Getting a Machine Shop to CMMC Level 2 Without Breaking the Business

110 controls, one IT person, and a DoD contract on the line. A field story about scoping CUI, working the POA&M, and getting assessment-ready without stopping production. The owner of a 60 person precision machine shop in central Ohio called us the week after a prime contractor told him he had eleven months to show a CMMC Level 2 certificate or lose two contracts worth roughly 40% of the shop's revenue. He'd read the flowdown clause a dozen times and still didn't know what it actually required of him. "I make aerospace brackets," he said. "I don't have an IT department. I have a guy named Dave who also runs the CNC machines." That's the reality of the defense industrial base below the primes: real engineering talent, almost no security infrastructure, and a compliance obligation that reads like it was written for a company ten times their size. We've now taken a handful of shops like this through Level 2, and the pattern is consistent. The technical controls are rarely the hard part. The hard part is figuring out where the controlled unclassified information actually lives, and resisting the urge to boil the ocean. What follows is roughly how the Ohio engagement went, with the specifics filed off. First, find the CUI — most of it isn't where they think Level 2 exists to protect controlled unclassified information. So the first question is never "how