CMMC, ITAR and Manufacturing Software: What Defense Manufacturers Need to Know

For defense manufacturers, production software is no longer just an operational decision. It's a cybersecurity decision.

I've spent my career helping manufacturers connect the right ERP and manufacturing systems so they can scale with greater visibility and control. Today, for companies supporting the defense industrial base, that control extends beyond production schedules, inventory, and delivery dates. It includes protecting the sensitive information that moves through every stage of manufacturing.

Your ERP holds more than job numbers and purchase orders. It may hold controlled technical drawings, engineering specifications, production travelers, inspection records, and supplier documentation. If that information is subject to government cybersecurity requirements, the software managing it becomes part of your compliance strategy.

That's why CMMC, ITAR and FedRAMP considerations should be part of how defense manufacturers evaluate manufacturing software.

StartProto runs on AWS GovCloud (US), providing a US-based government cloud infrastructure foundation. We are pursuing FedRAMP Moderate through a dedicated compliance program led by our compliance lead, TJ Elam. Our goal is to build a manufacturing platform that takes the security requirements of defense manufacturers as seriously as they do.

Here's what manufacturers need to understand about CMMC, ITAR, cloud manufacturing software, and the role their ERP plays in protecting controlled production data.

Understanding the Requirements for Defense Manufacturers

What is CMMC? The Cybersecurity Maturity Model Certification (CMMC) is the Department of War's framework for verifying that defense contractors and subcontractors have implemented appropriate cybersecurity protections for sensitive government information.

CMMC is designed to protect two primary categories of information:

• Federal Contract Information (FCI): Information provided by or generated for the government under a contract that is not intended for public release.
• Controlled Unclassified Information (CUI): Sensitive government information that requires safeguarding or dissemination controls under applicable laws, regulations or government-wide policies.

For manufacturers handling CUI, CMMC Level 2 is particularly important. It is based on the 110 security requirements in NIST Special Publication 800-171 Revision 2.

These requirements address areas including access control, authentication, audit logging, incident response, configuration management, personnel security and system integrity.

In practical terms, CMMC affects much more than your IT department. It affects the systems, people and processes involved in quoting, engineering, purchasing, production, quality and shipping.

What happened to CMMC Phase II?

When the Department of War paused the planned Phase II rollout of CMMC on July 13, 2026, many manufacturers interpreted the announcement as a reason to put compliance projects on hold. That would be a mistake.

The original November 10, 2026 implementation date for expanded third-party certification requirements is on hold. A September 3 class deviation further directed contracting officers to remove or revise third-party assessment requirements in applicable contracts. The department's 60-day reform review period concluded in September, with further program guidance still evolving.

What hasn't changed is the underlying obligation to safeguard controlled information.

Applicable DFARS 252.204-7012 requirements remain in effect. Defense contractors handling covered defense information must continue implementing the applicable NIST SP 800-171 requirements, reporting qualifying cyber incidents within 72 hours and meeting applicable assessment and affirmation obligations.

For manufacturers, the message is straightforward: the certification timeline may change, but protecting your customers' information is still a contractual responsibility.

The companies that use this time to strengthen their cybersecurity practices will be better positioned when additional assessment requirements take effect.

CMMC vs. FedRAMP: Why Your Manufacturing Software Matters

CMMC and FedRAMP are frequently discussed together, but they address different parts of the cybersecurity equation.

CMMC applies to the defense contractor. FedRAMP addresses the security of cloud service providers.

Understanding the distinction is important when selecting manufacturing ERP software.

CMMC: Protecting your manufacturing operation

CMMC evaluates whether your organization has implemented the cybersecurity practices necessary to protect FCI and CUI.

For a manufacturer, this can include:

• Employee access to engineering drawings and technical specifications.
• Computers and networks used in production.
• ERP and manufacturing execution systems.
• Email, file sharing and document management.
• Supplier communications and outside processing.
• Quality records, inspection data and production documentation.

Your manufacturing software is one component of this larger environment. It needs to support your security strategy rather than introduce additional gaps.

FedRAMP Moderate: Evaluating your cloud software vendors

The Federal Risk and Authorization Management Program (FedRAMP) establishes security standards for cloud services used by federal agencies.

Under DFARS 252.204-7012, when a contractor uses an external cloud service provider to store, process or transmit covered defense information, that cloud service must meet security requirements equivalent to the FedRAMP Moderate baseline.

This can be accomplished through FedRAMP Moderate authorization or an accepted equivalency pathway supported by the required assessment and documentation.

This distinction matters when evaluating cloud manufacturing software.

A vendor advertising SOC 2 compliance, encrypted storage or secure hosting has not necessarily demonstrated FedRAMP Moderate authorization or equivalency.

If your ERP stores or processes CUI, you need to understand exactly what security standards the underlying cloud service and application meet, what evidence the vendor can provide, and where vendor responsibilities end and yours begin.

