--- title: "CMMC Level 1 Compliance for DoD CNC | Olympus Machining" description: "How Olympus Machining meets CMMC Level 1 (Foundational) — 17 practices from FAR 52.204-21, annual self-assessment, SPRS posting. ITAR registered, CAGE 9V9P0." lang: en json-ld: | [ { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://www.olympusmachining.com/#organization", "name": "Olympus Machining LLC", "url": "https://www.olympusmachining.com", "logo": "https://storage.googleapis.com/gpt-engineer-file-uploads/SFKHg3gA6NVscESUCStAZeugW5B3/social-images/social-1762640845290-Olympus-Machining-Gear-Logo_Logo-ONLY.png", "description": "Olympus Machining LLC is a precision CNC machining shop located in Hanover, Pennsylvania, providing CNC milling and CNC turning services for OEMs and manufacturers nationwide.", "telephone": "+17176345094", "email": "info@olympusmachining.com", "address": { "@type": "PostalAddress", "streetAddress": "639 Frederick St, Suite 1", "addressLocality": "Hanover", "addressRegion": "PA", "postalCode": "17331", "addressCountry": "US" }, "sameAs": [ "https://www.google.com/maps/place/Olympus+Machining+LLC" ], "hasCredential": [ { "@type": "EducationalOccupationalCredential", "name": "ITAR Registration — DDTC", "credentialCategory": "Government Registration", "recognizedBy": { "@type": "Organization", "name": "U.S. Directorate of Defense Trade Controls (DDTC)" } }, { "@type": "EducationalOccupationalCredential", "name": "CMMC Level 1 Compliance", "credentialCategory": "Compliance Certification" } ] }, { "@type": [ "LocalBusiness", "ManufacturingBusiness" ], "@id": "https://www.olympusmachining.com/#localbusiness", "name": "Olympus Machining LLC", "image": "https://storage.googleapis.com/gpt-engineer-file-uploads/SFKHg3gA6NVscESUCStAZeugW5B3/social-images/social-1762640845290-Olympus-Machining-Gear-Logo_Logo-ONLY.png", "description": "Olympus Machining LLC is a precision CNC machining shop located in Hanover, Pennsylvania. We provide CNC milling, CNC turning, and prototype-to-production machining services for OEMs and manufacturers nationwide.", "address": { "@type": "PostalAddress", "streetAddress": "639 Frederick St, Suite 1", "addressLocality": "Hanover", "addressRegion": "PA", "postalCode": "17331", "addressCountry": "US" }, "telephone": "+17176345094", "email": "info@olympusmachining.com", "url": "https://www.olympusmachining.com", "priceRange": "$$", "areaServed": "United States", "aggregateRating": { "@type": "AggregateRating", "ratingValue": "5.0", "reviewCount": "15", "bestRating": "5", "worstRating": "1" }, "review": [ { "@type": "Review", "author": { "@type": "Person", "name": "Michael R." }, "reviewRating": { "@type": "Rating", "ratingValue": "5", "bestRating": "5" }, "reviewBody": "Olympus Machining delivered precise aluminum components for our robotics end-of-arm tooling on time and at a fair price." }, { "@type": "Review", "author": { "@type": "Person", "name": "Sarah T." }, "reviewRating": { "@type": "Rating", "ratingValue": "5", "bestRating": "5" }, "reviewBody": "We needed ITAR-compliant machining for defense hardware and Olympus Machining handled it professionally." }, { "@type": "Review", "author": { "@type": "Person", "name": "Dave K." }, "reviewRating": { "@type": "Rating", "ratingValue": "5", "bestRating": "5" }, "reviewBody": "Great CNC shop for prototype work. They provided DFM feedback that saved us time and cost." } ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Olympus Machining CNC Services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "@id": "https://www.olympusmachining.com/cnc-milling#service", "name": "CNC Milling Services", "url": "https://www.olympusmachining.com/cnc-milling", "provider": { "@id": "https://www.olympusmachining.com/#organization" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "@id": "https://www.olympusmachining.com/cnc-turning#service", "name": "CNC Turning Services", "url": "https://www.olympusmachining.com/cnc-turning", "provider": { "@id": "https://www.olympusmachining.com/#organization" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "@id": "https://www.olympusmachining.com/prototype-to-production#service", "name": "Prototype