CMMC Level 2 Certified Machine Shop, C3PAO Assessed
C3PAO assessed against all 110 NIST SP 800-171 requirements and registered in SPRS. What that covers for your drawings, quotes and CUI, and what it changes for your program.
Certification vs. Self-Assessment: Why the C3PAO Matters
The Cybersecurity Maturity Model Certification (CMMC) is the U.S. Department of Defense's program for verifying that contractors protect Controlled Unclassified Information (CUI). Level 2 aligns to the 110 security requirements of NIST SP 800-171 and is the level required for most contracts that involve CUI, which in a machine shop means technical data packages, drawings, specifications and the quotes and emails that carry them.
There are two ways a supplier can hold Level 2. A self-assessment, where the company scores itself and affirms the result in SPRS, and a certification assessment, where an accredited Certified Third-Party Assessment Organization (C3PAO) examines the implementation and issues the result. JD Machine holds the second. An independent assessor verified every one of the 110 requirements, and the certification is recorded in the Supplier Performance Risk System where a prime contractor or contracting officer can confirm it directly.
The Certification, Stated Plainly
What a prime contractor's supplier-security review needs to see, in the order it usually asks.
Level and type
CMMC Level 2, Final Certification by C3PAO assessment. Not a self-assessment, not a conditional status. The assessment covered the full set of 110 NIST SP 800-171 requirements.
Assessing organization
An accredited Certified Third-Party Assessment Organization (C3PAO). C3PAOs are accredited by the Cyber AB, the DoD's authorized accreditation body for the CMMC ecosystem, and the assessment result is recorded where a prime can verify it rather than taken on the supplier's word.
Verification
Ask and JD Machine will provide the certification record directly, or verify the status yourself in SPRS using the CAGE code. That is the current state at the moment you check it, which is more use to a supplier file than a date printed on a web page.
SPRS registration
The certification status and JD Machine's CAGE code are recorded in the Supplier Performance Risk System. A prime or a contracting officer with SPRS access can verify the status without asking JD Machine for anything.
What CUI Handling Covers at JD Machine
Controlled Unclassified Information arrives at a machine shop in ordinary-looking forms: a drawing attached to an RFQ, a technical data package for a first article, a specification revision emailed by a program engineer, a CAD model for a fixture. CMMC Level 2 governs how all of it is received, stored, accessed, shared and eventually destroyed.
In practice that means quotes, drawings, technical data and the email that carries them are handled inside a controlled environment with access limited to the people working the job, with the marking, handling and retention rules the contract requires. Customers sending CUI to JD Machine can do so knowing the receiving environment has been independently assessed against the standard their contract cites.
The Controls Behind It, in Plain Terms
Access is limited to the job
People see the technical data for the work they are assigned, and nothing else. Access is granted by role, reviewed, and removed when it is no longer needed.
Data is protected in transit and at rest
CUI is encrypted wherever it moves and wherever it sits, and it does not leave the controlled environment for personal devices, consumer file-sharing or unmanaged email.
Activity is logged and reviewed
Access to CUI systems is recorded and reviewed, so unusual activity is visible rather than assumed away.
People are trained and verified
Everyone who handles CUI is screened and trained on the handling rules before they touch it, and the training recurs.
Incidents have a plan
A documented incident response process covers detection, containment, reporting to the DoD within the required window, and recovery.
It is re-verified
The implementation was assessed by an independent C3PAO, and compliance is affirmed in SPRS on the DoD's required cadence. The controls are maintained as a running system, not a one-time project.
CMMC Level 2, ITAR and AS9100D Together
A DoD prime vetting a subcontractor usually needs three things at once: a quality system fit for flight and defense hardware, export-control registration for the technical data, and cybersecurity certification for the CUI. JD Machine holds AS9100D and ISO 9001:2015 through Amtivo, ITAR registration with the U.S. Department of State, and CMMC Level 2 through a C3PAO. One supplier, one qualification package, no gap to explain.
Defense ManufacturingThe Announcement and the Buyer's Guide
JD Machine achieves CMMC Level 2
The original announcement of the C3PAO certification, with the context of what the assessment involved and why JD Machine pursued certification rather than self-assessment.
Read the announcementWhat DoD primes actually look for
A guide for buyers vetting subcontractors on the ITAR, CMMC and AS9100 stack: what to verify, where to verify it, and what the credentials do and do not cover.
Read the guideRequest the Compliance Documentation Package
The CMMC certification record, ITAR registration confirmation, AS9100D and ISO 9001:2015 certificates, and a supplier-security summary are available as a package for approved-vendor-list submissions. Request it through the form and it is returned within 24 hours in most cases.
Qualify a CMMC Level 2 Supplier in One Step
Request the compliance documentation package for your approved vendor list, or send a print for a quote. Response within 24 hours in most cases.
(801) 782-4394CMMC Questions Buyers Ask
Does CMMC Level 2 cover ITAR data?
No. CMMC governs how CUI is protected; ITAR governs who may access defense technical data and where it may go. They overlap on the same drawings but are separate requirements. JD Machine holds CMMC Level 2 certification and is ITAR registered with the U.S. Department of State, so both are covered.
Is JD Machine's certification current?
Yes. CMMC requires a senior company official to affirm continued compliance in SPRS on the DoD's cadence, and a prime contractor can confirm the live status there at any time using JD Machine's CAGE code. The certification record is also available on request.
What is the difference between a CMMC self-assessment and a C3PAO certification?
A self-assessment is scored by the company itself and affirmed in SPRS. A C3PAO certification is an independent examination of the implementation by an accredited assessor. Contracts that involve CUI generally require the C3PAO certification. JD Machine holds the certification, not the self-assessment.
How can a prime contractor verify JD Machine's CMMC status?
Through the Supplier Performance Risk System (SPRS), using JD Machine's CAGE code. The status is visible to contracting officers and to primes with SPRS access. The certification record is also available on request as part of the compliance documentation package.
How many manufacturers hold CMMC Level 2 certification?
Relatively few. The requirement is new to most of the defense industrial base and the C3PAO assessment is a substantial undertaking for a mid-market manufacturer. Holding a final Level 2 certification, rather than a self-assessment or a plan of action, is one of the clearer ways a machine shop distinguishes itself on a DoD prime's approved supplier list.