Compliance

CMMC and ITAR for Small Machine Shops: What You Actually Need in 2026

LightsOut CNC Journal · 8 min read · Rules current as of September 24, 2026

If you machine parts for defense programs, two sets of rules come up fast: ITAR and CMMC. People often mix them up. They are different rules, run by different agencies, for different reasons. This guide explains each one in simple terms, what a small shop has to do today, and what changed in 2026.

Quick answer. ITAR is an export-control law from the State Department. It controls who can see and handle defense parts and drawings. If you make defense articles, you must register with the State Department, even if you never export. CMMC is a Defense Department cybersecurity program. It checks that you protect contract information on your computers. As of September 2026, CMMC self-assessments are required on some contracts, but the third-party certification step is paused while the Department reviews the program.

1. ITAR vs. CMMC at a glance

What it is: ITAR — an export-control law. CMMC — a cybersecurity program for defense contractors.
Who runs it: ITAR — the State Department's Directorate of Defense Trade Controls (DDTC). CMMC — the Defense Department (now also called the Department of War).
What it protects: ITAR — defense articles and their technical data. CMMC — contract information on your computer systems.
Main small-shop task: ITAR — register with DDTC and keep technical data away from foreign persons. CMMC — self-assess your security and post results in SPRS (the Supplier Performance Risk System, the Defense Department database for contractor security scores).
Main cost: ITAR — $3,000 per year DDTC registration (Tier 1), plus your compliance work. CMMC — the security work itself: IT setup, policies, and assessment time.

2. ITAR: what a small shop has to do

ITAR (the International Traffic in Arms Regulations) covers items on the U.S. Munitions List and the technical data for them, like drawings and models.

You must register, even if you never export. Any U.S. business that manufactures defense articles must register with DDTC. The rule says this directly: a manufacturer who does not export must still register. Making one defense article is enough to trigger it.

How: file form DS-2032 (Statement of Registration) through DDTC's online system.
Cost: new registrants pay the Tier 1 fee of $3,000 per year. Higher tiers apply to companies that get export licenses.
Renewal: registration is yearly. Letting it lapse and then doing ITAR work can mean paying back fees for the gap.

Registration is not the same as compliance. There is no official "ITAR certification." Registering tells the government you are in the business. It does not prove you handle controlled data correctly. Buyers usually want to know three things: Are you registered with DDTC? Do you have a written compliance plan? Do you follow it every day, including who can open ITAR drawings?

Who can see the data. Showing ITAR technical data to a foreign person counts as an export, even if it happens inside the U.S. Without an export license, that data should stay with U.S. persons. Under the ITAR, a U.S. person includes U.S. citizens, green card holders, and certain protected individuals such as refugees and people granted asylum. For a small shop, this affects visitor rules, cloud storage, and even which software support team can log into your systems.

A hiring note. The rule is "U.S. person," not "U.S. citizen." Limiting jobs to citizens only, when ITAR does not require it, can create a discrimination problem under federal law. Check with an employment attorney before you write a citizenship requirement into a job post.

3. CMMC: what a small shop has to do

CMMC stands for Cybersecurity Maturity Model Certification. It checks that defense contractors protect two kinds of information:

FCI (Federal Contract Information): basic contract info not meant for the public.
CUI (Controlled Unclassified Information): more sensitive info, like controlled technical drawings and specs from a prime. Export-controlled technical data is a common type of CUI in machine shops.

The three levels:

Level 1 — shops that only handle FCI. 15 basic security requirements. Yearly self-assessment. Every item must be met; no "fix it later" plan allowed.
Level 2 — shops that handle any CUI. 110 requirements from NIST SP 800-171 Rev. 2. Scored from -203 to 110. A limited "fix it later" plan is allowed at a score of 88 or higher.
Level 3 — a small number of the most critical programs. Level 2 plus 24 more requirements, with a government-led assessment.

