CMMC for Electronics and PCB Assembly Shops

If you build boards or assemblies for defense primes, CMMC has probably reached you by now — usually as a question from a customer rather than a letter from the government.

The good news is the same as for any small contractor: if you handle Federal Contract Information and not CUI, you’re looking at Level 1, which is 15 requirements you can meet with the systems you already run. The part that needs care in electronics is scoping, because your shop handles more varieties of customer data than most.

What FCI looks like in an assembly shop

Federal Contract Information is non-public information provided by or generated for the government under a contract. On your floor that typically includes:

  • Purchase orders and delivery schedules from a prime
  • Quantities, pricing and lead times tied to a defense program
  • Correspondence about a government job
  • Your own production paperwork for that contract — travellers, work orders, shipping documents

If you do defense work, you handle FCI. That’s the default case, and it’s Level 1.

What can push you to Level 2

This is where electronics differs from a general machine shop, and it’s worth being deliberate.

Customer-supplied design data can carry a different status. Gerber files, assembly drawings, bills of materials, netlists, test specifications and firmware are all candidates for being Controlled Unclassified Information — particularly when the end item is a defense article and the data is export-controlled.

Two signals to look for:

Markings. CUI is supposed to be marked. Check the title blocks and headers on the drawings and data packages your customers send. Look for CUI designations, distribution statements, or export-control warnings.

Contract language. Look for DFARS 252.204-7012 in your contract or purchase order. That clause follows CUI. If it’s there, the question deserves a real answer rather than an assumption.

If you find marked technical data or that clause, you’re likely looking at Level 2, which is a substantially larger undertaking — Level 1 vs Level 2 sets out the difference. Talk to your contracting officer or the prime’s contracts team before you build a programme on a guess.

If you find neither, you’re in the ordinary Level 1 case and the rest of this applies.

Where assembly shops actually have gaps

The 15 requirements are not demanding. The gaps turn up in the same few places, and they’re usually about shop-floor practicality rather than security sophistication.

Shared terminals on the line. The station where operators pull up work instructions or log test results is often a single shared login, because individual logins are friction when people rotate through. That’s a direct conflict with the unique-identification requirement. The usual fix is individual accounts with a short session, or moving the shared station out of scope by keeping contract information off it.

Programming and test equipment. AOI systems, ICT fixtures, flying-probe testers and programming stations are computers, and several of them run operating systems nobody has updated since installation. If they hold customer data or connect to your network, they’re in scope for the update and malicious-code requirements. If they’re genuinely isolated, write down that they are.

USB drives moving files to equipment. Common, practical, and a media-handling question. You don’t have to ban them. You do have to know where they go and what happens to them.

Customer data in email. Design packages arrive as attachments and live in inboxes indefinitely. Ask where those files end up and who can reach them.

Old machines that still work. A Windows 7 box driving a perfectly good piece of equipment is the hardest honest conversation in a shop like yours. If it touches contract information and can’t be updated, the options are isolating it, replacing it, or documenting precisely why it’s out of scope.

Boards and travellers on the floor. Physical protection isn’t only about doors. If documentation showing contract details sits on an open bench where visiting customers walk past, that’s within scope of the physical access requirements.

What you don’t need

No government cloud. No special software. No third-party auditor for Level 1. The ERP, email and file storage you already run can support a compliant Level 1 environment if they’re configured sensibly — see CMMC Level 1 Doesn’t Require Special Government Software.

A sensible order of work

  1. Establish whether any customer data you hold is CUI. Everything else depends on this.
  2. List where contract information lives: email, file server or cloud storage, ERP, shop-floor terminals, test equipment, paper.
  3. Work the 15 requirements against that list.
  4. Fix what’s quick — accounts, sharing settings, updates, a disposal practice.
  5. Document what you did, and keep it.

The bottom line

Electronics shops are usually Level 1, with one genuine complication: the technical data your customers send is more likely than most to be CUI, and that question has to be settled before anything else.

Settle scope first, then work the 15 requirements against your real systems — including the ones bolted to test equipment. For the wider walkthrough, start with the Plain English CMMC Level 1 Guide.