Does your shop need ITAR and CMMC compliance, or are you chasing requirements that don't apply to the work you do?
That's the question to answer before buying software, hiring a consultant, or putting a certification goal on the board. The right decision starts with the parts you quote, the contract language your customer passes down, and where drawings and other technical data go once they hit your inbox.
For a CNC or sheet-metal shop, the triggers aren't interchangeable. A part may fall under a U.S. Munitions List category, a DoD contract may require protection of Controlled Unclassified Information, or a foreign person may be able to access export-controlled technical data. One, several, or none of those conditions may apply. Don't treat “defense work” as a complete compliance assessment.
Table of Contents
The Question Every Shop Owner Is Actually Asking
A familiar scene: a prime contractor sends a request for quote for a machined housing. The estimator sees a drawing, a material callout, and a delivery date. The shop owner sees a job that might fit the machines and keep the spindle busy. Then someone asks whether the shop is ITAR registered and CMMC certified, and the conversation turns into a yes-or-no decision before anyone has checked what's in the file or contract.
That's backwards. Start with the specific work and the information required to quote and make it. Is the part or related technical data covered by a U.S. Munitions List category? Does the contract identify Federal Contract Information or Controlled Unclassified Information, and specify a CMMC level? Could a foreign person access technical data through email, file storage, support, or a subcontractor handoff?
Those answers determine whether ITAR, CMMC, both, or neither belong in your plans. ITAR controls exports and access to covered defense articles and technical data. CMMC is tied to DoD contract requirements for systems handling covered information. They can overlap in the same quoting workflow, but one doesn't automatically mean the other applies.
Write down the contract, the customer's data markings, and the people and systems that touch the files. If you can't identify those things, you don't yet have a sound basis for deciding whether to pursue the work or the compliance effort.
What ITAR Actually Controls in a CNC or Fab Shop
The ITAR trigger can arrive as an ordinary-looking RFQ. A customer emails a drawing and a 3D model. An estimator opens them, a CAM programmer creates toolpaths, and a sheet-metal fabricator or finisher receives a DXF or process sheet. The shop may be handling controlled technical data before anybody has bought material or cut metal.
Under 22 CFR 120.33's definition of technical data, ITAR technical data includes information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of defense articles. The definition expressly includes blueprints, drawings, photographs, plans, instructions, and documentation. For a shop, that can mean CAD files, specifications, manufacturing instructions, and related material used to estimate or produce a defense article.
Follow the drawing, not the appearance of the part
An aluminum bracket can look like routine commercial work and still be covered if it falls under a USML category or its drawing contains related controlled technical data. The customer's classification matters. Don't guess from the material, shape, or the fact that the part is made domestically.
Access matters too. ITAR is an export-control regime, and access by a foreign person can constitute an unauthorized export unless the supplier has applicable authorization. That means the practical boundary includes who can open an RFQ, where attachments are stored, who can provide support, and whether files flow to outside processors.
For a closer look at what to inspect before pricing, use this guide to reviewing engineering drawings. The point isn't to turn an estimator into an export-control lawyer. It's to recognize that the files can be controlled before production starts, and to ask the customer to confirm classification and handling expectations before the shop circulates them.
What CMMC 2.0 Actually Requires and When It Applies
CMMC isn't a general cybersecurity badge for every manufacturer that wants to sell to defense customers. It's a contract-award requirement when a DoD solicitation or contract calls for a specific level for systems handling Federal Contract Information or Controlled Unclassified Information. Read the actual clause and flow-down language. Don't assume a customer's industry or a defense-related part automatically settles the question.
Know what the required level means
Level 1 applies to Federal Contract Information and uses a self-assessment against the applicable practices. Level 2 applies to Controlled Unclassified Information and assesses the contractor against 110 cybersecurity requirements derived from NIST SP 800-171. Depending on the contract, Level 2 may involve a self-assessment or a third-party assessment by an authorized organization. Level 3 uses assessment by the Defense Industrial Base Cybersecurity Assessment Center when that level is required.
The distinction affects the workload. A shop handling covered CUI may need to document how its people, systems, and processes protect that information, not just answer a customer questionnaire. The system boundary can include email, drawing storage, estimating, file processing, backups, and support access if those systems handle the data.