to Production Machining", "url": "https://www.olympusmachining.com/prototype-to-production", "provider": { "@id": "https://www.olympusmachining.com/#organization" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "ITAR Registered CNC Machining", "provider": { "@id": "https://www.olympusmachining.com/#organization" } } } ] } } ] }, { "@context": "https://schema.org", "@graph": [ { "@type": [ "LocalBusiness", "ManufacturingBusiness" ], "@id": "https://www.olympusmachining.com/#organization", "name": "Olympus Machining LLC", "alternateName": "Olympus Machining", "url": "https://www.olympusmachining.com", "logo": { "@type": "ImageObject", "url": "https://www.olympusmachining.com/images/olympus-logo.png", "width": 300, "height": 100 }, "image": "https://www.olympusmachining.com/images/olympus-machining-headquarters-hanover-pa.jpg", "description": "Olympus Machining LLC is a U.S.-based precision CNC machining shop in Hanover, Pennsylvania, providing CNC milling, CNC turning, and prototype-to-production machining services for OEMs and manufacturers nationwide.", "telephone": "+1-717-634-5094", "email": "info@olympusmachining.com", "address": { "@type": "PostalAddress", "streetAddress": "639 Frederick St, Suite 1", "addressLocality": "Hanover", "addressRegion": "PA", "postalCode": "17331", "addressCountry": "US" }, "geo": { "@type": "GeoCoordinates", "latitude": 39.8007, "longitude": -76.9836 }, "areaServed": { "@type": "Country", "name": "United States" }, "priceRange": "$$", "sameAs": [ "https://www.google.com/search?sca_esv=2f4ed381b998a4d8&sxsrf=AE3TifODgJgBq4b1RAZEZnaHSJwX6ZOvSg:1767447357236&kgmid=/g/11kr8nzb2c&q=Olympus+Machining+LLC&shndl=30&shem=ptotplc,shrtsdl&source=sh/x/loc/uni/m1/1&kgs=100779a69d016c62&utm_source=ptotplc,shrtsdl,sh/x/loc/uni/m1/1", "https://www.instagram.com/olympusmachining/" ], "knowsAbout": [ "CNC Milling", "CNC Turning", "Precision CNC Machining", "Prototype Machining", "Short-Run Production", "Robotics Machining", "Quality Assurance", "First Article Inspection", "ITAR Compliance" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "CNC Machining Services", "itemListElement": [ { "@type": "OfferCatalog", "name": "CNC Milling Services", "url": "https://www.olympusmachining.com/cnc-milling" }, { "@type": "OfferCatalog", "name": "CNC Turning Services", "url": "https://www.olympusmachining.com/cnc-turning" }, { "@type": "OfferCatalog", "name": "Precision CNC Machining", "url": "https://www.olympusmachining.com/precision-cnc-machining" }, { "@type": "OfferCatalog", "name": "Prototype to Production", "url": "https://www.olympusmachining.com/prototype-to-production" }, { "@type": "OfferCatalog", "name": "Robotics & Automation Machining", "url": "https://www.olympusmachining.com/robotics-automation-machining" } ] } }, { "@type": "WebSite", "@id": "https://www.olympusmachining.com/#website", "name": "Olympus Machining", "url": "https://www.olympusmachining.com", "publisher": { "@id": "https://www.olympusmachining.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": "https://www.olympusmachining.com/?s={search_term_string}", "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://www.olympusmachining.com/compliance/cmmc-level-1#webpage", "name": "CMMC Level 1 Compliance for DoD CNC Machining Suppliers | Olympus Machining", "description": "How Olympus Machining meets CMMC Level 1 (Foundational) — 17 practices from FAR 52.204-21, annual self-assessment, SPRS posting. ITAR registered, CAGE 9V9P0.", "url": "https://www.olympusmachining.com/compliance/cmmc-level-1", "isPartOf": { "@id": "https://www.olympusmachining.com/#website" }, "about": { "@id": "https://www.olympusmachining.com/#organization" }, "inLanguage": "en-US" }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://www.olympusmachining.com" }, { "@type": "ListItem", "position": 2, "name": "Compliance", "item": "https://www.olympusmachining.com/compliance" }, { "@type": "ListItem", "position": 