Understanding CMMC Requirements Across the Defense Supply Chain

Defense procurement teams already evaluate suppliers for manufacturing capability, quality systems, capacity, and documentation. CMMC adds another consideration much earlier in the sourcing process: what controlled information will a supplier need to receive to quote or manufacture the part, and where will that information go once it enters the supply chain?

At Waukesha Metal Products, we may receive drawings, CAD design files, technical specifications, inspection requirements, or other contract information as part of defense work. Some information may qualify as Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). When it does, the cybersecurity requirements tied to the contract can extend to manufacturers and sub-tier suppliers whose systems process, store, or transmit it.

Procurement teams therefore need to understand the information path alongside the manufacturing path. Knowing who will handle sensitive information and where it needs to go can uncover cybersecurity requirements before work is awarded or technical files begin moving between suppliers.

Read on as we explain how CMMC requirements extend through the defense manufacturing supply chain and what procurement teams should consider when evaluating suppliers.

What Does the CMMC Framework Protect?

The Cybersecurity Maturity Model Certification, or CMMC, framework provides a way to assess how companies within the defense industrial base protect government information.

Federal Contract Information is nonpublic information provided by or generated for the federal government under a contract to develop or deliver a product or service. Controlled Unclassified Information requires additional safeguarding or dissemination controls under applicable law, regulation, or government-wide policy.

In manufacturing, the difference affects how project information must be handled. A file may contain the dimensions and specifications needed to make a component, but its use on the production floor doesn’t determine its cybersecurity classification. Contract requirements and the type of information being provided determine the protections that apply.

Under current CMMC certification defense supply chain requirements, Level 1 addresses FCI and is based on the basic safeguarding requirements in FAR 52.204-21. Level 2 addresses CUI and aligns with the 110 security requirements in NIST SP 800-171 Revision 2.

Procurement teams should establish what information a supplier will receive before determining how CMMC affects the sourcing decision.

How Do CMMC Flowdown Requirements Reach Subcontractors?

A defense component may require work from companies beyond the prime contractor or direct supplier. Cybersecurity requirements need to account for those relationships when protected information accompanies the work.

DFARS 252.204-7021 requires contractors to flow the appropriate CMMC requirement into applicable subcontracts and other contractual instruments. Contractors must also verify the required CMMC status, reducing defense supply chain risk for OEMs, before awarding a subcontract when the receiving supplier’s systems will process, store, or transmit FCI or CUI.

The requirement depends on the information provided to the subcontractor.

Consider a fabricated component that requires an outside finishing process. A processor may be able to complete the work using limited production information. Another operation could require access to a controlled drawing or technical specification. Each production route creates a different information path, even when the physical part ends up in the same place.

We believe those details should be understood before the work moves downstream. Giving a supplier only the information needed for its operation can reduce unnecessary exposure of protected data and make responsibilities easier to define.

What Does a Supplier’s CMMC Status Actually Cover?

A general statement about CMMC readiness doesn’t tell a procurement team everything it needs to know.

CMMC requirements apply to the contractor information systems used in contract performance that process, store, or transmit FCI or CUI. Contractors must maintain the required status for those systems throughout the contract.

Scope becomes especially important when a manufacturer operates multiple facilities, US and USMCA dual-shore manufacturing facilities or uses different systems across its operations

Procurement should know where the work will take place and where protected information will be accessed. A cybersecurity assessment associated with a defined system environment should not automatically be interpreted as covering every location, system, or possible production path within a company.

The same principle applies when a project changes. Moving an operation to another location or adding an outside supplier may change where information needs to go. Cybersecurity review should follow those changes rather than remain tied to assumptions made during the original sourcing decision.

Start With the Information Needed to Do the Work

We see the strongest supplier discussions begin with a clear understanding of what information is actually required.

Quoting may require one set of files. Once the project moves into production, manufacturing engineering or quality personnel may need additional specifications, revision-controlled drawings, inspection criteria, or other customer documentation. As the project progresses, more people and systems may need access to controlled information.