The CMMC 2.0 final rule became effective on December 16, 2024, and DoD planned a four-phase incorporation of requirements into solicitations and contracts, with full compliance required by the fourth year of the rollout, as described in DoD's CMMC overview. Treat that as a reason to review upcoming bids and flow-downs, not as a reason to buy a certification before you know which requirement a contract imposes.
Where ITAR and CMMC Overlap and Where They Diverge
ITAR and CMMC can apply to the same RFQ, but they ask different questions. ITAR is about export control, including access to covered technical data. CMMC is about cybersecurity controls for systems handling contract information. Treating them as one checklist creates gaps: a shop might secure its network but fail to control access by foreign persons, or restrict access but lack the documented cybersecurity evidence required for a CMMC assessment.
Consider a precision CNC shop quoting a titanium housing. The customer identifies the drawing as ITAR-controlled CUI. The shop needs to control who can access the technical data and how it moves, while also protecting the systems that receive, store, process, or transmit CUI. One RFQ has brought both regimes into the workflow, but the obligations remain distinct.
Dimension | ITAR | CMMC 2.0 |
|---|---|---|
Trigger | Covered defense articles, services, or related technical data, with applicability tied to the relevant USML classification and activity | A DoD solicitation or contract requiring a level for systems handling FCI or CUI |
Main concern | Export control, including who may access technical data and where it goes | Cybersecurity practices protecting covered information in contractor systems |
Scope | The data and activities subject to export-control rules, including access and transfers | The contractor information systems that handle covered contract information |
Evidence | Classification and authorization decisions, access controls, data-flow records, and controlled handling procedures | Security documentation and evidence showing how required controls operate |
Consequence | Unauthorized disclosure or export can create an ITAR violation | Failure to meet the contract's required status can affect award or continued eligibility |
A CMMC assessment doesn't make ITAR obligations disappear, and ITAR controls don't prove that a shop meets CMMC requirements. The practical move is to classify the data, identify the contract requirement, then build controls for each applicable obligation without pretending the labels are interchangeable.
The Data Boundary That Runs Through Your Quoting Workflow
The compliance boundary isn't just a folder marked “defense.” It follows the data through the work: a shared inbox receives the RFQ, software parses attachments, an estimator stores the quote, revisions arrive, a CAM programmer uses the model, and a finisher receives the relevant drawing or process information. Digital travelers, accounting links, backups, and support access can also touch or expose the same information.
A shop that wants to keep ordinary commercial quoting outside a controlled environment needs a defensible separation. That means identifying which inboxes, user accounts, devices, storage, integrations, and people can access the protected RFQs. A drawing copied into a spreadsheet or downloaded to a local laptop can pull those places into the practical data flow even if the official quote record sits somewhere else.
Make the handoffs visible
Map the steps from the typical machine-shop RFQ process, then mark every point where controlled information enters, changes hands, or leaves the shop. Include the finisher, outside processor, accounting system, backups, and any vendor support path. If a subcontractor receives controlled data, document the handoff and confirm the applicable contractual requirements.
A 2025 Redspin survey found that 58% of respondents were moderately, slightly, or not prepared for CMMC, and 13% had taken no preparatory action, according to DefenseScoop's report on the readiness gap. For a small shop, the lesson is practical: the weak point may be the everyday estimating habit, not a missing security product. An estimator who forwards an attachment without recording the recipient can create a control and evidence problem.
A quoting system can help preserve versions, permissions, and activity records, but it can't define the boundary by itself. The shop must decide what belongs inside, who is authorized to handle it, and how the process works when a customer sends a revision or an outside finisher needs the file.
Why ITAR-Aware Software Does Not Equal Compliance
A vendor's “ITAR-aware” or “CMMC-ready” wording isn't a certification for your shop. Software can support controls, but the contractor still has to confirm the data classification, system boundary, personnel eligibility, access permissions, contractual flow-downs, incident procedures, and documented handling practices.
Don't stop at the vendor's encryption statement. Ask where data is stored and processed, who can access it, how support works, who controls decryption keys, whether subcontractors can touch the information, and whether customer data is used for model training or support review. For ITAR-controlled unclassified data, an encryption-based export-control carve-out has specific conditions, including FIPS 140-compliant cryptographic modules, protection of decryption keys from unauthorized parties, and restrictions on intentional storage or transmission to prohibited countries. A marketing claim alone doesn't establish that those conditions are met.