3, "name": "CMMC Level 1", "item": "https://www.olympusmachining.com/compliance/cmmc-level-1" } ] }, { "@type": "BlogPosting", "@id": "https://www.olympusmachining.com/compliance/cmmc-level-1#article", "headline": "CMMC Level 1 Compliance for DoD CNC Machining Suppliers", "description": "How Olympus Machining meets CMMC Level 1 — 17 practices from FAR 52.204-21, annual self-assessment, SPRS posting. ITAR registered, CAGE 9V9P0.", "url": "https://www.olympusmachining.com/compliance/cmmc-level-1", "datePublished": "2026-05-21", "dateModified": "2026-05-21", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://www.olympusmachining.com/compliance/cmmc-level-1" }, "author": { "@type": "Organization", "@id": "https://www.olympusmachining.com/#organization", "name": "Olympus Machining", "url": "https://www.olympusmachining.com" }, "publisher": { "@type": "Organization", "@id": "https://www.olympusmachining.com/#organization", "name": "Olympus Machining", "url": "https://www.olympusmachining.com", "logo": { "@type": "ImageObject", "url": "https://www.olympusmachining.com/images/olympus-logo.png", "width": 300, "height": 100 } }, "isPartOf": { "@id": "https://www.olympusmachining.com/#website" }, "inLanguage": "en-US" }, { "@type": "FAQPage", "@id": "https://www.olympusmachining.com/compliance/cmmc-level-1#faq", "mainEntity": [ { "@type": "Question", "name": "What is CMMC Level 1?", "acceptedAnswer": { "@type": "Answer", "text": "CMMC Level 1 (Foundational) is the entry tier of the Cybersecurity Maturity Model Certification program. It applies to Department of Defense contractors and subcontractors that handle Federal Contract Information (FCI) — non-public information provided by, or generated for, the government under contract — but do not handle Controlled Unclassified Information (CUI). Level 1 requires implementation of the 17 basic safeguarding practices defined in FAR 52.204-21 and an annual self-assessment posted to the Supplier Performance Risk System (SPRS)." } }, { "@type": "Question", "name": "How is CMMC Level 1 different from NIST SP 800-171?", "acceptedAnswer": { "@type": "Answer", "text": "CMMC Level 1 maps to the 17 basic safeguarding practices in FAR 52.204-21. NIST SP 800-171 is the full 110-control framework for protecting CUI, and aligns with CMMC Level 2. Level 1 is a subset focused on baseline cyber hygiene; Level 2 adds substantial controls around audit logging, incident response, configuration management, and assessment rigor. A supplier sized for Level 1 may not be appropriate for a contract that flows down CUI and requires Level 2." } }, { "@type": "Question", "name": "Does my subcontractor need CMMC?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, if the subcontractor will process, store, or transmit FCI or CUI on your behalf. DFARS 252.204-7012 and the CMMC program both flow down: a prime cannot pass FCI to a non-compliant sub. Awarding FCI-handling work to a sub that has not self-attested to CMMC Level 1 (or higher when CUI is involved) creates contractual risk for the prime. Olympus Machining is sized and scoped for Level 1 subcontract work for prime contractors handling FCI." } }, { "@type": "Question", "name": "Is CMMC Level 1 self-assessed or third-party certified?", "acceptedAnswer": { "@type": "Answer", "text": "Level 1 is self-assessed. Contractors perform the assessment annually against the 17 practices, score themselves, and submit the result to SPRS. Level 2 contracts can be either self-assessed (for non-prioritized acquisitions) or require a Certified Third-Party Assessor Organization (C3PAO) assessment. Level 3 is government-led. Olympus performs the Level 1 self-assessment annually and maintains the SPRS submission as a supplier-qualification artifact." } }, { "@type": "Question", "name": "What is Federal Contract Information (FCI)?", "acceptedAnswer": { "@type": "Answer", "text": "FCI is information not intended for public release, provided by or generated for the federal government under a contract to develop or deliver a product