Guide
CMMC 2.0 for Wisconsin Manufacturers: A Plain-English Guide
What CMMC 2.0 means for Wisconsin machine shops, fabricators and suppliers in the defense supply chain: levels, what is required, where to start and how long it takes.
Short answer: CMMC is the Defense Department's cybersecurity requirement for its suppliers, and it began phasing into contracts in late 2025. If you only handle basic contract information, you will typically need Level 1 (basic safeguards with a yearly self-assessment). If you handle Controlled Unclassified Information, such as many defense drawings and specs, you will typically need Level 2, which follows the security requirements in NIST SP 800-171. Start by finding exactly where that information lives.
The levels in brief
| Level | Who it is for | What it involves |
|---|---|---|
| Level 1 | Suppliers handling Federal Contract Information | Basic safeguards, annual self-assessment |
| Level 2 | Suppliers handling Controlled Unclassified Information | NIST SP 800-171 requirements, self-assessment or third-party assessment depending on the contract |
| Level 3 | A small number of the most sensitive programs | Additional requirements, government assessment |
Where to start
- Find the controlled information. Which drawings, specs and emails are covered, and where do they live today?
- Shrink the scope. Keep covered information in as few systems as possible, sometimes a dedicated enclave.
- Run a gap assessment against the required practices.
- Close the big gaps first: multi-factor sign-in, access control, endpoint protection, logging and backups.
- Document it: a system security plan and a plan of action for anything still open.
How long it takes
Small shops with a focused scope can often get ready in a few months. Larger or more spread-out environments take longer, which is why starting early protects your contracts.
We help Wisconsin suppliers get ready. See CMMC 2.0 compliance for defense suppliers.
Frequently asked questions
Does CMMC apply to subcontractors?
Yes. Requirements flow down the supply chain to subcontractors who handle covered information.
Can we use Microsoft 365 for controlled information?
Covered information has specific requirements for cloud services. Many suppliers use government-grade cloud offerings or a separate enclave. A gap assessment will tell you what fits your situation.
What happens if we are not ready?
You may not be eligible for contracts that require a CMMC level, so prime contractors may start asking suppliers for their status well before a contract is awarded.