CAD/CAM workstations holding engineering drawings
CAD/CAM workstations holding engineering drawings
No. 01
Why CMMC Level 2 typically applies.
Subcontractor agreements under DFARS 252.204-7012 obligate flowdown of cybersecurity and CUI-handling requirements. When the prime is a CMMC Level 2 organization, the sub typically inherits the same obligations for the portion of work that touches CUI.
DBIT Defense does not interpret control intent on this page. The above is a factual summary of regulatory provisions; refer to NIST SP 800-171 Rev. 2 and 32 CFR Part 170 for the source text.
No. 02
Typical in-scope systems we see.
production traveler and routing systems
production traveler and routing systems
quality records (FAI, CoC) storage
quality records (FAI, CoC) storage
subcontractor portals exchanging CUI
subcontractor portals exchanging CUI
Illustrative only. Actual scope for any contractor depends on the specific contract clauses, the CUI types in play, and the systems that handle them.
No. 03
Services for aerospace suppliers.
01
Service
CMMC Gap Assessment
A clear, control-by-control read on where your environment falls short of CMMC Level 2 — and what closing the gap will take.
02
Service
SSP & POA&M Development
System Security Plans and Plans of Action & Milestones that reflect how your environment actually operates — written in language assessors recognize.
03
Service
Remediation Support
Hands-on closure of the technical and procedural gaps that an assessor will fail you on — sequenced so the highest-impact items land first.
04
Service
Managed Compliance for Level 2
A monthly retainer that maintains your SSP, POA&M, evidence library, training cadence, and readiness score between annual obligations and triennial assessment cycles.
05
Service
C3PAO Assessment Preparation
Stakeholder rehearsals, evidence packaging, and walkthroughs that let your team enter a formal assessment knowing what is being asked and why.
No. 04
Where aerospace suppliers cluster.
No. 05
Other industries we serve.
01
Industry
Marine Systems Contractors
Marine systems integrators, vessel maintenance contractors, and port-logistics firms supporting Navy and Coast Guard programs are increasingly in CMMC scope.
02
Industry
Electronics Manufacturers
Electronics manufacturing services (EMS) firms, PCB fabricators, and electromechanical assembly shops that ship to defense primes typically need CMMC Level 2.
03
Industry
IT & Cybersecurity Subcontractors
IT services firms, software contractors, and cybersecurity consultancies that work under DoD primes are themselves in scope for CMMC Level 2.
04
Industry
Defense Logistics & Sustainment
Sustainment, base-support, warehousing, and distribution contractors handling defense supply chains routinely encounter CMMC Level 2 obligations.