies.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.