CMMC Level 1 on the shop floor: what's in scope, USB transfers, and older machines

KB-061 | Applies to: All plans | Last reviewed: October 27, 2026 | Version 1.0

How the 15 requirements apply to CNC machines, CAM workstations, and the rest of the plant

KB-061 | Applies to: All plans | Last reviewed: October 27, 2026

Most CMMC Level 1 guides are written as if every company is an office. If you run a machine shop, a fabrication floor, or a small plant, this guide answers the questions they skip: which equipment is in scope, whether you can keep moving programs on USB sticks, and what to do with machines that can't have logins.

Find what's in scope by following one drawing

For a Level 1 self-assessment, what's in scope is anything that processes, stores, or sends Federal Contract Information (FCI). FCI is information you receive or create under a government contract that isn't meant for the public, such as drawings, specs, purchase orders, and delivery schedules. Not sure whether your contracts involve FCI? See KB-062.

The fastest way to find your scope is to follow one drawing from the moment it arrives:

• It lands in someone's email or a shared folder.
• An engineer opens it on a CAM workstation.
• A program goes to the machine over the network or on a USB stick.
• The controller runs it, and a copy prints at the inspection bench.

Every stop on that path is in scope. Machines that never see contract files, the break room TV, and the forklift charger are not. Some shops keep their scope small on purpose by moving defense work through one route: one folder, one workstation, one way to the machine.

Write the path down on the File Path tab of the Scoping Worksheet, in the 0 Start Here folder of the evidence folder kit (see KB-040). The worksheet's Summary tab matches the scope fields you'll fill in on SPRS.

Moving programs on USB sticks

Level 1 doesn't ban USB transfers. Two requirements already cover them:

• Scan what comes in (requirement 15). Make sure the antivirus on your CAM and office computers scans USB drives when they're plugged in.
• Wipe or destroy before it goes (requirement 7). A stick that held contract files is wiped or destroyed before it's thrown out or reused for something else. Old sticks go in the same pile as old hard drives.

A simple house rule makes both easier: company-owned sticks only, kept in a known place, and no personal drives on shop computers. The House Rules template in the 0 Start Here folder has a line for it.

Older machines that can't have logins

Many controllers have no user accounts, updates, or antivirus, and never will. You don't have to replace them to complete a Level 1 self-assessment. DoD's Level 1 Assessment Guide says a permanent limitation that's written down, along with the steps you take to protect around it, can be scored as Met.

Write it down on the Older Equipment tab of the Scoping Worksheet: what the machine can't do, and how you protect it. Protections that often make sense:

• It isn't connected to your office network or the internet.
• Only trained operators use it, in an area visitors don't walk through.
• Programs reach it one controlled way, and files are scanned before they get there.
• Someone is named as responsible for it.

Who can get to job folders and CAM files

The same rules apply on the floor as in the office. Give the defense job folder only to the people who work on those jobs, give each person their own login with no shared "shop" or "CAM" account, and remove access the day someone leaves. The Authorized User List template in the 1 Access Control folder helps you keep track.

Visitors and open bay doors

The physical requirements cover the areas with your computers, network equipment, and anything holding contract information. You don't have to lock down every square foot. Draw a line around the office, the engineering desk, the network closet, the printer where drawings come out, and any machine that receives contract files. Inside that line, lock what can be locked, keep a list of who has keys or fobs, sign visitors in and escort them, and keep drawings and screens out of casual view. Delivery drivers can stay at the dock, and the bay doors can stay open.

The Visitor Log and Key and Badge List templates are in the 4 Physical Protection folder.

If your drawings are marked CUI or export-controlled

Drawings marked as Controlled Unclassified Information (CUI) usually point to CMMC Level 2, not Level 1. AffirmReady covers Level 1 only. See KB-003 for the difference.

What done looks like

• The path contract files take through your shop is written down, and you know which equipment is in scope.
• Your USB rule is written down, and the antivirus on in-scope computers scans USB drives.
• Each older machine has a note saying what it can't do and how you protect it.
• Your house rules, user list, visitor log, and key list are filled in and in final form, not drafts.
• Each item is recorded in AffirmReady with a link to where you saved it (see KB-013).

Still need help?

Email support@affirmready.com and include your company name and the email address on your AffirmReady account. Our team is available Monday through Friday, 8:00 AM to 5:00 PM Eastern, and replies within one business day.

For CMMC Level 1 readiness purposes only. Not legal advice. Your company is responsible for the accuracy of its self-assessment and affirmation.