CMMC 2.0 readiness for Minneapolis manufacturers, machine shops, and engineering firms in the defense supply chain. MSSP-grade controls, not paperwork-only consulting.
Minnesota manufacturers, machine shops, aerospace suppliers, and defense subcontractors don't have a CMMC question anymore. They have a CMMC deadline. The Department of Defense's Cybersecurity Maturity Model Certification (CMMC) program rule took effect in December 2024, and since November 10, 2025 the CMMC contract clause has been phasing into new DoD solicitations. If your business handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), CMMC is becoming a condition of doing business with the prime contractors you serve.
McNallan Technology Solutions has served Twin Cities businesses for more than 50 years. We're not a compliance-paperwork shop. We're an MSSP-grade IT provider that operates the same layered security stack CMMC was written to enforce: endpoint detection, application allowlisting, immutable backup, MFA enforcement, identity monitoring, tenant hardening, security awareness training, and 24/7 monitoring. When we sit down with a Minneapolis contractor to plan CMMC readiness, we already run the controls. The work is mapping what's in place, fixing what isn't, and documenting it so a C3PAO assessor can confirm it.
Minnesota's defense industrial base is bigger than people outside it realize. Honeywell Aerospace, BAE Systems, Polaris Government & Defense, Lockheed Martin, and Northrop Grumman all have a presence in the state, and their supply chains run through Minnesota subcontractors: machine shops in Anoka and Brooklyn Park, fabricators in Plymouth and Maple Grove, electronics assemblers along 169, software and engineering subs throughout the metro. Every one of those subs that handles FCI or CUI is in scope for CMMC.
The phased rollout schedule is real. Under DFARS clause 252.204-7021, CMMC requirements appear in solicitations on a planned schedule. Phase 1 began November 10, 2025 with Level 1 and Level 2 self-assessment requirements. Phase 2 adds Level 2 C3PAO certification requirements starting November 10, 2026. At full implementation in November 2028, every new DoD contract that touches FCI or CUI will require the appropriate CMMC level before contract award, not after. There is no grace period for a contractor who shows up to bid without the CMMC status a prime contractor needs to flow work down.
CMMC Level 2 maps to 110 security practices drawn from NIST SP 800-171 Rev 2, and the underlying controls assume a layered security program that a basic generalist IT contract was never built to deliver. That gap shows up at assessment time. We wrote about this in detail in our MSP vs MSSP article, the structural problem with generalist providers attempting CMMC.
We've broken our CMMC work into four service tracks, each tied to where a Minnesota contractor typically is in the journey. Click into the service that matches your situation, or talk to us about scoping a combined engagement.
For DoD contractors handling FCI only, not CUI. Annual self-assessment against the 15 basic safeguarding requirements in FAR 52.204-21. We get you ready, document it, and walk you through the SPRS affirmation.
Read more about Level 1 readinessFor contractors that touch CUI. 110 NIST SP 800-171 Rev 2 practices, triennial C3PAO assessment. We do the gap analysis, build the SSP and POA&M, deploy missing controls, and get your documentation ready for the C3PAO assessment.
Read more about Level 2 consultingThe 110 requirements behind CMMC Level 2, and what your C3PAO auditor checks. What they cover, and how our readiness work finds your gaps and gives you remediation recommendations.
Read more about NIST 800-171CMMC sits on top of a real security program. Our cybersecurity practice (24/7 SOC, EDR, application allowlisting, immutable backup, tenant hardening) is the operational layer that satisfies most Level 2 technical practices.
See our cybersecurity stackA lot of Minneapolis contractors have been through a compliance exercise before, whether a CIS assessment, ISO 27001, or a cyber insurance questionnaire. CMMC is not those.
CMMC isn't a "best practice" or a recommendation. The DFARS 252.204-7021 clause makes compliance a contractual condition. A false attestation in SPRS is a False Claims Act exposure. The 2024 Penn State settlement and the 2022 Aerojet Rocketdyne settlement both came from misrepresenting NIST 800-171 compliance.
Most frameworks let you self-describe controls. CMMC Level 2 expects documented evidence for all 110 requirements. "We have antivirus and a firewall" is not enough. Plan to show MFA enforcement, EDR alert logs, backup verification, and evidence for each NIST SP 800-171A assessment objective.
Before assessment, you must define the boundary: what systems hold CUI, what people touch it, where it's stored, who's authorized. A bad scope covers your entire company when only one engineering enclave handles CUI, ballooning cost and timeline. A good scope isolates CUI to a defined enclave and dramatically reduces the assessable surface.
Every Level 2 assessment requires an SSP, a POA&M, and a body of evidence. Once the assessment closes, you live with those artifacts, updated annually, produced again at the triennial reassessment. We build them so they're maintainable, not so they look good once and rot.
The level depends on your DoD contract and the type of information you handle. FCI requires Level 1, CUI requires Level 2.
If you handle only Federal Contract Information (FCI), you need Level 1. If you handle Controlled Unclassified Information (CUI), you need Level 2 and likely a C3PAO third-party assessment. A small minority of contractors handling the most sensitive CUI need Level 3. The contract language in your DoD solicitation, or the flow-down clause from your prime, will tell you which level applies. We’ll review your contract language as part of any engagement.
CMMC requirements are phasing into DoD solicitations now, with full implementation in November 2028. If you’re bidding on DoD work today, start now.
The CMMC program rule (32 CFR 170) took effect December 16, 2024. The DFARS contract rule took effect November 10, 2025, which started Phase 1: Level 1 and Level 2 self-assessment requirements in solicitations. Phase 2, starting November 10, 2026, adds Level 2 C3PAO certification requirements. Phase 4, full implementation, begins November 10, 2028. Typical Level 2 readiness runs 6 to 12 months.
Ask how many Level 2 engagements they’ve delivered and whether they can produce NIST SP 800-171 evidence today.
The honest test: ask them what their layered security stack looks like and whether they can produce documented evidence of the controls in NIST SP 800-171 Rev 2 today on their existing managed clients. If the answer is “we’ll figure it out together,” they’re learning on your dime.
Level 1 is self-assessment. For most Level 2 contracts touching CUI, a C3PAO third-party assessment is required.
Level 1 is self-assessment with annual affirmation in SPRS. Level 2 is mixed. For the majority of contracts that touch CUI, a triennial C3PAO third-party assessment is required, but a narrow subset allows self-assessment. The contract language determines it. Most Minnesota defense subcontractors who actually handle CUI will need a C3PAO.
You can’t bid it. CMMC compliance is a contract eligibility requirement, and no certification means no contract award.
CMMC compliance is a contract eligibility requirement under DFARS 252.204-7021. If a prime contractor requires Level 2 certification to flow work down to you, you don’t get the work, and the prime is contractually required to verify your certification before placing the order.
Talk to us about your situation. We'll spend 45 minutes on a scoping call: what contracts you're chasing, what level applies, what your current security stack looks like, and where the gaps are. From there we scope a readiness engagement, confirm the scope with you, and start work.
McNallan Technology Solutions works best with growth-focused Minnesota businesses (25+ employees) that view technology as a productivity investment, not a cost to minimize.
Prefer a real conversation? Skip the form and call us directly during business hours.
+1 763-424-3388Working hours
Mon–Fri
Emergency
8:00 AM – 5:00 PM
24/7 on-call support
Share a few details and we’ll follow up with next steps and a clear path forward.
"*" indicates required fields