Practical rule: If a vendor can't explain its data flows, access model, and contractual commitments in plain language, don't put controlled drawings into the system.
CMMC accountability stays with the contractor. Under the final rule, contractors must post current CMMC status and applicable system identifiers in SPRS, while an affirming official maintains an annual or change-triggered affirmation of continuous compliance, as set out in the Federal Register rule text. A platform can provide records that support your evidence, but it can't make that affirmation for you.
Compare tools on hosting, access controls, tenant separation, audit records, and whether the system can keep commercial RFQs apart from controlled work. A machine-shop software stack should fit the boundary your shop has documented, not define your legal responsibilities by default.
A Practical Decision Path for Your Shop
Run this review before accepting a defense RFQ or making a certification budget. Put the answers in writing so the owner, estimator, and operations lead are working from the same facts.
List the work and the markings. Review current and prospective defense jobs. Identify drawings, CAD files, bills of materials, inspection records, and process sheets marked or identified as ITAR-controlled, FCI, or CUI. Ask the customer to clarify anything that isn't clear.
Read the contract flow-downs. Check the solicitation, prime contract, purchase order, and subcontract terms for information-handling requirements and the CMMC level. Ask the customer which systems and data types the requirement covers, and whether outside finishers or processors will receive controlled files.
Map the route through your shop. Trace the RFQ from inbox to estimating, CAM, production, inspection, finishing, accounting, and backup. Record who can access each step and where files are copied. Include email, local devices, cloud storage, and vendor support.
Compare the requirement with your current setup. If the contract calls for CMMC Level 1 or Level 2, determine which systems handle the relevant information and what evidence you can produce. If ITAR applies, separately confirm classification, access eligibility, and any needed authorization. Don't treat one answer as proof of the other.
Make the business call. Pursue the work if the expected opportunity justifies the controls and ongoing administration. If it doesn't, decline it or discuss price, schedule, and handling responsibilities with the customer before accepting.
On or after October 1, 2025, CMMC requirements can appear broadly in DoD solicitations and contracts, except for acquisitions solely of commercially available off-the-shelf items, under the current DFARS provisions. That makes flow-down review a real bidding task, not paperwork to leave until after award.
Red flags include unclear data classification, a customer unwilling to identify the required CMMC level, uncontrolled forwarding to outside processors, or a schedule that assumes the shop can handle restricted files without changing its process. Don't accept a job first and hope the compliance details sort themselves out later.
Common Questions Shop Owners Ask First
Does machining or finishing a defense part automatically require ITAR registration?
No. A shop doesn't need ITAR registration merely because it machines, fabricates, or finishes parts for the defense industry. Registration generally applies to a U.S. person or company that manufactures, exports, or temporarily imports a defense article, or furnishes a defense service, subject to the applicable rules. Confirm the USML classification and the work involved with the customer before treating registration as necessary. Registration also isn't the same as export authorization.
Does separating controlled RFQs keep ordinary work out of CMMC scope?
A properly segregated environment can help define a narrower system boundary, but the shop must be able to show that the separation works in practice. If an estimator copies a controlled drawing into a shared drive or sends it through a general inbox, that system may enter the data flow. Document the boundary and include connected systems and users that handle the information.
What should we have ready for a Level 2 assessment?
The System Security Plan should describe how your shop implements the requirements in its actual environment. Supporting evidence can include asset and data inventories, access reviews, logging records, configuration and vulnerability records, incident-response procedures, and assessment results. Keep it specific to your systems and work, not a generic policy packet.
Should we pursue certification before winning a defense contract?
Don't pursue it as a marketing badge. Review the opportunities you're bidding on, ask primes and customers what requirements they will flow down, and estimate the operational work needed to meet them. If the contract terms don't call for the status, or the likely work won't justify the effort, don't buy compliance theater.
Start with the job and the data, then decide whether the certificate belongs on your roadmap.
Uptool provides quoting software for CNC and fabrication shops that organizes RFQs, drawings, CAD files, BOMs, revisions, and quote records in a connected workflow. If you're reviewing how controlled information moves through estimating, visit Uptool to see whether its workflow fits the boundary your shop has defined.
