CMMC Level 1 on the Shop Floor: CNC Machines, USB Sticks, and Older Equipment

Most CMMC Level 1 guides are written as if every company is an office. If you run a machine shop, a fabrication floor, or a small plant, you have questions those guides don't answer. Is the whole floor in scope? Can we keep walking programs to the machines on a USB stick? What do we do with the controller that's older than half our crew?

Here's how the 15 FAR 52.204-21 requirements apply on the shop floor, in plain English.

What on the shop floor is actually in scope?

For a Level 1 self-assessment, what's in scope is the equipment that processes, stores, or sends Federal Contract Information (FCI). FCI is information you receive or create under a government contract that isn't meant for the public: drawings, specs, purchase orders, delivery schedules, and similar files from a defense job.

That means your scope is usually smaller than the whole building. The fastest way to find it is to follow one drawing from the moment it arrives:

It lands in someone's email or a shared folder.
An engineer opens it on a CAM workstation.
A program goes to the machine over the network or on a USB stick.
The controller runs it, and a copy prints at the inspection bench.

Every stop on that path is in scope. Machines that never see contract files, the break room TV, and the forklift charger are not. Some shops make their scope smaller on purpose by moving defense work through one route: one folder, one workstation, one way to the machine.

Write the path down once. It becomes the backbone of your self-assessment.

Do I have to stop using USB sticks to move programs?

No. Level 1 doesn't ban USB transfers. Two of the 15 requirements already cover them:

Scan what comes in. Requirement 15 asks you to scan files from outside sources as they're downloaded, opened, or run. DoD's Level 1 Assessment Guide uses files copied from USB drives as its example. Make sure the antivirus on your CAM and office computers scans removable drives.
Wipe or destroy before it goes. Requirement 7 says media that held contract information must be wiped or destroyed before it's thrown out or reused for something else. Old sticks go in the same pile as old hard drives.

A simple house rule makes both easier: company-owned sticks only, kept in a known place, no personal drives on shop computers.

What about older machines that can't have user accounts?

Many controllers have no logins and never will. You don't have to replace them to complete a Level 1 self-assessment.

DoD's Level 1 guide says a permanent limitation that's written down, along with the steps you take to protect around it, can be scored as Met. The guide expects that note to live in a security plan document, which it recommends but doesn't require at Level 1. A short written section in your own records does the same job.

Protections that often make sense for an older machine:

It isn't connected to your office network or the internet.
Only trained operators use it, in an area visitors don't wander into.
Programs reach it one controlled way, and files are scanned before they get there.
Someone is named as responsible for it.

The goal isn't to make old equipment act new. It's to show you know its limits and have handled them.

Who should be able to get to shared drives and CAM files?

The same rules that apply in the office apply here. Requirements 1 and 2 ask you to limit access to the people and devices that need it, and to limit what each person can do. In practice:

Give the defense job folder to the people who work on it, not to everyone with a login.
Give each person their own account. No shared "shop" or "CAM" login (requirement 5).
Remove access when someone leaves.

What about visitors and open bay doors?

The physical requirements cover the areas with your computers, network equipment, and anything holding contract information. They don't require you to lock down every square foot.

Draw a line around those areas: the office, the engineering desk, the network closet, the printer where drawings come out, and any machine that receives contract files. Inside that line, lock what can be locked, keep a list of who has keys or fobs, sign visitors in and escort them, and keep printouts and screens out of casual view. Delivery drivers stay at the dock. The bay doors can stay open.

What if my drawings are marked CUI or export-controlled?

Then it's a different conversation. Drawings marked as Controlled Unclassified Information (CUI), or covered by export rules, need more than Level 1, which AffirmReady does not cover. The Cyber AB Marketplace lists providers and assessors who work above Level 1.

What should I write down?

Keep it short and real:

The path contract files take through your shop, and which equipment is in scope
Your USB rule and how files are scanned
A note for each older machine: what it can't do and how you protect it
Who has access to the defense job folder
Your visitor rule, sign-in sheet, and key or badge list

Each of these should be in final form, not a draft. Your senior official will rely on them when affirming in SPRS (the Supplier Performance Risk System).

Frequently asked questions

Does Level 1 require network segmentation on the shop floor? Not as a general rule. Level 1 requires separating publicly accessible systems, like a public web server, from your internal network. It doesn't require separating every machine. Keeping in-scope equipment on a known, small path is still smart.

Do I need encrypted USB drives? Level 1 doesn't require encryption. It requires scanning incoming files and wiping or destroying media before disposal or reuse.

Do my machine operators need security training for Level 1? Training isn't one of the 15 Level 1 requirements. Operators do need to know your house rules, like the USB rule and the visitor rule, so you can follow them in practice.

For CMMC Level 1 readiness purposes only. Not legal advice. Your company is responsible for the accuracy of its self-assessment and affirmation.

Sources: FAR 52.204-21 (acquisition.gov); DoD CMMC Assessment Guide, Level 1 (dodcio.defense.gov); 32 CFR 170.15, 170.19 and 170.22.

Not sure where your shop stands on the 15 requirements? Take the free five-minute Readiness Check at affirmready.com/readiness-check.