or service. It includes contract performance data, purchase orders, drawings marked as FCI, schedules, and technical correspondence. FCI does not include information provided by the government to the public (such as on a public website) or simple transactional information (like payment processing data)." } }, { "@type": "Question", "name": "How does Olympus handle FCI in a CNC machining context?", "acceptedAnswer": { "@type": "Answer", "text": "Drawings and program-related correspondence flowed down by primes are treated as FCI by default. They are stored on access-controlled file shares, transmitted via encrypted email or secure file-transfer when leaving Olympus, and access is restricted to named employees with a documented need-to-know. Removable-media writes from FCI-handling endpoints are prohibited. On program completion, FCI is retained per contract requirements and disposed of per the media-disposal practice." } }, { "@type": "Question", "name": "What does Olympus need to provide to add us to a prime's approved supplier list?", "acceptedAnswer": { "@type": "Answer", "text": "For Level 1 work, the standard package is: SPRS confirmation of current self-assessment, ITAR registration letter from DDTC, CAGE Code (9V9P0), W-9, and signed acceptance of the prime's quality flow-down clauses. AS9102 sample FAI report available on request. Most prime supplier-qualification packages can be completed within 5 business days of the request." } }, { "@type": "Question", "name": "When will Olympus pursue CMMC Level 2?", "acceptedAnswer": { "@type": "Answer", "text": "Olympus Machining is positioned to evaluate CMMC Level 2 once our AS9100 quality system rollout is complete and the cybersecurity controls required by NIST SP 800-171 are fully integrated. Customers with active CUI-handling programs should contact us to discuss interim arrangements and joint roadmap planning; we will identify scope mismatch at quote review rather than at award." } } ] } ] } ] --- [Home](/) [CNC Milling](/cnc-milling) [CNC Turning](/cnc-turning) [Quality Assurance](/quality-assurance) [CNC Machining Capabilities](/capabilities) [CNC Machining Services](/cnc-machining) [Quality Program](/quality) [Contact Olympus Machining](/contact) [Prototype to Production](/prototype-to-production) [Industries Served](/industries-served) [Materials Machined](/materials-machined) [Robotics & Automation Machining](/robotics-automation-machining) [Precision CNC Machining](/precision-cnc-machining) [Compliance & Cybersecurity](/compliance) [Privacy Policy](/privacy-policy) [Blog](/blog) [Sitemap](/sitemap) [Pennsylvania CNC Machining](/areas-served/pennsylvania-cnc-machining) [Maryland CNC Machining](/areas-served/maryland-cnc-machining) [Virginia CNC Machining](/areas-served/virginia-cnc-machining) [Delaware CNC Machining](/areas-served/delaware-cnc-machining) [New Jersey CNC Machining](/areas-served/new-jersey-cnc-machining) [New York CNC Machining](/areas-served/new-york-cnc-machining) [Ohio CNC Machining](/areas-served/ohio-cnc-machining) [West Virginia CNC Machining](/areas-served/west-virginia-cnc-machining) [Washington DC CNC Machining](/areas-served/washington-dc-cnc-machining) [North Carolina CNC Machining](/areas-served/north-carolina-cnc-machining) [Aerospace Machining Tolerances Explained](/blog/aerospace-machining-tolerances-explained) [Titanium CNC Machining for Aerospace](/blog/titanium-cnc-machining-aerospace) [Aerospace CNC Machine Shop Near DC/MD](/blog/aerospace-cnc-machine-shop-near-washington-dc-maryland) [Cutting-Edge CNC Shop for Aerospace](/blog/cutting-edge-cnc-machine-shop-aerospace-industry) [Best CNC Machine Shop in Hanover, PA](/blog/best-cnc-machine-shop-hanover-pa) [QMS: Precision, Traceability, Process Control](/blog/quality-management-system-qms-precision-traceability-process-control) [Vet a CNC Shop in Pennsylvania](/blog/vet-cnc-machine-shop-pennsylvania-aerospace-defense-robotics) [CNC Shops in Rural America: Hanover, PA](/blog/cnc-machine-shop-rural-america-hanover-pa) [Aerospace CNC Machining in