CUI Is Hiding in Your Everyday Manufacturing Operations

When manufacturers think about controlled information, they often picture government documents stored in a restricted folder or a secure server.

In reality, CUI can move through nearly every stage of a manufacturing workflow.

Consider a typical defense manufacturing job.

It begins with a customer RFQ containing technical specifications. Engineering receives a CAD model and associated drawings. The production team creates a BOM, routing and traveler. Purchasing issues orders for materials and outside processing. Quality generates first article inspection reports and dimensional inspection records. Shipping prepares the documentation required to deliver the finished component.

Each of those steps can involve information subject to safeguarding requirements.

Some common examples include:

• CAD files, engineering drawings and technical specifications.
• Bills of materials and manufacturing instructions.
• Routing documents, production travelers and process specifications.
• Purchase orders and supplier flowdown documentation.
• First article inspection reports and quality records.
• Emails and attachments containing controlled technical information.

The challenge is that this information rarely lives in one place.

A drawing might be stored in a shared drive, attached to an email, uploaded into an ERP and forwarded to an outside processor. Production instructions may be printed and distributed across the facility.

Every additional system or transfer creates another point that needs to be evaluated as part of your cybersecurity boundary.

This is one reason manufacturing ERP software deserves more attention during CMMC planning. Your ERP often connects the very systems and processes through which controlled information moves.

Cloud Manufacturing and ITAR: What Defense Manufacturers Should Know

CMMC is not the only regulatory consideration for defense manufacturers. Companies producing defense articles or handling controlled technical data may also have obligations under the International Traffic in Arms Regulations (ITAR).

ITAR governs the export and temporary import of defense-related articles, services and technical data identified on the U.S. Munitions List.

For manufacturers, this can include engineering drawings, CAD models, specifications, technical documentation and other controlled information associated with defense products.

Is cloud manufacturing software ITAR compliant?

This is an important question when evaluating cloud manufacturing software.

ITAR-regulated technical data must be handled in accordance with applicable export control requirements, including restrictions on access by foreign persons.

Using a cloud platform does not automatically make a manufacturer ITAR compliant. Likewise, hosting software in a U.S.-based data center does not, by itself, establish ITAR compliance.

Manufacturers evaluating ITAR-compliant manufacturing software should understand:

• Data residency: Where is production and engineering data stored and processed?
• Access controls: Who can access controlled technical information, and how is access restricted?
• Personnel controls: Are personnel access and administrative privileges managed in accordance with applicable export control requirements?
• Encryption: How is sensitive data protected at rest and in transit?
• Auditability: Can the organization demonstrate who accessed or modified controlled information?
• Third-party services: Do integrations, support tools, backups and other service providers introduce additional exposure?

Why AWS GovCloud matters

AWS GovCloud (US) provides a cloud infrastructure environment designed for sensitive workloads subject to U.S. government security and regulatory requirements.

StartProto runs on AWS GovCloud today. This provides a U.S.-based government cloud infrastructure foundation for our manufacturing platform.

However, infrastructure selection is only one part of the equation. Application-level controls, personnel access, operational procedures and the specific services handling controlled data must also be evaluated.

For manufacturers considering cloud manufacturing software for ITAR-regulated operations, the right question isn't simply whether a vendor uses GovCloud. It's whether the complete solution and its operating model satisfy the requirements applicable to your data.

The Hidden Cost of Running Two Manufacturing Systems

One common approach to CMMC preparation is to maintain a traditional ERP while implementing a separate secure enclave for controlled information.

This can provide a way to isolate CUI, but it also introduces operational complexity.

Your team still needs the same drawing to quote the job, schedule production, issue materials, build the part and complete inspection. If that information lives in a separate environment, employees may need to move between systems, duplicate records and manually transfer information.

That creates several challenges:

• Duplicate data entry: Employees enter the same information into multiple systems.
• Version control problems: Engineering revisions may not be reflected consistently across environments.
• Operational delays: Teams spend time switching systems and locating information.
• Expanded compliance scope: More integrations and data transfers mean more relationships to document and assess.
• Higher software costs: Separate enclave subscriptions, integration work and consulting fees add to the total cost of ownership.

For example, an enclave costing $150–$300 per user per month would represent $36,000–$72,000 annually for 20 users, before additional software, integration or consulting costs. This is an illustrative scenario, not a universal market price.

The alternative worth evaluating is a connected manufacturing system designed with security boundaries and data handling requirements in mind.

When quoting, purchasing, production, inventory and quality operate in one connected ERP, manufacturers can reduce unnecessary data transfers and improve operational visibility.

Of course, consolidation does not eliminate the need for a properly defined CUI boundary. The specific application, hosting environment, integrations and access controls still need to be evaluated before placing CUI in the system.

What to Look for in CMMC Machine Shop Software and Manufacturing ERP

Whether you call it CMMC machine shop software, defense manufacturing ERP or secure cloud manufacturing software, the evaluation criteria should extend beyond standard production functionality.

