Small and mid-sized manufacturers make up the majority of the DoD supply chain — and most are far less ready for a CMMC assessment than their self-scores suggest. Here is what the gap really looks like, and how to close it before contract awards turn on it.
Small businesses make up more than 70% of the Department of Defense supplier base, and as the Cybersecurity Maturity Model Certification (CMMC) program moves into binding enforcement, most of them are walking into the assessment window with a confidence level that the evidence will not support. The pattern we see across gap assessments is consistent: leadership believes the company is "mostly there." Documentation, scoping, and sustained control implementation say otherwise.
The disconnect is not a story about negligence. It is a story about complexity that has been quietly accumulating for years on shop floors that were never architected for a formal cybersecurity audit.
A modern shop floor is a digital attack surface
Walk into a small precision-machining or aerospace-components supplier today and the production environment looks impressive. CNC machines run lights-out shifts. Robots tend cells. ERP, MES, CAD/CAM, quality, and inventory systems are stitched together so jobs flow without manual re-entry. That integration is exactly what makes these suppliers competitive — and exactly what expands the in-scope footprint under CMMC.
Most small manufacturers still treat cybersecurity as a front-office problem: email, accounting, the file server in the closet. The shop floor is treated as operational equipment, not as a system that handles, transmits, or is adjacent to Controlled Unclassified Information (CUI). When an assessor walks the boundary, that mental model breaks. Engineering drawings flow from the prime's portal to a workstation, into a CAM package, out to a machine controller, back into quality records, and into delivery documentation. Each of those hops is in scope unless it is intentionally engineered out.
Manufacturing has been the most-targeted sector for cyberattacks for several years running, and the reason is structural: legacy equipment, flat networks, dual-use IT/OT systems, and small teams without dedicated security staff. CMMC was created in part to close exactly that exposure inside the defense industrial base.
The self-assessment hangover
For years, defense suppliers were allowed to self-attest against NIST SP 800-171 and post a Supplier Performance Risk System (SPRS) score. Many did so honestly, in good faith, and with reasonable interpretations of the controls. What was almost universally underestimated was the depth of three things that an assessor will actually demand:
- A defined system boundary, with a current network diagram and a documented data flow showing where CUI lives, moves, and rests.
- A System Security Plan (SSP) and Plan of Action & Milestones (POA&M) that describe each control as it is actually implemented in your environment — not generic policy language copied from a template.
- Objective evidence that the control has been operating consistently over time: logs, screenshots, configuration baselines, ticket records, training rosters, access reviews.
When third-party assessors evaluate the same environments suppliers have already self-scored, the variance is dramatic. Industry data published this year shows the average delta between supplier self-scores and evidence-based assessments running in the range of negative 130 points on the 110-point scale — meaning many companies that reported themselves at or near full compliance were, in practice, deep in the negative once boundary, documentation, and evidence were tested.
The gap rarely traces back to one missing tool. It traces back to scope drift, unclear ownership, and policies that describe an idealized environment rather than the one running on the network.
What the gap actually looks like in practice
Across the small-manufacturer engagements our RPO team runs, the same themes repeat:
- CUI is everywhere it should not be. Drawings end up in personal OneDrive folders, in shared inboxes, on USB drives that move between the office and the shop, and on contractor laptops that were never enrolled in MDM.
- The boundary has never been formally drawn. There is no enclave. The "in-scope" environment is, effectively, the entire company, which inflates the assessment by an order of magnitude.
- Identity is fragmented. Local accounts on shop-floor PCs, shared logins on machine controllers, vendor remote-access tools without MFA, and an Active Directory that has not been cleaned up in a decade.
- Logging exists but is not retained, not centralized, and not reviewed. There is no realistic story to tell about incident detection.
- Policies were written once, by an outside consultant, and never operationalized. Staff have not been trained against them. Evidence of execution does not exist.
- Vendor and flow-down obligations under DFARS 252.204-7012 have not been pushed to subcontractors and tooling vendors with access to CUI.
Each item on its own is fixable. Together, they are a six-to-twelve-month program — not a weekend remediation sprint.
Why this is a business-continuity issue, not just a compliance issue
For small subcontractors whose defense work is a meaningful share of revenue, ineligibility for award is not a slap on the wrist. It is a revenue cliff. Prime contractors, increasingly, will not be able to place work with suppliers who cannot show the required CMMC level for the contract in question. When a supplier slips, the prime absorbs schedule risk, qualification cost, and sourcing delay — which means primes are getting more disciplined, faster, about who stays on the approved vendor list.
The capacity side of the market is the other pressure. The pool of authorized C3PAOs and qualified RPOs is finite. Assessment slots are filling. Suppliers who wait until a contract requires CMMC before starting their readiness work are competing for constrained resources at exactly the moment their revenue depends on the outcome.
How to close the gap deliberately
The companies that get through cleanly tend to do the same five things, in the same order:
- Scope first. Define the CUI environment intentionally. In most small-manufacturer cases, that means standing up a dedicated enclave (commonly built on Microsoft 365 GCC High and Azure Government with FIPS-validated cryptography) and pulling CUI workflows into it. A well-drawn enclave can shrink assessment scope by 70 to 90 percent.
- Map the data. Document where CUI enters the company, every system it touches on its way to delivery, and every party that handles it — internal and external. The data-flow diagram is the single most useful artifact in the entire program.
- Engineer the controls into the enclave, not bolted onto the legacy network. Conditional access, phishing-resistant MFA, device compliance, DLP, encryption at rest and in transit, and centralized logging are dramatically easier to implement once and prove repeatedly inside an enclave.
- Build the evidence muscle. Treat logging, access reviews, vulnerability scanning, training completion, and configuration baselines as recurring operational tasks with named owners and tickets — not as one-time artifacts produced before an audit.
- Push DFARS 7012 flow-down to vendors with CUI access (IT providers, machine-tool vendors, calibration partners, contract programmers). Their posture is now your posture.
A narrowing window
CMMC is no longer a future planning item. Contract clauses are appearing in new awards and modifications. The runway between "we should look at this" and "we cannot bid on this work" is shorter than it has ever been.
The small manufacturers who treat readiness as an engineering project — scoped, resourced, sequenced, and owned — are positioning themselves to win share as competitors fall out of the qualified pool. The ones still treating it as a checklist exercise will discover the gap the way most companies discover it: in the room with an assessor, when it is too late to redesign the environment.
If you are sizing the lift for your organization, Maverc's RPO team runs structured gap assessments built specifically around small and mid-sized defense manufacturers — including enclave architecture, evidence operations, and a realistic, dated path to your target CMMC level.
