CMMC Was Built for the Front Office. The Department Is Now Looking at the Shop Floor.

A stolen engineering drawing can expose valuable intellectual property. It may allow an adversary to copy a design, study a capability, or gain insight into a defense program.

A compromised CNC machine creates a different problem. If it cannot operate safely or reliably, the parts it produces may stop moving through the supply chain.

That distinction matters as the Department of War presses industry to increase production of munitions, missiles, drones, and other defense capabilities. Protecting technical information remains essential. So does keeping the equipment that turns those designs into finished products running.

For manufacturers, cybersecurity is no longer only a question of protecting files in the engineering office. It is also a question of whether production can continue after an incident on the shop floor.

Why the conversation is shifting toward the shop floor

Operational technology (OT) includes the programmable systems and devices that monitor or control physical processes: CNC controllers, programmable logic controllers (PLCs), human-machine interfaces (HMIs), robotics, industrial gateways, and related equipment.

These systems have different constraints than office IT.

A laptop may be patched overnight. A production controller may require coordination with the equipment manufacturer, an approved maintenance window, validation of process settings, and a safe restart sequence.

The distinction becomes even more significant when equipment supports a production schedule that cannot tolerate unexpected downtime.

The shift was visible at CS5 East in October 2026, where sessions explored the practical challenges of protecting Controlled Unclassified Information (CUI) on manufacturing floors and the Department's Brilliant at the Basics guidance.

The Department of War CIO's initiative includes a distinct OT Top 10 covering inventories, identity and access management, network segmentation, vendor remote access, vulnerability management, recovery, and monitoring.

Its significance is not that it establishes a second certification program.

It recognizes that protecting manufacturing operations requires security decisions that account for the equipment, people, and processes responsible for production.

CMMC reform: What is required today, what is guidance, and what may change?

One important distinction is getting lost in the conversation about CMMC reform:

The CMMC program is not paused. The Department suspended the implementation of Phase II while it reviews and reforms the program.

That distinction matters because manufacturers still have cybersecurity responsibilities today.

1. Existing cybersecurity requirements remain in effect

On July 13, 2026, the Department suspended the planned expansion of CMMC Phase II requirements, originally scheduled for November 10, 2026.

That action did not eliminate existing Phase I self-assessment requirements or applicable contractual cybersecurity obligations.

Defense contractors handling covered defense information remain subject to applicable DFARS requirements, including NIST SP 800-171 obligations under DFARS 252.204-7012.

The Department has also stated that self-assessments and select government-led assessments will continue.

These government assessments are distinct from the expanded third-party certification requirements that would have become conditions of award under Phase II.

For organizations operating systems within an applicable NIST SP 800-171 Revision 2 assessment boundary, remote access and network protection are already addressed by existing security requirements.

For example:

Requirement 3.1.12 addresses monitoring and controlling remote-access sessions.

Requirement 3.1.14 addresses routing remote access through managed access control points.

Requirement 3.1.15 addresses authorizing remote privileged commands and access to security-relevant information.

Requirement 3.13.1 addresses monitoring, controlling, and protecting communications at external and key internal system boundaries.

Requirement 3.13.5 addresses separating publicly accessible system components from internal networks.

These requirements are not proposals for future reform. They are part of the existing Revision 2 security baseline where applicable.

Their implementation depends on the organization's assessment scope and system architecture.

2. Current OT guidance supports stronger operational security

The Department's Brilliant at the Basics OT Top 10 provides practical cybersecurity guidance for industrial environments.

It is not, by itself, a new CMMC assessment level or an additional set of mandatory certification requirements.

Some recommendations reinforce existing NIST SP 800-171 requirements. Others address operational risks that can extend beyond a particular CUI assessment boundary.

That distinction matters for manufacturers.

A production system may require additional safeguards because its failure would interrupt operations, even when its treatment under CMMC differs from that of a conventional CUI Asset.

3. Reform is underway, but future requirements are not yet established

The Department has initiated a broader review of CMMC, including its implementation costs, assessment approach, and effectiveness in addressing cybersecurity risk.

Operational technology and continuous security monitoring have emerged as important themes in that discussion.

The Cyber AB has also emphasized that the CMMC program continues to operate while reforms are considered.

However, discussions at town halls, industry events, and within the assessment community should not be mistaken for final regulatory changes.

Until the Department formally announces and implements revised requirements, manufacturers should distinguish proposed reforms from obligations that already apply.

The practical response is to meet today's requirements while making security improvements that will remain valuable regardless of how CMMC evolves.

OT is not automatically outside CMMC scope

For manufacturers, one of the most important distinctions is how operational technology is classified within a CMMC assessment.

Calling equipment "OT" does not automatically exempt it from the program.

Under 32 CFR § 170.19, certain OT devices that can process, store, or transmit CUI but cannot be fully secured may qualify as Level 2 Specialized Assets.

These assets are included within the Level 2 assessment scope.

They must be identified in the asset inventory, addressed in the System Security Plan (SSP), included in the relevant network diagram, and managed using documented risk-based security policies and practices.

Their assessment treatment differs from conventional CUI Assets. For qualifying Level 2 Specialized Assets, assessors review the SSP rather than automatically testing the device against every Level 2 security requirement.

Other manufacturing systems may be classified as CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, or out-of-scope assets, depending on their actual functions, connections, and relationship to CUI.

