CMMC & NIST 800-171 Readiness for Indiana Manufacturers

Who This Is For

Machine shops, fabricators, electronics assemblers, RV and trailer component makers and other manufacturers in Elkhart, South Bend, Plymouth, Warsaw, Goshen and across Northern Indiana that are in the defense supply chain — usually two or three tiers down from the prime — and have received a DFARS clause, a CMMC flow-down letter, or a request for an SPRS score. Typically 10 to 150 employees, no dedicated IT or compliance staff, and a very real risk of losing the contract if the answer is wrong.

The Problem: The Requirement Flows Down, the Expertise Doesn't

The Department of Defense requires that Controlled Unclassified Information — drawings, specifications, technical data — be protected wherever it goes. CMMC is how the DoD now verifies that, and it reaches every supplier that touches CUI, no matter how small. The primes have compliance departments. Their suppliers have an owner, an office manager and whoever is "good with computers." The requirement arrived; the budget, the people and the plain-English explanation did not.

The result we see most often: a manufacturer self-attests to a score it can't support, or spends money on tools a vendor said were "CMMC compliant" (no tool is — only an organization can be), or tries to secure the entire plant when only four workstations ever see a controlled drawing. All three are expensive. None of them are necessary.

CMMC in Plain English

The 110 Level 2 requirements cover 14 families — access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity. About a third are technical settings; the rest are policies, procedures and evidence that you follow them.

What We Do

• Scoping — identify exactly where CUI enters, lives and leaves, and design the smallest enclave that contains it. This is the step that determines the cost of everything after it.
• Gap assessment — every one of the 110 requirements scored Met / Not Met / Not Applicable, with evidence, producing your honest SPRS score and a prioritized gap list.
• Remediation plan with costs — phased, fixed-price, approved one phase at a time. Technical fixes (MFA, logging, segmentation, encryption, endpoint protection, GCC/GCC High migration where needed) and the policies and procedures to match.
• System Security Plan (SSP) and POA&M — the two documents assessors actually read, written for your environment, not copied from a template.
• Evidence collection — screenshots, logs, training records and sign-offs organized so an assessment is a review, not a scramble.
• SPRS submission — the score, the date and the plan, submitted correctly.
• Ongoing operation — the controls run as part of your managed IT agreement: monitoring, logging, patching, access reviews, annual training, so you stay ready between assessments.
• Assessment support — when a C3PAO assessment is required, we prepare you for it and sit in on it.

How It Goes

1. Read the contract. Which clauses, which level, which deadline, and whether ITAR applies. Half of the confusion ends here.
2. Trace the CUI. Which customers send it, which people open it, where it's saved, which machines read it, who it goes out to. Then draw the enclave around that.
3. Assess. Two to four weeks for a small shop, including interviews, configuration review and evidence gathering. You get the gap list and the real SPRS score.
4. Remediate in order. Highest-weighted gaps first (the SPRS methodology weights some requirements at 5 points, most at 1), scheduled around production.
5. Document. SSP, POA&M, policies, procedures, training records — built as the work is done, not afterward.
6. Operate and re-check. Controls become routine; an annual internal review keeps the score true.

Pricing

The scoping and gap assessment is a fixed-price engagement. Remediation is quoted as a phased fixed-price plan after the assessment, because the cost depends almost entirely on how small the CUI enclave can be made. Ongoing operation of the controls is covered under a managed IT agreement. If a third-party assessment is required, the C3PAO's fee is separate and we'll tell you what to budget for it. Hourly consulting follows our published rates.

Related

Managed IT for manufacturers · All compliance services · Cybersecurity services · Cyber-insurance readiness · AI usage policy and governance · IT services in Elkhart

From the blog: CISA's Cybersecurity Performance Goals 2.0: A 2026 Action Plan for Northern Indiana SMBs · Four Compliance Gaps That Cost Businesses Money