The affirmation. A senior person at your company, called the Affirming Official, must sign an affirmation in SPRS after the assessment and every year after. An outside consultant can help with the work but cannot sign for you.

If you handle CUI, you likely already had rules. DFARS clause 252.204-7012 has required NIST SP 800-171 for years. It also requires you to report cyber incidents within 72 hours, and any cloud service that holds this data must meet FedRAMP Moderate or an equivalent standard.

4. What changed in 2026

CMMC went live in contracts on November 10, 2025. Phase 1 made Level 1 and Level 2 self-assessments a condition of award on applicable new Defense contracts.
Phase 2 is suspended. Phase 2 was set to start November 10, 2026. It would have required third-party (C3PAO) Level 2 certification on many CUI contracts. On July 13, 2026, the Department suspended Phase 2 and the later phases and formed a CMMC Reform Task Force.
The pause is now written into contract rules. On September 3, 2026, the Department reissued a class deviation that tells contracting officers to remove third-party CMMC requirements and use Level 1 or Level 2 self-assessments instead.
The review is not finished. The Task Force report was due to the Department's CIO on September 11, 2026. As of September 21, it had not been made public. No new date for third-party certification has been set. Department leaders have also said they want more focus on the security of shop-floor and manufacturing technology.
What did not change: NIST SP 800-171, DFARS 252.204-7012, SPRS scores, and the yearly affirmation all still apply.

Why this matters for a small shop. The pause changed how your security is checked, not whether you need it. With less third-party checking, your signed self-assessment carries more weight. The Justice Department uses the False Claims Act against contractors who misstate their cybersecurity. Keep your SPRS score accurate and backed by evidence.

5. A simple plan for a small shop

Figure out what you make. If any part is on the U.S. Munitions List, register with DDTC before you start.
Figure out what data you hold. FCI only means Level 1. Any CUI, including controlled drawings, means Level 2.
Shrink the footprint. Keep controlled data in one small, locked-down area of your network, not on every shop PC. Less scope means less to secure and assess.
Check your cloud tools. If they hold CUI, they need FedRAMP Moderate or an equivalent standard. This includes ERP, file storage, and email.
Do the self-assessment and post it in SPRS. Have your Affirming Official sign it. Put a yearly reminder on the calendar.
Keep going during the pause. The security work is the same whether third-party certification returns next year or later.
Get free help. APEX Accelerators (formerly PTACs) offer no-cost government contracting help, including with SPRS and registrations.

Frequently asked questions

Do I need ITAR registration if I never export? Yes, if you manufacture defense articles. The ITAR says a manufacturer who does not export must still register with DDTC.

How much does ITAR registration cost? New registrants pay $3,000 per year (Tier 1). Higher fees apply to companies that receive export licenses.

Is there such a thing as ITAR certification? No. There is DDTC registration and your own compliance program. "ITAR certified" is industry shorthand, not an official status.

Can a green card holder work on ITAR parts? Yes. Under the ITAR, green card holders are U.S. persons, along with U.S. citizens and certain protected individuals.

Is CMMC required right now? Yes, on applicable new Defense contracts, but only as a Level 1 or Level 2 self-assessment. Third-party Level 2 certification was suspended on July 13, 2026 while the program is reviewed.

What CMMC level does a machine shop need? It depends on your data. FCI only means Level 1. If you receive controlled technical drawings or other CUI, you need Level 2.

Are ITAR and CMMC the same thing? No. ITAR is a State Department export-control law about who can access defense items and data. CMMC is a Defense Department program about securing contract information on your systems. Many shops need both.

About the author

Andrew Adams is the founder and CEO of LightsOut CNC, an automated 5-axis machine shop opening in November 2026 in the Los Angeles South Bay. LightsOut's own ITAR and CMMC status is listed on its Quality & Compliance page.

More about Andrew and his other articles →

This article is for general information and entertainment purposes only. It is not legal advice. CMMC rules are changing. Confirm current requirements with your contracting officer, your prime, or an export-control attorney.