Why Defense Primes Should Act Now to Find CMMC Level 2 Suppliers

By Justin Quinn, President and Owner of Focused on Machining

A buyer from a large defense prime recently reached out to us at Focused on Machining. He was looking for a new defense supplier that could take on programs that require CMMC Level 2 compliance. 

We were happy to talk to him about his program and provide a quote. We are currently 95% complete with our CMMC Level 2 preparation, with a clear Plan of Action and Milestones (POA&M) in place.

But that conversation made us realize something: a major challenge is on the way across the defense manufacturing supply chain. The defense industrial base is under pressure to move faster than ever; at the same time, CMMC requirements may soon be phased into DoD contracts, even as the next phase of implementation is under review.

This combination could create real timeline issues for primes and suppliers that wait too long to act.

The Coming CMMC Supply Chain Crunch

The buyer told us that much of his recent time has been spent searching for CMMC Level 2 suppliers. Historically, his company had a large supplier base and could choose from a wide range of capable shops. 

But with CMMC requirements continuing to evolve, that flexibility is beginning to shrink. And this change is happening against a broader push across the defense industrial base to strengthen supply chains and deliver critical capabilities at greater speed and scale.

Many of the suppliers this buyer currently works with are talented small shops that have supported defense work for years. But some haven’t looked deeply into CMMC, while many others intend to be compliant eventually but have not taken meaningful steps yet. 

At this point, the next phase in implementation could bring CMMC Level 2 third-party assessment requirements into the award process. Even with the timeline paused, it’s risky to wait; suppliers that have not started may still be looking at a year or more of work before they are truly ready.

The buyer told us he was reaching out now to get ahead of this potential issue. He saw that we had experience with primes along with our CMMC Level 2 self-assessment, and wanted to add us as a partner before he lost other suppliers and programs experienced disruptions. 

What Defense Suppliers and Machine Shops Should Do Now

At this point, even after the recent pause, I do think it’s incumbent upon suppliers to start taking concrete steps. CMMC is a serious commitment, and I understand why many small shops have been cautious. It requires time, planning, outside support, new processes, and ongoing expenses.

I also understand the financial concern. CMMC is not inexpensive, and the recurring costs are real. But in our experience, the investment did not happen all at once. The process unfolded over time, with expenses spread across multiple phases. That made it possible to manage the work piece by piece instead of treating it as one massive project.

There are also resources available from the government and from people in the industry who have already gone through the process. I have shared some of what I learned along the way in my previous articles, and I’m always happy to talk with other shops trying to understand what comes next.

What Defense Primes Should Do Now

Primes, above all, should not wait until requirements are clarified again to evaluate their supplier base.

Many suppliers may not fully understand how much work is involved in becoming CMMC Level 2 ready. If a shop isn’t already well down the road, they may not be ready in time.

The best step is to begin adding new suppliers now. Some of your existing suppliers may eventually complete the process, and primes may be able to move work back to them later. But to avoid disruption, it is better to identify CMMC-ready manufacturing partners before a program is at risk.

Where Focused on Machining Stands Today

As of July 2026, we are:

• 95% complete with our CMMC Level 2 preparation. 

• Working toward full CMMC Level 2 certification this year.

• Following a clear Plan of Action and Milestones (POA&M), with remaining items scheduled for completion within the next 30 days. 

• Scheduled for our audit in early fall 2026.

Let’s Talk About Your CMMC Project

When I served in the Air Force as an aircraft mechanic, I would sometimes look at the parts I was installing and think about the path they took to get to me. I wondered what the markings and numbers meant and where the parts came from. Eventually, that curiosity helped lead me into manufacturing.

Because of that history, defense work is personal to me. As a defense supplier and service-disabled veteran-owned small business, I feel a patriotic obligation to take the responsibilities of CMMC seriously. I’m proud of the work we have done to prepare. 

And I also want to do my part to make sure the broader defense supply base stays strong. If you are a shop trying to navigate CMMC, please reach out, because I’m happy to talk. And if you are a prime looking for manufacturing partners who can meet CMMC Level 2 requirements, let’s discuss your program.

5 Lessons Learned on Our Journey to CMMC Level 2 Compliance

By Justin Quinn, Owner of Focused on Machining

At Focused on Machining, we are fully prepared to support your CMMC Level 2 projects with our precision machining. But that compliance didn’t happen overnight.