Identifying FCI or CUI at the appropriate point allows manufacturers to manage it within the systems designated for protected information.

Procurement teams should also consider access at the sub-tier level. An outside supplier performing a limited secondary operation may not need the full technical data package. If protected information is necessary, the applicable cybersecurity requirements need to be addressed before the subcontract is awarded.

A clear information path gives both sides a more accurate picture of the work before production begins.

Review Cybersecurity Alongside the Manufacturing Route

Supplier qualification works best when the cybersecurity review reflects how the component will actually be produced.

At WMP, a defense project may involve manufacturing and machining complex defense components including metal stamping, fabrication, welding, assembly, or in-house tooling support depending on the part requirements. Most production routes can remain within our capabilities, while others may involve an outside process specified by the customer or required for the finished component.

Where the work goes matters when protected information has to go with it.

Procurement teams should establish which operations will be performed by the direct supplier and identify expected outside processing early. If another company needs FCI or CUI to perform its portion of the work, CMMC flowdown requirements need to be considered for that relationship as well.

Revision control deserves the same attention. Long-running defense projects can experience drawing or specification changes over time. New revisions still need to follow the appropriate information path as they move into manufacturing and inspection.

Confirm Current CMMC Status, not a Past Milestone

CMMC status includes ongoing requirements rather than serving as a permanent credential earned once.

DFARS 252.204-7021 requires contractors to maintain the applicable CMMC status across their quality management system and covered IT networks during contract performance and complete an annual affirmation of continuous compliance in SPRS. Applicable subcontractors have corresponding affirmation requirements for the systems used to perform their work.

Procurement teams should therefore evaluate the status associated with the work being sourced at the time of award.

Changes to the production route deserve another look as well. A new subcontractor or a change in how sensitive information is handled impacts reducing defense supply chain risk even when the part design itself remains unchanged.

What Does the Current CMMC Phase II Suspension Mean?

CMMC Phase I began on November 10, 2025. On July 13, 2026, the Department paused the planned transition to Phase II while it reviews the framework.

During the pause, procurement requirements may designate CMMC Level 1 self-assessments or CMMC Level 2 self-assessments. Level 2 C3PAO and Level 3 DIBCAC assessment designations are paused for this period. The Department has also stated that existing cybersecurity requirements under DFARS 252.204-7012 remain in effect and that it will continue addressing NIST SP 800-171 Revision 2 compliance through self-assessments and selected government-led assessments.

In practical terms, the implementation schedule has changed, but cybersecurity still belongs in defense supplier qualification.

Procurement teams still need to determine what protected information a supplier will receive and how applicable contract requirements extend through the supply chain. Those questions remain relevant even as the CMMC rollout continues to evolve.

How CMMC Fits into Defense Supplier Qualification

Cybersecurity is one part of a larger sourcing decision.

We support defense customers with metal stamping and fabrication capabilities across our stamped assemblies and product portfolio, as well as machining, welding, assembly, prototyping, and in-house tool and die resources. Our quality systems support formal validation requirements through documentation such as PPAP and FMEA submissions, capability studies, control plans, and traceability documentation as required by the customer.

Our Grafton, Wisconsin facility maintains ITAR registration under our official DDTC ITAR Registration Letter M34405, and we continue to advance our CMMC readiness efforts. We’re in the final stages of achieving Level 2 CMMC certification.

For procurement teams, addressing cybersecurity early creates a clearer sourcing picture. Information requirements can be matched to the manufacturing route before controlled files move between companies, and any necessary supplier flowdowns can be addressed before they become a production issue.

Defense manufacturing requires control over the part as well as the information used to produce it. We encourage customers to request a CMMC-compliant defense metal stamping quote or discuss these requirements with us early so we can understand how the work will be manufactured and how protected information will need to be handled.

Learn more about Waukesha Metal Products’ defense manufacturing capabilities.

Read more about our technical defense manufacturing insights.