Manufacturers need a platform that supports both operational control and a well-defined cybersecurity strategy.

Here are five areas to evaluate.

1. Secure cloud infrastructure

Understand where your data is hosted, what cloud security standards apply, and whether the provider can supply documentation supporting its security claims.

For cloud services handling CUI, ask specifically about FedRAMP Moderate authorization or equivalency.

2. User access and permissions

Your ERP should support appropriate user permissions and access controls. Not every employee needs access to every engineering drawing, customer record or production document.

Ask how the vendor manages authentication, privileged access and audit logging.

3. Traceability and audit records

Manufacturers need visibility into what happened to a job, who performed an operation, which revision was used and what documentation was generated.

Look for systems that maintain reliable records of production and quality activities.

4. Connected production and quality workflows

Your ERP should connect the information used in quoting, BOM management, purchasing, production scheduling, execution and quality.

Disconnected applications create more opportunities for data to be duplicated, transferred or exposed outside the intended environment.

5. Clear vendor responsibility and documentation

Ask the vendor to explain which security controls it owns, which responsibilities are shared, and which remain with your organization.

A documented Customer Responsibility Matrix is particularly useful when preparing for an assessment.

No manufacturing software can make your organization CMMC compliant on its own. But the right platform can simplify your environment, reduce operational complexity and give your team a stronger foundation for implementing the required controls.

How StartProto Is Approaching Manufacturing Software Security

At StartProto, we believe defense manufacturers shouldn't have to choose between operational efficiency and taking cybersecurity seriously.

Our platform connects the manufacturing workflow, from quoting and purchasing through production and quality, so teams can work from a shared operational system rather than relying on disconnected applications.

We are also investing in the infrastructure and compliance program needed to support the security expectations of defense manufacturers.

Here's where we stand:

AWS GovCloud (US) infrastructure

StartProto runs on AWS GovCloud, providing a U.S.-based government cloud infrastructure foundation.

Pursuing FedRAMP Moderate

We are pursuing FedRAMP Moderate through a dedicated compliance program led by our compliance lead, TJ Elam. This involves preparing for the security requirements and independent assessment associated with the FedRAMP Moderate baseline. We will communicate our authorization status accurately as the program progresses.

Connected manufacturing workflows

StartProto brings quoting, BOMs, purchasing, production, inventory and quality together in one manufacturing platform. This connected approach helps reduce the operational fragmentation associated with managing production information across multiple systems.

Configurable documentation and records

Our Custom Forms and records capabilities support manufacturers managing documented quality processes, including customers who maintain ISO 9001 certification.

We recognize that security is a shared responsibility. Your manufacturing software provider should be transparent about its infrastructure, security controls, documentation and responsibilities. Your organization remains responsible for its own policies, people, devices, facility and applicable compliance obligations.

We will never claim that installing StartProto makes a manufacturer CMMC or ITAR compliant. Those responsibilities belong to the organization. What we can do is be transparent about our security program and build a manufacturing platform that takes those responsibilities seriously.

Frequently Asked Questions About CMMC and Manufacturing Software

What is CMMC, and why does it matter to manufacturers?

CMMC is the Cybersecurity Maturity Model Certification, a Department of War framework designed to verify that defense contractors implement appropriate cybersecurity protections. It matters to manufacturers handling Federal Contract Information or Controlled Unclassified Information because applicable contracts require specific safeguarding practices and assessments.

Do machine shops need CMMC certification?

Manufacturers and machine shops that support defense contracts may need to meet CMMC requirements if they handle FCI or CUI. The specific level depends on the information involved and the requirements in the applicable contract. Companies handling CUI generally need to address CMMC Level 2 requirements.

Does my manufacturing ERP need to be FedRAMP Moderate authorized?

Not every manufacturing ERP needs FedRAMP Moderate authorization. However, if an external cloud service provider stores, processes or transmits covered defense information, DFARS 252.204-7012 requires the cloud service to meet FedRAMP Moderate-equivalent security requirements. Authorization or an accepted equivalency pathway should be verified for the specific service.

Is AWS GovCloud automatically ITAR compliant?

No. AWS GovCloud provides infrastructure designed for sensitive government workloads, but using GovCloud alone does not make an application or manufacturer ITAR compliant. The complete solution, including application controls, personnel access, data handling and third-party services, must be evaluated against applicable export control requirements.

Can manufacturers use cloud software for ITAR-controlled data?

Potentially, yes. Cloud environments can support ITAR-regulated operations when the specific services, configurations, personnel access and operating practices satisfy applicable requirements. Manufacturers should evaluate the complete solution rather than relying solely on a vendor's cloud hosting claims.

Does CMMC Phase II being paused mean manufacturers can delay cybersecurity investments?

No. The pause affects the planned rollout of expanded third-party assessment requirements. Applicable contractual cybersecurity obligations, including relevant DFARS and NIST SP 800-171 requirements, remain in effect. Manufacturers should continue strengthening their security programs and preparing supporting evidence.

‍