Think of it this way: ProShop is the system, you are the discipline. ProShop provides the technical infrastructure containing audit logs with role-based access restrictions and retention controls. You own the organizational controls, defining who gets access, enforcing MFA, physical security, reviewing logs, and completing your SSP and POA&M. CMMC compliance spans three layers of responsibility, with controls managed by your shop, covered by ProShop, and relegated to a shared hosting cloud. You can learn more about these shared responsibilities with our shared responsibility matrix.

A Plan of Action and Milestones (POA&M) is a formal document that identifies controls you haven’t yet fully implemented and lays out a time-bound plan to close those gaps. The DoD requires a minimum score of 88 out of 110 controls to be eligible for conditional certification with open POA&M items (applies specifically to SPRS scoring under DFARS 252.204-7019/7020, and is subject to program-specific interpretation and regulatory change). All items must be resolved within 180 days. Critical controls cannot be deferred to a POA&M at all.

CMMC requirements flow specifically to the parts of the supply chain that handle CUI. If you receive, process, store, or transmit Controlled Unclassified Information as part of a defense contract, you are in scope for Level 2, and your prime cannot absorb that compliance on your behalf. If your work involves only Federal Contract Information (FCI) with no CUI, Level 1 may apply. When in doubt, confirm your scope with your prime contractor.

For most defense shops, yes. If a digital or paper traveler contains technical specifications, revision levels, or information derived from a defense contract, it very likely contains CUI. This is one of the most common places shops underestimate their CUI footprint. If you’re performing defense work, treat your travelers as CUI until a formal scoping exercise confirms otherwise.

For most small shops, an enclave is the more practical starting point. It limits your compliance scope to only the systems and people that touch CUI, which reduces cost and complexity significantly. The tradeoff is maintaining a real, documented boundary between your CUI environment and everything else. ProShop SAFE is designed specifically to support this model. Boundary definition, network segmentation, and organizational controls remain the customer’s responsibility.

Any tool that processes, stores, or transmits CUI is inside your compliance boundary and must be addressed in your System Security Plan. Most commercial versions of Teams, Slack, and standard email are not FedRAMP Moderate authorized, meaning CUI should not travel through them. This is also a staff training issue: your team needs to know not just what CUI is, but where it cannot go.

It depends, but don’t assume it isn’t. G-Code in full isolation may not qualify, but in practice, programs tied to a specific defense-contract part or stored alongside identifying metadata likely carry CUI implications. The safest posture is to apply your CUI handling procedures to all manufacturing data associated with a defense contract and work backward from there if you believe specific elements are genuinely out of scope.

Any CNC machine that receives, stores, or processes defense-contract programs is inside your CMMC boundary and must be addressed in your SSP. This includes access control, configuration management, and logging where the machine supports it. For legacy machines that rely on USB, keypad, or DNC and can’t support modern controls, you’ll need physical access restrictions, supervised operation, and manual logs documented in your POA&M.

No. AS9100 and CMMC are separate frameworks with different governing bodies and scopes. That said, shops that are already AS9100 certified have meaningful infrastructure that transfers well, such as documented procedures, consistent recordkeeping, and a culture of internal audits. If you’re AS9100 certified, you’re not starting from scratch on CMMC, but extending a discipline you’ve already built.

This is one of the most complex intersections in the current CMMC landscape, and Canadian shops should engage qualified legal and compliance guidance specific to their situation. CMMC Level 2 requires a FedRAMP Moderate authorized environment for CUI, and AWS GovCloud is restricted to U.S. persons and entities. Canadian manufacturers typically need a U.S.-based entity or a Managed Service Provider that can provide a compliant environment.