Manufacturing is where NIST SP 800-171 meets equipment that was never designed for it. A defense machine shop receives a technical data package from its customer, converts it into CAM programs, sends those programs to CNC controllers on the floor, prints drawings for the operators, and tracks the job in an ERP system. Every one of those steps can put Controlled Unclassified Information somewhere a standard IT control set does not reach.
The challenge is rarely the office network. It is the operational technology, the paper, and the business systems that hold engineering data alongside everything else.
Where CUI lives in a manufacturing business
- Technical data packages, models and drawings received from customers — typically Controlled Technical Information, often with a distribution statement and sometimes ITAR-controlled.
- CAD and CAM files and the CNC programs generated from them, which inherit the controls of the source data.
- Printed drawings, travelers and inspection reports on the shop floor.
- ERP and MRP systems such as ProShop, E2 or JobBOSS when they store drawings, routings or customer specifications.
- Quality records, first article inspection reports and certificates that reproduce controlled dimensions.
Mapping this flow is the first deliverable of any manufacturing engagement. CUI categories explains why technical data usually falls under Controlled Technical Information, and how to find CUI in your systems covers the tracing method.
The legacy OT problem
Many CNC controllers, coordinate measuring machines and test stands run embedded or end-of-life versions of Windows that cannot be patched, cannot run an endpoint agent, and would void the machine's warranty if you tried. Requirements such as 3.14.1 (flaw remediation), 3.14.2 (malicious code protection) and 3.4.2 (security configuration) cannot be met on the device itself.
The accepted approach is to isolate rather than harden: place the machines on a segmented network with no internet access, control what can transfer programs to them, scan media before use (3.7.4 and 3.14.5), and document the compensating controls in the SSP. CMMC scoping guidance recognizes specialized assets such as operational technology and test equipment as a distinct category documented in the SSP rather than assessed against every requirement.
Paper on the shop floor
A printed drawing is CUI on physical media. The Media Protection and Physical Protection families apply: drawings must be marked, kept in controlled areas, accounted for when they leave, and destroyed properly when no longer needed (3.8.1, 3.8.3, 3.8.4, 3.8.5). Visitors walking the floor on a tour must be escorted and logged (3.10.3 and 3.10.4), two requirements that can never be placed on a POA&M.
The practical fixes are simple and cheap — marked folders, locked drawing racks, shredding bins, a visitor log at the entrance to production — but they are frequently missed because nobody thinks of the floor as part of the information system.
ERP and the scoping decision
If your ERP stores drawings or controlled specifications, every user and integration of that system is in scope. Many shops reduce scope by keeping controlled files in a separate, protected file repository and storing only job numbers and non-controlled data in the ERP. Others move the ERP into an enclave or a cloud environment that meets the DFARS 252.204-7012 FedRAMP Moderate equivalency requirement.
Either choice is defensible; leaving it undecided is not. The cost implications are covered in what CMMC compliance actually costs.
A realistic sequence for a machine shop
- Trace every path a customer drawing takes from receipt to scrap.
- Decide the boundary: enclave for engineering and ERP, segmented OT network for the floor.
- Fix the quick physical wins: marking, storage, visitor control, destruction.
- Implement MFA, FIPS-validated encryption and logging inside the boundary.
- Document OT compensating controls in the SSP and post an honest SPRS score.
Frequently asked questions
Do CNC machines need antivirus to meet NIST 800-171?
Machines that cannot run it should be isolated and their media controlled, with the compensating controls documented in the SSP. Assessors look for a reasoned approach, not an agent on every device.
Are drawings always CUI?
Not always. Drawings the customer marks or identifies as controlled, or that contain export-controlled technical data, should be treated as CUI. Commercial drawings with no DoD connection are not.
Is a small machine shop held to all 110 requirements?
Yes, if it handles CUI. Scope is the lever: keeping CUI in a small enclave makes the full standard affordable.
How do CNC programs get to the machines safely?
Through a controlled transfer path — a dedicated file server or DNC system on the segmented OT network, with access limited to programmers and scanned media only. Avoid ad hoc USB transfers from engineering laptops.