CMMC for Wisconsin Manufacturers: Which Level You Need and Where to Start

CMMC applies to a Wisconsin manufacturer when defense work, as a prime or a subcontractor at any tier, puts nonpublic contract information on the shop's own computers. You need Level 1 if you only handle Federal Contract Information (FCI), the nonpublic information a defense contract gives you or has you create. You need Level 2 if you receive Controlled Unclassified Information (CUI), such as drawings and specs marked as controlled. As of late September 2026, both levels are self-assessments you post yourself, because the third-party phase is suspended. The place to start is finding out exactly what your customers send you.

This is general information about a federal rule, not legal advice. The clauses in your contract or purchase order govern what you owe.

CMMC for Wisconsin manufacturers: does it apply to your shop?#

The CMMC rule (32 CFR 170.3 (opens in a new tab)) covers every Department of Defense contract and subcontract awardee that will process, store or transmit FCI or CUI on its own information systems. (The department's CMMC pages now call it the Department of War.) It reaches commercial items too, except contracts exclusively for commercially available off-the-shelf (COTS) items.

The part that catches small manufacturers is flowdown. Under 32 CFR 170.23 (opens in a new tab), CMMC applies to subcontractors "throughout the supply chain at all tiers," and primes must pass the requirement down. You can sit several tiers below the prime (say, machining brackets for a company that builds assemblies for the contract holder) and still be in scope.

Signs it applies to you:

• Your purchase orders or subcontracts cite DFARS 252.204-7012, 252.204-7019, 252.204-7020 or 252.204-7021, or FAR 52.204-21.
• A customer has asked for your SPRS score or your CMMC status.
• Drawings or specs arrive marked CUI or carry distribution statement B, C, D, E or F. DFARS 252.204-7012 (opens in a new tab) treats technical information with a military or space application that meets the B through F criteria as controlled technical information, and it names engineering drawings as one example of technical information.

CMMC Level 1 vs Level 2 in plain English#

The level depends on the type of information you hold, not the size of your shop. For subcontractors, the rule sets the floor: FCI only means Level 1, and any CUI means at least Level 2.

Level 1 protects FCI. It is the 15 basic safeguarding requirements in FAR 52.204-21 (opens in a new tab): limit system access to authorized users, verify who those users are, sanitize or destroy media before disposal, escort visitors, fix flaws in a timely manner, run malware protection and keep it updated, and separate public-facing systems from your internal network. Much of this is ordinary good IT practice. The catch is that every one must be met, because Level 1 does not allow open items on a plan.

Level 2 protects CUI. It is the 110 security requirements in NIST SP 800-171 Revision 2 (opens in a new tab). NIST has since published Revision 3 and marked Revision 2 withdrawn, but the rule says CMMC Level 2 requirements are "identical to the requirements in" Revision 2 (32 CFR 170.14 (opens in a new tab)). Level 2 reaches well past antivirus and passwords, into logging, configuration control, incident response, media protection and encryption.

Level 3 adds selected requirements from NIST SP 800-172, is assessed by the government's DCMA DIBCAC team, and requires a final Level 2 certification first (32 CFR 170.18 (opens in a new tab)). It applies only where a contract calls for it, and it is not where a small shop starts.

Here is how the two common levels compare, per the DoW CIO CMMC page (opens in a new tab) as of late September 2026:

Is CMMC paused? Where the phase-in stands#

• Phase 1 began November 10, 2025. Under 32 CFR 170.3 (opens in a new tab), that is the phase where DoD intended to require Level 1 (Self) or Level 2 (Self) as a condition of award in applicable contracts.
• Phase 2 was scheduled for November 10, 2026. That is the step where the rule says DoD intended to start requiring Level 2 certification assessments by a Certified Third-Party Assessment Organization (C3PAO).
• On July 13, 2026, the Department of War suspended the Phase II requirements and set up a CMMC reform task force. Its CMMC page (opens in a new tab) says the program "is paused in Phase 1 and may only require self-assessments at two levels," and that during this period it will enforce NIST 800-171 Rev 2 "through self-assessments and select government-led assessments."

What did not change matters more. The same page says the pause "does not eliminate the requirement for companies to protect information in accordance with DFARS clause 252.204-7012." If that clause is in your contract, it requires you to:

• implement NIST SP 800-171 on systems that handle covered defense information;
• report cyber incidents to DoD within 72 hours of discovery, which requires a DoD-approved medium assurance certificate;
• preserve images of affected systems for at least 90 days after you report;
• use cloud providers that meet security requirements equivalent to the FedRAMP Moderate baseline when they store, process or transmit covered defense information.

