CMMC Is Coming for Defense Suppliers. Your ERP Holds the Data It Protects.

The Rule Is Moving

For years, small defense manufacturers have heard that cybersecurity certification was coming. It is now close.

The Department of Defense published its proposed rule for the Cybersecurity Maturity Model Certification program, known as CMMC, on December 26, 2023, and the public comment period closed on February 26, 2024. The department has said it intends to phase the requirements into contracts over several years once the rule is final. For thousands of suppliers in the defense industrial base, many of them machine shops, fabricators and component makers with modest IT resources, certification will become a condition of winning and keeping contracts.

What CMMC Requires

The program, in its current form, has three levels.

The program, in its current form, has three levels. Level 1 applies to companies that handle only federal contract information and covers a set of basic safeguarding practices, assessed annually by the company itself. Level 2 applies to companies that handle controlled unclassified information, or CUI, and aligns with the 110 security requirements of NIST Special Publication 800-171. The proposed rule estimates that about 76,000 of these companies will need an assessment by an accredited third party. Level 3 adds further requirements for the most sensitive programs and is assessed by the government.

None of this is entirely new. Defense contractors handling CUI have been required by the DFARS 252.204-7012 clause to implement NIST SP 800-171 for years. What CMMC changes is verification. Instead of attesting to compliance, many suppliers will have to prove it to an assessor.

Why the ERP Is at the Center

In a typical small defense manufacturer, CUI does not sit in one secure folder. It is spread across the business, and a large share of it passes through the ERP.

Engineering drawings and specifications attached to items. Part numbers and bills of material tied to defense programs. Routings with process details for controlled parts. Purchase orders sent to subcontractors with technical data attached. Quality records and certifications. Shipping documents. If any of this is CUI, the systems that store and process it are in scope for the assessment, along with the people who can access it and the networks it travels over.

That has practical consequences. It means knowing which items and documents in the ERP are controlled. It means controlling who can see them, through role-based access and unique user accounts rather than shared logins. It means logging access, protecting backups, and controlling how data leaves the system, including what is emailed to suppliers.

The Cloud Question

Many manufacturers are moving to cloud ERP, and that decision now has a compliance dimension. Under the DFARS 7012 clause, a cloud service used to store or process CUI must meet security requirements equivalent to the FedRAMP Moderate baseline, along with obligations around incident reporting.

Not every cloud ERP, and not every hosting arrangement offered by a reseller, meets that bar. A defense supplier evaluating a move to the cloud should ask the vendor directly, in writing, how its offering meets the 7012 requirements, and should not assume that a large provider's general security certifications are sufficient.

Where to Start

The first step is scoping. Identify where CUI enters the business, where it is stored, who uses it and where it goes. Many companies find that they can reduce their scope considerably by keeping controlled data in fewer systems and limiting who can access it, which reduces both the cost of compliance and the size of the assessment.

The second step is a gap assessment against the 110 requirements of NIST SP 800-171, with an honest score. Contractors are already expected to report a self-assessment score in the Supplier Performance Risk System, and a gap assessment is the time to find out whether that number would survive an outside review.

The third step is a plan, with an owner and a budget, to close the gaps. Some will be technical, such as multi-factor authentication and logging. Many will be procedural, such as documented policies, access reviews and training. The ERP will figure prominently in both.

The Bottom Line

CMMC will turn cybersecurity from an attestation into a verified requirement for defense suppliers, and the rule is moving toward final. For a small or mid-sized manufacturer, the ERP is likely to be one of the systems at the center of the assessment, because it holds so much of the controlled information the program protects. Scope where CUI lives, assess honestly against NIST SP 800-171, confirm that any cloud ERP meets the DFARS requirements, and start closing the gaps before a contract depends on it.

At Cherry Street, this is the work we do. We help defense suppliers find where controlled information lives in their ERP, reduce the scope of what has to be protected, and evaluate whether their current or proposed systems will hold up to an assessment.