CMMC compliance for shops that make the parts.
Small East Tennessee defense suppliers need the CMMC controls built, documented, and kept running. That's the work we do. We're not an assessor. We're the people who make the assessment boring.
Corey Watson · Managing Member, Limehawk•Updated Oct 2026•6 minWhat do CMMC compliance services actually include?
CMMC compliance services from us are the IT side: we build the Level 1 or Level 2 technical controls, document how each one is met in your System Security Plan, track open items on a POA&M, and keep it all running month to month so the score you affirm stays true. We are not a C3PAO, an RPO, or an assessor. We’re the team that makes the environment pass.
In practice that means:
- Scoping first. Where FCI and CUI actually live, and whether a CUI enclave or GCC High shrinks the job.
- Network segmentation. The office, the CUI environment, and the shop floor on separate segments, so a phished laptop can’t reach a controller.
- MFA everywhere it’s required, enforced, not just available.
- Encryption on laptops and wherever CUI is stored.
- Logging and monitoring that someone actually reads, with the records kept.
- SSP and POA&M evidence. Each requirement written up the way it’s really configured, with screenshots and dates, not intentions. See our SSP guide and POA&M guide.
- Keeping it running. Patching, monitoring, onboarding and offboarding under our managed IT, so next year’s affirmation isn’t a fire drill.
Which CMMC level does my shop need?
It depends on what the contract hands you. If you only handle Federal Contract Information, purchase orders and contract details, you’re at Level 1: 15 basic safeguarding requirements and an annual self-assessment. If you receive Controlled Unclassified Information, like controlled technical drawings, you’re at Level 2: the 110 requirements in NIST SP 800-171 Rev 2. Not sure which data you have? Start with what counts as CUI and what counts as FCI.
Where does CMMC stand right now?
CMMC has been in DoD contracts since November 10, 2025 (Phase 1). On July 13, 2026, DoD suspended the move to Phase 2 while it reviews the program, so new contracts are limited to Level 1 and Level 2 self-assessments for now. The self-assessment requirements stay in force. The full picture is in our CMMC overview. The pause is a window to get the controls in place, not a reason to wait.
Why a machine shop is harder than an office
Most CMMC advice assumes every computer can be patched and replaced. Shops don’t work that way. The CNC controller on Windows 7 runs fine and isn’t going anywhere. The CMMC rule treats that kind of equipment as a Specialized Asset, and the answer is isolation and documentation, not a rip-and-replace. We already support Windows XP and 7, SCADA, and plant-floor networks for our manufacturing clients, so the shop floor is the part we’re used to.
How we work
Month-to-month managed IT, 3-user minimum, no multi-year contract. Critical issues get a response in under 15 minutes. CMMC build-out is scoped on a call once we know your level, your data, and your current setup.
Book a call and we'll scope what your shop needs for Level 1 or Level 2.
CMMC compliance, plainly
Straight answers about fit, scope, and how we work.
Send a message →Are you a CMMC assessor or RPO?
No. We're not a C3PAO, an RPO, or a certified assessor. We build and run the IT controls, document them in your SSP, and keep them working. You or your assessor do the assessment.
Do you do Level 1 and Level 2?
Yes. Level 1 is the 15 safeguarding requirements for Federal Contract Information. Level 2 is the 110 NIST SP 800-171 Rev 2 requirements for CUI. We implement both.
Do we need GCC High?
Not always. It depends on whether you hold CUI, what kind, and how your contracts are written. Sometimes a small CUI enclave is the simpler answer. We walk through it on the call, and our GCC High guide covers the tradeoffs.
Can you help with our SSP and POA&M?
Yes. We write up how each requirement is actually met in your environment, with evidence, and track open items on a POA&M. We don't sign your affirmation; that stays with your company.
We have old machines on the shop floor. Is that a problem?
Not by itself. Equipment that can't be fully secured is treated as a Specialized Asset under the CMMC rule. We isolate it, segment it, and document it. We already support Windows XP and 7 and SCADA on plant floors.
What does it cost?
Managed IT is month-to-month with a 3-user minimum and no multi-year contract. CMMC build-out is scoped on a call once we know your level and your setup.