On top of that, DFARS 252.204-7019 (opens in a new tab) says that if you are required to implement NIST SP 800-171, then to be considered for award you need a current assessment (not more than 3 years old) with its summary score posted in the Supplier Performance Risk System (SPRS).

The plain reading: the pause removed a third-party audit deadline, not the security work. This is also the part of the program most likely to change while the task force works, so check the DoW CIO CMMC page (opens in a new tab) before you make budget decisions.

Where to start: five steps for a small manufacturer#

1. Read your contracts, then ask your customer in writing#

Pull your recent purchase orders, subcontracts and terms and conditions, and look for the clauses listed above. Under DFARS 252.204-7021 (opens in a new tab), the contracting officer fills in the required CMMC level, and the prime must flow the correct level down to you. If your paperwork is vague, email your buyer two questions: which CMMC level applies to our work, and will you send us CUI? Keep the reply.

For contract questions, the Wisconsin Procurement Institute in Milwaukee is the state's APEX Accelerator, and it lists help understanding and complying with DoD cybersecurity requirements, including CMMC (opens in a new tab), among its services.

2. Follow the CUI through your building#

Trace one controlled drawing from the moment it arrives until the part ships: the inbox, the file share, the ERP attachment, the CAD/CAM workstation, the programmer's USB stick, the printer, the machine controller, the quality folder. Every stop is in scope. The fewer places CUI lands, the smaller the job, so it is worth pricing out a small, controlled set of systems for CUI instead of securing the whole company to Level 2.

Two scoping rules in 32 CFR 170.19 (opens in a new tab) matter on a shop floor:

• Machines count, differently. Operational technology and test equipment that can handle CUI but cannot be fully secured are "specialized assets." They go in your asset inventory, system security plan and network diagram, and you must show you manage them under your own risk-based policies, but they are not assessed against the other Level 2 requirements. That is one more reason to separate the shop floor network from the front office.
• Your IT provider counts too. If an outside IT provider handles CUI or security data for you, its services fall inside your assessment scope, and the arrangement has to be documented in your plan and in the provider's customer responsibility matrix. Ask for one.

3. Run an honest gap assessment#

Score your current setup against the right list: 15 requirements for Level 1, 110 for Level 2. An outside security assessment helps here, because the people who set up your systems are not the best judges of them, and our guide to what a cybersecurity assessment should include covers what you should get back. Be strict with yourself. A self-assessment is only as good as the evidence behind it, and a senior person at your company signs off on it (step 5).

4. Write the plan, then close the gaps#

For Level 2, document how each system is handled in a system security plan. Anything still open goes on a plan of action and milestones, which you must close within 180 days (32 CFR 170.16 (opens in a new tab)). The limits are tight. Under 32 CFR 170.21 (opens in a new tab), your score must be at least 88 out of a possible 110, only the lowest-weight requirements can stay open, and the system security plan itself cannot be one of them. Then do the work: tighten access, turn on logging, patch on a schedule, train your people, and test your backups.

5. Post to SPRS, name your Affirming Official and set the calendar#

Post your results in SPRS (opens in a new tab). Under 32 CFR 170.22 (opens in a new tab), an Affirming Official, "the senior level representative" responsible for compliance, must affirm your status after every assessment and annually after that. Put the dates on the calendar: Level 1 self-assessments every year, Level 2 every three years, affirmations every year. If you hold CUI under DFARS 252.204-7012, also get the medium assurance certificate and write down who does what when the 72-hour reporting clock starts.

How Coulee Tech helps with CMMC in Wisconsin#

Coulee Tech is a managed IT and AI services company based in the Holmen and La Crosse area, with an office in Eau Claire, and our engineers work on-site across the region. Our manufacturing IT services cover the ERP, the shop floor network and OT security, and our compliance management work supports NIST and CMMC: gap analysis, policy development, technical controls, employee training, documentation and audit preparation.

We do not certify anyone. Our part is the preparation: finding the gaps, fixing them and keeping the evidence current. Our Eau Claire office serves the Chippewa Valley, and our Holmen office serves La Crosse and the Coulee Region.

Frequently asked questions#

Book a compliance review#

Not sure which level your contracts require, or how far you are from it? Book a compliance review and we will start with a gap analysis against the level your contracts call for, then rank the fixes by risk. An initial gap analysis typically takes 2 to 4 weeks.