When the CMMC framework was first announced, I knew how essential compliance would be for our customers involved in defense work. And as a veteran, that responsibility is personal to me. I quickly learned, however, that being among the first to tackle this challenge would come with unique challenges. 

With the DoD beginning to enforce CMMC requirements, many shops are now facing the journey we’ve completed. To help other CNC machine shops, I want to share several lessons we learned along the way. I’ve also got one important recommendation for OEMs and primes navigating these early days of CMMC.

Why You Need an Experienced Partner

When the Department of Defense introduced the first version of the CMMC program in 2020, we immediately began investigating the certification process. At this time, no IT providers had any meaningful experience with the brand-new requirements, and the framework would continue to evolve for years to come.

Our existing IT provider was transparent about their lack of experience in the area, but they offered to help in any way they could. They had been trustworthy partners on other issues for many years, and I decided to take them up on their offer.

It quickly became clear that it would simply take too long to have a partner who was learning alongside me. I thanked them for their transparency and switched to a new IT company.

Lesson 1: If a partner tells you they’re not ready, it’s best to keep searching.

The Importance of Due Diligence

When we selected our second CMMC IT partner, they presented themselves as having deep CMMC expertise. At that point in time, it was still difficult to validate those types of claims, as everyone was still learning what CMMC would eventually become. With few established benchmarks or references available, we made the best choice we could at the time.

As the relationship continued, I began asking more detailed CMMC questions. Their responses were broad and vague, which made it clear their supposed expertise had just been in pursuit of sales.

Lesson 2: In the early days, it was hard to verify a potential partner’s expertise. Today, you have more available to you. Ask technical, requirement-based questions and request proof of prior CMMC work before choosing a partner.

Don’t Go It Alone

After my first two IT partnerships, I had made some progress on CMMC, but not enough. I briefly decided to handle CMMC myself. I love a challenge, and I’d previously led our certification efforts to become an AS9100 machine shop. I figured if I was intelligent enough to rebuild Air Force engines, I could handle this process. 

But CMMC is different. The requirements are dense and technical, and some sections genuinely felt like reading a foreign language. I eventually decided I needed help from professionals.

Lesson 3: As a machine shop owner, you cannot effectively achieve CMMC Level 2 certification alone. Even if you’re strong in IT and have led other certification efforts, it’s simply a different beast.

Find the Right Partner and Work in Phases

At this point, I was committed to finding an experienced partner and doing extensive due diligence. I interviewed multiple firms that were able to provide clear proof of their expertise in CMMC. 

Ultimately, I found the right partner in Imprimis in Colorado Springs. Their owner has decades of experience working with the DoD, and the firm specializes in CMMC work. They have been key to our success, and I recommend them to any other Colorado machine shop going through this process.

It’s important to note that, even after finding the right partner, the path to CMMC Level 2 certification is a marathon and not a sprint. Our process has included months of significant work followed by stretches of slower progress due to bottlenecks or reviews. That’s relevant to your expenses too, as some months will have significant costs, while others will be lower.

Lesson 4: Achieving CMMC certification takes place in stages, and it takes time. This structure helps distribute the spending and workload over time, but it also means the process is lengthy. Start early, well before a partner requires you to be certified.

What Primes Need to Know

These lessons have primarily been for other machine shops, but I do have a final message for our customers and primes. In many early CMMC contracts, Level 2 work begins with a self-assessed CMMC Level 2 status rather than a full third-party certification. But shops still must be actively progressing toward full Level 2 certification.

Lesson 5: If a shop says they are “almost done,” ask for proof. They should be able to provide documentation such as their scope outline, POA&M, system security plan, and other materials.

This matters for your supply chain, too. Even though we are compliant, we cannot send controlled documents to downstream vendors if they do not meet the necessary standards.

Moving Forward With Confidence

I’m sharing these lessons because I want to help other shops protect sensitive data and strengthen our national defense. Our journey was full of twists and turns, but we’re proud we achieved CMMC early.

If you are a machine shop owner who has questions, don’t hesitate to contact me. 

And if you’re an OEM looking for a CMMC Level 2 manufacturer, request a quote today!