Independence Day is all about safeguarding American freedom. For defense manufacturers, protecting Controlled Unclassified Information (CUI) is part of that mission. This article distills the latest CMMC Compliance Guide podcast episode—recorded for release on July 4th—into an actionable playbook designed specifically for CNC and aerospace machine shops running DoD or ITAR work.

What Really Counts as CUI in a Machine Shop?

Paper, Prints, and Travelers

• Coolant-soaked travelers with part specifications

• Drawings, models, and derivative prints

• Legacy paperwork—even from projects a decade ago

Digital Files

• G-code sent to CNC controllers (almost always CUI)

• CAD/CAM files, setup sheets, and inspection reports

• Any derivative data created while fulfilling a DoD contract

The “Not CUI” Exception

Finished physical parts are generally not CUI, but shipping them abroad without proper authorization can trigger export-control violations.

CUI vs. ITAR: Overlapping but Different Obligations

• Export-controlled CUI often appears as ITAR-restricted controlled technical information (CTI).

• Data marked “NOFORN” means only U.S. citizens may access it—affecting whether you deploy Microsoft GCC or GCC High.

• Evaluate future bid opportunities before locking into a cloud environment that can’t handle ITAR data.

Enclave or Enterprise? Choosing the Right Architecture

When an Enclave Works

• Less than half your work is DoD-related

• Clear separation between CUI users and non-CUI users

• Budget supports dual software licenses (e.g., two seats of SOLIDWORKS)

When an Enclave Fails

• Most employees touch defense jobs

• Multiple hats in a small shop blur the lines

• “Easy button” VDI solutions get pierced by real-world workflows (e.g., pulling files to USB for the CNC)

Practical Shop-Floor Solutions That Actually Work

1. FIPS-Validated USB Drives with Keypads

• Hardware-encrypted, PIN-protected, and readable by old CNC controllers

• Inventory, label, and track each drive as CUI media

• Cost-effective alternative to $15k network diodes

2. Air-Gapped or Segmented CNC Networks

• Keep legacy controllers off the main shop network

• Use secure VLANs or subnets plus firewall rules for vendor updates

• Document exceptions in your System Security Plan (SSP)

3. Tight USB Governance

• Disable generic thumb drives across the enterprise

• Only allow approved encrypted media with specific serial numbers

• Log every file transfer in a media control sheet

4. Handling Operational Technology (OT)

• Classify CNCs, PLCs, and IoT sensors as specialized assets

• Show assessors you know where each asset lives—even if it stays offline

• Maintain firmware/update procedures with controlled firewall rules

What CMMC Assessors Really Want to See

1. Complete asset inventory—including legacy XP machines

2. Network diagram that clearly segments CUI, OT, and business systems

3. Policies and procedures covering paper CUI, USB usage, and enclave boundaries

4. SSP that tells a story—how controls are implemented, not boilerplate text

5. Evidence artifacts—screenshots, media logs, and configuration exports matching the written policies

Independence Day Checklist: First Week Back in the Shop

1. Map Your CUI Flow – Create a data-flow diagram from customer inbox to shipping dock.

2. Segment or Air-Gap – Move CNC controllers off the production LAN or fence them with VLANs.

3. Deploy Encrypted USBs – Replace off-the-shelf sticks with FIPS-validated drives and PIN pads.

4. Lock Down Paper – Use CUI cover sheets and lock cabinets after hours.

5. Update the SSP – Reflect every real-world control, especially for legacy equipment.

6. Plan for ITAR – Verify cloud and messaging services can handle export-controlled data.

CMMC compliance isn’t about perfect environments—it’s about proving you protect CUI in the messy reality of a 24/7 machine shop. By combining encrypted media, sensible network segmentation, and thorough documentation, you can achieve CMMC Level 2 without shutting down production.

Need a fast-track path to compliance or a sanity check on your current plan? CMMC Compliance Guide helps CNC and aerospace shops navigate CMMC and NIST 800-171—from readiness assessments to full implementation.

Visit cmmccomplianceguide.com to schedule a discovery call or download free resources.