If you machine parts, weld assemblies or build subsystems that end up in something the Department of Defense buys, a prime has probably already asked about your cybersecurity. The Cybersecurity Maturity Model Certification (CMMC) turns that question into a contract requirement, and the answer has to be backed by evidence, a written System Security Plan and a score your prime can look up.
ACS has supported manufacturers in Northern Michigan for more than two decades. We built a CMMC readiness practice because our own clients needed one, and we built it the way we run everything else: documented, measured and evidence-driven, so the score you report is one you can defend.
Who this is for
- Subcontractors with DoD work in the pipeline. Your prime has sent a flowdown letter, a supplier questionnaire or a contract clause (DFARS 252.204-7012, 252.204-7021 or the FAR basic safeguarding clause) and wants to know your status.
- Shops handling drawings and specs marked as controlled. If you receive Controlled Unclassified Information (CUI), you are in Level 2 territory whether you have 12 employees or 200.
- Owners who want a straight answer before spending. Most of our conversations start with “what do we actually need, and what will it cost?” The scoping workshop exists to answer exactly that.
Level 1 or Level 2, in plain language
| Level 1 | Level 2 | |
|---|---|---|
| Information covered | Federal Contract Information (FCI) | Controlled Unclassified Information (CUI) |
| Requirements | 15 basic safeguarding requirements from the FAR | 110 requirements of NIST SP 800-171 |
| How it is assessed | Annual self-assessment | Self-assessment or a C3PAO certification assessment, as the contract specifies |
| Score reported | Met or not met for all 15 | A score out of 110, recorded in SPRS |
| Deferring gaps | Not allowed | A POA&M is allowed within limits; the System Security Plan can never be deferred |
| Who affirms | A senior official at your company | A senior official at your company |
Which level applies is decided by the information, not by the company. Getting that determination right is the single most consequential step in the whole process, because it decides whether you are managing 15 requirements or 110.
How a CMMC engagement with ACS runs
1. Scoping workshop
Everything downstream is priced off this, so it comes first and it is fixed-fee. We spend a day on site with your contract signatory, the people who handle prints, a shop floor lead and whoever administers your prime’s portal. Nothing is graded. We map how government information arrives (portal downloads, email, physical prints, EDI), where it comes to rest (file shares, ERP, CAD, email, inspection records, the print rack at the machine) and who touches it.
The workshop delivers nine things:
- An information flow map for your company
- The FCI versus CUI determination, with the reasoning written down
- The assessment boundary
- Containment options, usually an enclave for the controlled information versus bringing the whole environment into scope, each with asset count, control burden, disruption and cost delta
- A shared services recommendation, including which of your existing tools stay and which have to change
- A System Security Plan outline
- A prioritized remediation roadmap
- A remediation budget range
- A findings presentation to your leadership
The containment decision is yours. We lay out the options with real numbers; we do not pick for you.
2. Gap assessment and score
Once the boundary is set, we assess every applicable requirement and its assessment objectives. Each finding records what was checked, how, when and by whom. Wherever one of our managed tools can supply the evidence (identity and MFA state from Microsoft 365, patch and encryption state from endpoint management) we pull it from the system rather than asking someone to remember. The result is a DoD Assessment Methodology score with provenance on every line.
3. System Security Plan and POA&M
The SSP is the document an assessor reads first and the one requirement that can never sit on a POA&M. We author it from the assessment, along with the Plan of Action and Milestones for whatever can lawfully be deferred.
4. Remediation
Gaps become phased projects sequenced by point value, by whether they may be deferred, by your contract deadline and by cost. Shared infrastructure work is split from site-specific work so sister companies are not billed twice. We track each project in our service desk, update the control status as work closes and recalculate the score as you go.
5. Self-assessment package and affirmation
When the score is where it needs to be, we assemble the package: final score, POA&M with credible completion dates, the SSP, the evidence index and an affirmation packet for your senior official. ACS advises and remediates. You attest, on your authority, because that is how the rule is written and because a false claim is a legal problem we will not set you up for.
6. Annual maintenance
CMMC is not a one-time project. We refresh evidence, run the POA&M countdown, watch for control drift as your environment changes and prepare each annual affirmation.
Why manufacturers work with ACS on CMMC
We are already inside the boundary, and we say so. Any managed IT provider whose monitoring, endpoint protection, backup or documentation tools touch your systems is an External Service Provider under the rule and part of your assessment. ACS runs its own environment through the same process we use for clients and gives you a customer responsibility matrix: which requirements we cover, which you cover, which are shared.
Evidence, not assertions. A questionnaire filled in from memory produces a score nobody can defend. Our findings pull from the systems themselves and carry source, method, date and assessor.
Fixed-fee scoping with a remediation credit. The workshop has a fixed price, quoted after a short discovery call. Half of it is credited toward remediation when you start that work with us within 90 days.
Sister companies handled correctly. Commonly owned entities each need their own assessment, score and affirmation. We model them separately, then test whether a shared architecture is defensible for both. You pay for one engagement, not two.
Twenty-plus years in manufacturing IT. We support production floors, CAD and CAM systems, ERP and the vendors around them every day. Read how we keep a Traverse City roll-forming and stamping shop running, and see our IT services for manufacturers.
What this service is not
- ACS is not a C3PAO. We do not certify anyone and nothing we produce implies independent assessment authority. If your contract calls for a certification assessment, a C3PAO performs it, and we get you ready for it.
- We do not sign your affirmation. Your named senior official does.
- We do not guess at remediation cost. The workshop produces a budget range. The real number comes from the gap assessment.
- We do not sell you a binder. A System Security Plan that does not match the environment is worse than none, because it is a written misstatement. Ours is generated from the assessment and kept current.
Where we work
ACS is headquartered in Traverse City and serves manufacturers across Northern Michigan, Grand Rapids and West Michigan, with teams in Chicagoland and Central Florida. The scoping workshop happens at your facility. Assessment, remediation and maintenance are a mix of on-site and remote work, and we take on remote engagements anywhere in the United States.
Start with a discovery call
Fifteen minutes to tell us what your prime has asked for and what information you handle. We will tell you whether you are looking at Level 1 or Level 2, what the workshop would cover for your company and what it costs. No pitch.
Book a discovery call or call 231-267-TECH (8324). You can also reach us through our contact page.
Already running managed IT with us? CMMC readiness builds on managed security, vulnerability management and security awareness training, so much of the groundwork may already be in place.