Pennsylvania](/blog/aerospace-cnc-machining-pennsylvania) [CNC Prototyping in PA](/blog/cnc-prototyping-pa) [CNC Machining in Pennsylvania](/blog/cnc-machining-pennsylvania) [Choosing CNC Machining Vendors](/blog/choosing-machining-vendors-cnc-machining-shop) [CNC Machining for Robotics — Guide](/blog/cnc-machining-for-robotics-automation-guide) [CNC Machining Parts for Robotics](/blog/cnc-machining-for-robotics-automation) [Prototype-to-Production CNC Machining](/blog/prototype-to-production-cnc-machining) [How OEMs Evaluate CNC Machine Shops](/blog/how-oems-evaluate-cnc-machine-shops) [CMM Inspection at Olympus Machining](/blog/cmm-inspection-enhances-quality-and-repeatability-at-olympus-machining) [ITAR & CMMC Level 1 in Precision CNC Machining](/blog/itar-cmmc-level-1-precision-cnc-machining) [Precision CNC Machining in Hanover, PA](/blog/precision-cnc-machining-hanover-pa) [AS9102 First Article Inspection Checklist](/blog/as9102-first-article-inspection-checklist) [AS9102 First Article Inspection](/as9102-first-article-inspection) [AS9102 FAI vs PFAI](/as9102-fai-vs-pfai) [AS9102 Balloon Drawings](/as9102-balloon-drawings) [CMM Inspection Services](/cmm-inspection-services) [Medical-Grade Alloys](/materials/medical-grade-alloys) [CMMC Level 1 Compliance](/compliance/cmmc-level-1) [Olympus vs Xometry](/comparison/olympus-vs-xometry) [Olympus vs Protolabs](/comparison/olympus-vs-protolabs) [Direct Shop vs Marketplace](/comparison/direct-shop-vs-marketplace) [Aerospace & Defense Machining](/industries/aerospace-defense) [Medical Device Machining](/industries/medical-devices) [Firearms & Suppressor Machining](/industries/firearms-suppressors) [Energy & Oil/Gas Machining](/industries/energy-oil-gas) [Philadelphia CNC Machining](/areas-served/philadelphia-cnc-machining) [Pittsburgh CNC Machining](/areas-served/pittsburgh-cnc-machining) [Baltimore CNC Machining](/areas-served/baltimore-cnc-machining) [Titanium CNC Machining](/materials/titanium-cnc-machining) [PEEK CNC Machining](/materials/peek-cnc-machining) [Inconel CNC Machining Guide](/materials/inconel-cnc-machining-guide) ![Olympus Machining LLC logo — precision CNC machining shop in Hanover, Pennsylvania](/assets/olympus-logo-DbWcTX06.webp) HomeAboutServices[Blog](/blog)Contact[Careers](/careers)[(717) 634-5094 ](tel:+17176345094)[Login](/auth)Get Quote [Back to Compliance](/compliance) # CMMC Level 1 Compliance for DoD CNC Machining Suppliers The Cybersecurity Maturity Model Certification (CMMC) is the U.S. Department of Defense's framework for safeguarding sensitive information in the defense industrial base. CMMC Level 1 — the Foundational tier — applies to contractors and subcontractors that handle Federal Contract Information (FCI) but not Controlled Unclassified Information (CUI). Olympus Machining LLC, an ITAR-registered precision CNC machine shop in Hanover, Pennsylvania (CAGE code 9V9P0, York County), maintains practices aligned with CMMC Level 1 and FAR 52.204-21. ## What CMMC Level 1 Means for a DoD Subcontractor CMMC Level 1 is built on the 17 basic safeguarding practices defined in FAR 52.204-21. Any contractor or subcontractor processing, storing, or transmitting FCI on behalf of the federal government is contractually required to meet these practices. For a precision CNC machine shop, FCI typically includes program-related information shared by a prime contractor — purchase orders, drawings marked as FCI, schedules, and technical correspondence. Level 1 does not address CUI. Programs that flow down CUI require Level 2 (which adds the NIST SP 800-171 control set). Olympus Machining is sized and scoped for Level 1 work and does not currently bid programs that require Level 2 / SP 800-171 certification. ## Implementation Table: 17 Practices, FAR Clause, Olympus Implementation, Evidence Practice-by-practice mapping of FAR 52.204-21 controls to Olympus implementation and the evidence artifact available to prime supplier-quality teams. No FCI-specific or environment-specific details are disclosed publicly; this is the