Aligning Shop-Floor and IT Processes to CMMC Level 2: NADCAP Aerospace Case Study

The most common mistake we see consultants make in environments like this one is treating CMMC as a cybersecurity project to be led out of IT. That framing fails for three reasons rooted in how manufacturing actually works.

First, manufacturing IT was never designed to be a compliance system. Coalfire Federal's own published analysis puts it directly: manufacturers have not culturally felt themselves to be targets of cyber attacks, and their IT operations are typically focused on enabling production connectivity rather than preventing unauthorized access. That is not negligence - it is a rational consequence of running a business where uptime and throughput pay the bills. The result, though, is that the existing IT documentation rarely meets the evidence standard NIST SP 800-171A applies during a C3PAO assessment.

Second, AS9100 and CMMC use different verbs. AS9100 is built around process control. The auditor asks: does the organization have a process? Is the process documented? Is it being followed? Is variation being tracked and addressed? CMMC, through the NIST SP 800-171A assessment methodology, is built around three verbs - Examine, Interview, and Test. Examine asks to see documentation. Interview asks whether the people responsible can explain the control in their own words. Test asks whether the control actually works the way the documentation claims. Documentation that satisfies an AS9100 auditor does not automatically satisfy a C3PAO assessor.

Third, the shop floor itself is in scope. Federal Contract Information and Controlled Unclassified Information do not stop at the office door. A paper traveler on a CNC operator's bench, a customer drawing printed and posted next to a heat-treat oven, a quality-inspection report sitting on a coordinate measuring machine workstation - all of these are CUI handling events. The Cyber AB and authoritative defense counsel have repeatedly confirmed that CMMC scope flows wherever CUI flows, and in a real manufacturer, CUI flows through quality, production, inspection, shipping, and receiving - not just through the email server.

Most consultants approach CMMC as a cybersecurity initiative led out of IT. For a NADCAP shop with mature AS9100 muscle memory, that is the wrong organizing principle. Quality engineers, production supervisors, and shop-floor leads already know how to live inside a controlled, audited process. The work is to extend that discipline into the cyber controls - not to rebuild it from scratch.

The end state is a single integrated quality and information security management system. AS9100 is not being run alongside CMMC. CMMC is being run as the cyber chapter of the quality system the shop already operated. Management reviews cover both. The same internal-audit team that reviews quality records can review information security evidence. The same corrective-action discipline that handles a NADCAP finding can handle a CMMC gap. The organizational cost of running CMMC after this engagement is materially lower than it would be if CMMC had been spun up as a parallel function with its own meetings, its own metrics, and its own reporting lines.

From the production floor's perspective, very little visibly changed. Paper still moves where it needs to move. Operators still run the parts that come down to them. What changed is that every CUI handling step now has a documented procedure behind it, and that procedure is followed because it is part of how the shop already works - not because someone in IT printed a new policy nobody reads.

From an assessor's perspective, what changed is much larger. The shop now produces evidence on a recurring cadence rather than producing it in a panic in the weeks before assessment. Documentation matches practice. Personnel can explain what they do. The Specialized Asset classifications are documented and defensible. The CUI inventory matches the boundary diagram in the SSP. The same shop that walked into this engagement with mature AS9100 discipline and minimal CMMC discipline now walks into C3PAO assessment with both - under one management system.

Every Consilien engagement maps to specific, citeable controls and publications. This is the regulatory and standards footprint of the work described above.

If you are running a NADCAP-accredited aerospace shop in Southern California or anywhere else, you already have a competitive advantage most CMMC content does not recognize. AS9100D and your NADCAP scope require process discipline, documented procedures, internal audit cadence, corrective-action workflow, training records, and change control - every one of which has a direct counterpart in CMMC Level 2 controls. The cost and time of CMMC preparation drops materially when the program is run as an extension of the compliance system you already have, rather than as a separate IT project.

The mistake to avoid is letting your IT vendor lead CMMC as a technology refresh. Technology is downstream of scope, and scope is set by where CUI actually flows in your business. In a real metal finishing shop, that includes the shop floor, the QA lab, the customer-supplied drawing repository, the heat-treat oven control software, and the inspection plan database - none of which are the email server.

The Cyber AB reports that approximately 1,000 organizations have achieved CMMC Level 2 certification across a Defense Industrial Base estimated at 80,000 contractors. The bottleneck is not C3PAO capacity. The bottleneck is contractor readiness. For NADCAP shops, the fastest path to readiness runs through the AS9100 system you already trust.