CMMC Requirements Have Changed: What Manufacturers Need to Know

By: Paul LaPorte, Cybersecurity Coordinator

How CMMC Requirements Have Changed

As July 13th, 2026, the US Department of War has lifted all requirements for small and medium manufacturers to receive a third-party certification audit. This means that small and medium manufacturers will need to self-report their compliance with the CMMC level required by contracts. Many in the Department of Defense supply chain are seeing this is a huge relief, as they will no longer need to endure the substantial cost and investment of time that comes with a third-party audit. However, it’s important to remember a few things as we move forward into this new landscape.
You Still Need To Meet CMMC Requirements
 
The suspension of third-party audit requirements does not mean that CMMC at large has been suspended, or that DoD manufacturers are no longer expected to meet CMMC requirements. The requirements that manufacturers have to meet have stayed exactly the same at all levels of CMMC outside of the need for a third-party audit. So, any work that needs to be done to meet those requirements will still need to be performed in order to satisfy DFARS clauses and bid on DoD contracts.
Assistance Is Still Available
 
Just because CMMC compliance is self-reported now does not mean that you cannot receive outside assistance in gathering the information and performing the assessments needed to submit your SPRS score. It is still acceptable, and, in many cases, encouraged, for manufacturers to seek assistance from knowledgeable professionals in information technology and cybersecurity. Similarly, if a company still desires a third-party certification audit from a C3PAO, that option is still available for them; it is simply no longer a requirement.

False Reporting Carries Serious Consequences

Just because CMMC scores are entirely self-reported, it doesn’t mean that manufacturers can simply fabricate a passing grade. Intentional misrepresentation of your SPRS score carries serious penalties, including the loss of a contract and heavy fines in the hundreds of thousands of dollars. This does not mean that manufacturers will face these penalties for honest mistakes or an unintentional misinterpretation of the requirements; those things are expected to happen in some cases. But if you plan to ignore your responsibilities as a DoD manufacturer now that a third-party audit is no longer required, know that you are playing a very dangerous game with your business.
Reach Out For Needs Or Further Questions

 

If your manufacturing business lacks the resources to conduct a CMMC self-assessment, or if you need assistance with remediation projects needed to meet CMMC requirements, the first place you should reach out to is your regional MEP center. Your regional MEP center will be able to provide guidance and assistance on assessments, IT and cybersecurity consulting, policy writing, employee training, and more. Your regional MEP center will also be able to find out what grants are currently available to help offset the costs of these projects and are solely dedicated to working with small and medium manufacturers. Manufacturers located in the Mohawk Valley can contact AIM Cybersecurity Coordinator Paul LaPorte for any questions or needs regarding CMMC, cybersecurity, or other IT related questions you may have. Those outside the Mohawk Valley can find their regional MEP center by going to https://newyorkmep.org/.
Posted in