supplier-qualification-level summary. Control ID FAR Clause Olympus Implementation Evidence Artifact AC.L1-3.1.1 Authorized Access Control FAR 52.204-21(b)(1)(i) — Limit information system access to authorized users, processes acting on behalf of authorized users, or devices. Active Directory / Microsoft 365 account provisioning per named employee. Workstation login requires individual credentials. Shared accounts prohibited on any system that touches FCI. Account-provisioning record, joiner/mover/leaver log, workstation policy. AC.L1-3.1.2 Transaction & Function Control FAR 52.204-21(b)(1)(ii) — Limit information system access to the types of transactions and functions that authorized users are permitted to execute. Role-based access groups on file shares and ERP. Admin rights restricted to a named subset; standard users cannot install software or alter system configuration. Role-permission matrix, file-share ACL export. AC.L1-3.1.20 External Connections FAR 52.204-21(b)(1)(iii) — Verify and control/limit connections to and use of external information systems. Outbound business-service connections (banking, ERP, email) are vetted and documented. No personal cloud-storage or removable-media writes from FCI-handling endpoints. Approved-services list, USB-policy enforcement record. AC.L1-3.1.22 Public Information Posting FAR 52.204-21(b)(1)(iv) — Control information posted or processed on publicly accessible information systems. Public website and social channels are reviewed before publication. Customer-controlled material, drawings, FCI, or any program-identifying information is never published. Marketing approval workflow, public-posting policy. IA.L1-3.5.1 Identification FAR 52.204-21(b)(1)(v) — Identify information system users, processes acting on behalf of users, or devices. Each employee assigned a unique user account. Service accounts named and inventoried. No shared logins on FCI-handling systems. User-account inventory, service-account register. IA.L1-3.5.2 Authentication FAR 52.204-21(b)(1)(vi) — Authenticate (or verify) the identities of those users, processes, or devices as a prerequisite to allowing access. Password complexity policy enforced via Group Policy. Multi-factor authentication (MFA) required on all remote access and on Microsoft 365. GPO export, MFA enrollment report. MP.L1-3.8.3 Media Disposal FAR 52.204-21(b)(1)(vii) — Sanitize or destroy information system media containing FCI before disposal or release for reuse. Retired hard drives are wiped to NIST SP 800-88 Clear/Purge level or physically destroyed. Removable media containing FCI is destroyed in-house. Media-destruction log with serial numbers and dates. PE.L1-3.10.1 Limit Physical Access FAR 52.204-21(b)(1)(viii) — Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals. Facility locked outside business hours. Production floor accessible only via badged or key entry. Server hardware in locked space. Facility access policy, key/badge issuance log. PE.L1-3.10.3 Escort Visitors FAR 52.204-21(b)(1)(ix) — Escort visitors and monitor visitor activity. Visitors sign in at reception, receive a badge, and are escorted at all times in production, inspection, and office areas. Visitor log, escort policy. PE.L1-3.10.4 Physical Access Logs FAR 52.204-21(b)(1)(x) — Maintain audit logs of physical access. Visitor sign-in records retained per the document-control procedure. Reviewed periodically as part of internal audit. Retained visitor log, document-control retention record. PE.L1-3.10.5 Manage Physical Access FAR 52.204-21(b)(1)(xi) — Control and manage physical access devices. Keys and access badges are issued, tracked, and recovered on employee separation. Lost badges deactivated immediately. Badge issuance/recovery log, separation checklist. SC.L1-3.13.1 Boundary Protection FAR 52.204-21(b)(1)(xii) — Monitor, control, and protect organizational communications at the external boundaries and key internal boundaries of the information systems. Business-grade firewall at network perimeter with default-deny inbound. Outbound