Consider an engineering workstation that receives a controlled drawing, software that prepares a CNC toolpath, and a machine controller that receives the resulting program.

Determining the appropriate assessment scope requires understanding which systems process, store, or transmit CUI, what information reaches the controller, and how the systems interact.

The equipment's location on the shop floor does not settle the question.

Neither does its classification as industrial equipment.

The correct approach follows the actual information flow and the applicable asset-scoping criteria.

Where we'd start: Meet existing requirements and protect production

Our recommendation is not based on predicting what CMMC reform will require next.

It starts with understanding the organization's current contractual responsibilities, then identifying operational exposures that could affect production even beyond those requirements.

For many manufacturers, that work begins with four practical steps.

1. Validate the assessment boundary and CUI information flow

Before making infrastructure changes, confirm which systems fall within the applicable CMMC assessment scope.

Trace how CUI moves between engineering workstations, file storage, manufacturing applications, machine controllers, and external service providers.

Document the appropriate asset categories and make sure the SSP reflects the actual environment.

This establishes which protections are required for compliance and where additional operational risk analysis may be appropriate.

2. Build an accurate OT and remote-access inventory

Bring together operations, engineering, IT/security, maintenance personnel, and relevant equipment vendors.

Walk the production environment rather than relying exclusively on diagrams developed during installation.

The inventory should identify equipment and controller types, system owners, available firmware versions, critical production dependencies, connected workstations, and relevant network connections.

Separately, document how equipment manufacturers and outside service providers access those systems.

Record the access method, authorized accounts, approval process, systems reachable through the connection, monitoring capabilities, and how access is revoked.

These inventories support existing documentation and security obligations while revealing operational dependencies that may otherwise go unnoticed.

3. Engineer and validate network segmentation

Network segmentation is the practice of separating systems into controlled network areas and restricting the communications allowed between them.

For example, a plant may need to prevent a compromised office workstation from communicating directly with CNC controllers, while still allowing approved production data to reach those machines.

A flat network is one where systems have broad connectivity to one another with few internal restrictions. That arrangement can make it easier for an incident affecting one device to reach other systems.

Segmentation can reduce that exposure.

But implementing it is not as simple as adding a firewall or changing a switch setting.

It requires a network engineer to understand equipment communications, production data flows, vendor connections, dependencies between systems, and the operational consequences of blocking traffic.

The engineer must then design appropriate network boundaries, configure routing and access rules, test necessary communications, and coordinate implementation with operations.

Changes may need to occur during scheduled maintenance windows to avoid interrupting production.

For systems subject to applicable NIST SP 800-171 requirements, protecting external and key internal boundaries is already part of the existing security baseline, particularly Requirement 3.13.1.

Requirement 3.13.5 specifically addresses separated subnetworks for publicly accessible system components.

The precise network design should be based on those applicable requirements, the assessment boundary, and the facility's operational needs.

Segmentation is a substantive engineering project—not a quick checklist item or a requirement manufacturers should defer while waiting for reform.

4. Establish vulnerability management and recovery procedures that work in production

Industrial equipment cannot always be patched on the same schedule as office computers.

A controller update may require manufacturer approval, process validation, or downtime that must be coordinated around production commitments.

Organizations should identify known vulnerabilities, determine which systems are exposed, and establish appropriate mitigation measures when immediate patching is not feasible.

Those measures may include restricting access, isolating vulnerable equipment, or applying other protections that reduce the likelihood and consequences of compromise.

Recovery planning is equally important.

Operations, engineering, and security teams should know who can isolate an affected system, which backups and controller configurations are available, how process settings will be validated, and who authorizes a safe restart.

A recovery plan that restores a server but cannot safely restart the production line does not fully address the manufacturer's business risk.

The question is bigger than certification

CMMC establishes important responsibilities for protecting sensitive defense information.

Manufacturing resilience introduces another consideration: what must continue operating for the company to meet its delivery commitments?

Those responsibilities overlap, but they are not identical.

A manufacturer may have a well-defined CUI assessment boundary while also depending on production equipment whose availability is critical to contract performance.

An engineering drawing stolen by an adversary can expose sensitive intellectual property.

A compromised CNC controller can prevent critical parts from being made, inspected, or delivered.

Both are cybersecurity concerns. They create different operational consequences.

That is why the Department's increased attention to OT matters.

Cybersecurity in manufacturing is not only about preventing information from leaving the organization.

It is also about protecting the systems needed to produce what customers and defense programs depend upon.

Our view: Build security that survives reform

Manufacturers should not wait for CMMC reform to finish before addressing existing requirements or known production vulnerabilities.

Nor should they launch a second, expensive compliance initiative based on predictions about rules that have not been finalized.

A more durable approach connects three responsibilities:

Compliance: Accurately identify the systems and information subject to applicable cybersecurity requirements.

Engineering: Design and implement controls that protect those systems and their communications without disrupting legitimate production.

Operations: Establish ownership, monitoring, maintenance, and recovery processes that support the plant over time.

This work requires cooperation between leadership, IT, engineering, production teams, and equipment vendors.

It also requires the judgment to distinguish an assessment requirement from a broader operational risk—and to address both appropriately.

The most useful question for a manufacturing leader is straightforward:

If an outside connection or production controller were compromised tonight, which operations could be affected, and would your team know how to respond?

If the answer is uncertain, that is a practical place to begin.

Site2 helps manufacturers connect CMMC requirements with the technical and operational realities of their environments.