filtering on known-malicious categories. Firewall rule-set export, perimeter diagram. SC.L1-3.13.5 Public-Access System Separation FAR 52.204-21(b)(1)(xiii) — Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. Public-facing services (website, guest Wi-Fi) are logically separated from the internal shop network. Guest Wi-Fi cannot reach internal subnets. Network segmentation diagram, VLAN configuration. SI.L1-3.14.1 Flaw Remediation FAR 52.204-21(b)(1)(xiv) — Identify, report, and correct information and information system flaws in a timely manner. OS and application updates applied on a managed schedule. Critical security patches prioritized. Patch-management report, monthly status summary. SI.L1-3.14.2 Malicious Code Protection FAR 52.204-21(b)(1)(xv) — Provide protection from malicious code at appropriate locations within organizational information systems. Endpoint protection deployed on every workstation and server. Email gateway scans attachments and URLs. Endpoint deployment report, EDR console export. SI.L1-3.14.4 Update Malicious Code Protection FAR 52.204-21(b)(1)(xvi) — Update malicious code protection mechanisms when new releases are available. Automatic signature/definition updates configured. Engine updates applied per vendor cadence. EDR update-status report. SI.L1-3.14.5 System & File Scanning FAR 52.204-21(b)(1)(xvii) — Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed. Real-time scanning enabled. Scheduled full-system scans run weekly. Removable-media scans on insertion. Scheduled-scan log, scan-result summaries. ## SPRS Scoring Explained The Supplier Performance Risk System (SPRS) is the DoD database that hosts contractor cybersecurity self-assessment scores. For Level 1, the assessment is a binary check: each of the 17 practices is either fully implemented (MET) or not (NOT MET). A contractor that achieves MET on all 17 practices is considered Level 1 compliant. Unlike Level 2 (NIST SP 800-171), there is no negative-point scoring at Level 1 — partial implementation does not yield partial credit. Prime supplier-quality teams reviewing a sub in SPRS see four fields per assessment: the date of the most recent self-assessment, the scope of the assessment (enterprise, enclave, or specific contract), the result, and the date by which any Plan of Action & Milestones (POA&M) items will be closed. Olympus Machining performs the self-assessment on an enterprise scope and re-assesses annually or whenever a material change to the IT environment occurs. Material changes that trigger a between-cycle review include: new vendor system connections (ERP, accounting), endpoint refresh that changes the firewall or EDR posture, organizational changes that affect role-based access, and any reported security event. The annual self-assessment is approved by management before submission to SPRS. ## Flow-Down Clause Language for Primes Prime contractors purchasing CNC-machined components from Olympus Machining can incorporate the following clause (or equivalent) into the purchase order to flow down FAR 52.204-21 / CMMC Level 1 requirements: **Cybersecurity Flow-Down (FAR 52.204-21 / CMMC Level 1).** Seller shall implement and maintain the basic safeguarding requirements of FAR 52.204-21 with respect to all Federal Contract Information (FCI) processed, stored, or transmitted under this Purchase Order. Seller represents that it has performed and submitted a current CMMC Level 1 self-assessment to the Supplier Performance Risk System (SPRS), and shall provide written confirmation of its current SPRS posting upon request. Seller shall promptly notify Buyer of any cyber incident affecting FCI handled under this Purchase Order, and shall preserve relevant records for not less than ninety (90) days following discovery. Seller shall flow down equivalent requirements to any lower-tier supplier that will process, store, or transmit FCI on Seller's behalf. This clause does not impose Controlled Unclassified Information (CUI) handling, NIST SP 800-171 / CMMC Level 2, or DFARS 252.204-7012 obligations unless separately invoked in writing by Buyer. Olympus Machining will execute this language as-written for Level 1 subcontract work. Programs that require CUI handling, NIST SP 800-171, or DFARS 252.204-7012 should be routed to suppliers sized for that scope; we will identify scope mismatch at quote review rather than at award. ## Annual Self-Assessment and SPRS Posting Olympus Machining performs the self-assessment annually and maintains the SPRS submission as part of our supplier qualification record. A copy of our current SPRS confirmation is available to prime contractors on request. Self-assessment is not a one-time exercise. Practice implementation is reviewed and any deficiencies are corrected before the score is submitted. ## Roadmap to CMMC Level 2 CMMC Level 2 (Advanced) applies to contractors handling Controlled Unclassified Information (CUI) and requires implementation of the 110 controls defined in NIST SP 800-171. For prioritized acquisitions, Level 2 also requires a third-party assessment by a Certified Third-Party Assessor Organization (C3PAO) rather than a self-assessment. Olympus Machining is positioned to evaluate Level 2 once our AS9100 quality system rollout is complete and the additional cybersecurity controls — audit logging, incident response, configuration management, and assessment rigor — are fully integrated. Customers with active CUI-handling programs should contact us to discuss interim arrangements and joint roadmap planning. ## ITAR Registration and CAGE 9V9P0 Olympus Machining is registered with the U.S. Department of State Directorate of Defense Trade Controls (DDTC) under the International Traffic in Arms Regulations (ITAR). Our Commercial and Government Entity (CAGE) code is 9V9P0, registered to our Hanover, Pennsylvania facility. ITAR registration and CMMC Level 1 alignment together cover the baseline supplier-qualification requirements for the majority of Level-1 defense subcontracting work. ## CMMC Level 1 FAQ ### What is CMMC Level 1? ### How is CMMC Level 1 different from NIST SP 800-171? ### Does my subcontractor need CMMC? ### Is CMMC Level 1 self-assessed or third-party certified? ### What is Federal Contract Information (FCI)? ### How does Olympus handle FCI in a CNC machining context? ### What does Olympus need to provide to add us to a prime's approved supplier list? ### When will Olympus pursue CMMC Level 2? **Related:** [Compliance overview](/compliance) · [AS9102 FAI](/as9102-first-article-inspection) · [Quality assurance](/quality-assurance) · [Precision CNC machining](/precision-cnc-machining) · [CNC milling](/cnc-milling) · [CNC turning](/cnc-turning) [CNC Milling](/cnc-milling) [CNC Turning](/cnc-turning) [Quality Assurance](/quality-assurance) [Prototype to Production](/prototype-to-production) [Industries Served](/industries-served) [Materials Machined](/materials-machined) [Robotics & Automation Machining](/robotics-automation-machining) [Precision CNC Machining](/precision-cnc-machining) [Careers](/careers) [ITAR CNC Machining for Mid-Atlantic Aerospace OEMs](/itar-cnc-machining-mid-atlantic-aerospace) [CNC Tolerances & GD&T Guide](/resources/cnc-machining-tolerances-gdt-guide) [Reducing CNC Machining Costs](/resources/reducing-cnc-machining-costs) [6061 vs 7075 Aluminum](/materials/6061-vs-7075-aluminum) [Brass vs Bronze Machining](/materials/brass-vs-bronze-machining) [![Olympus Machining LLC logo — CNC machining shop Hanover, PA](/assets/olympus-logo-DbWcTX06.webp)](/) Olympus Machining LLC is a precision CNC machining shop in Hanover, Pennsylvania, providing CNC milling and turning services for OEMs and manufacturers nationwide. Olympus Machining LLC · 639 Frederick St, Suite 1 · Hanover, PA 17331 · (717) 634-5094 Explore all [areas served, industries, and capabilities →](/sitemap) © 2026 All rights reserved.[Admin](/auth) [Compliance & Cybersecurity](/compliance)[Privacy Policy](/privacy-policy)[Sitemap](/sitemap) ITAR-aligned internal controls. Cybersecurity practices aligned with CMMC Level 1 (FAR 52.204-21).