If you're a small manufacturer or machine shop in the defense supply chain, 2026 has been a confusing year for CMMC. The rollout timeline changed, third-party certification was paused, and the news cycle moved quickly. Through all of it, one thing hasn't changed: defense customers still expect suppliers to protect controlled unclassified information.

That's why many small suppliers are looking for a CMMC readiness partner. This guide explains where things stand and which questions to ask before choosing help.

Where CMMC Stands Today

The CMMC program rule took effect in December 2024, and the DFARS acquisition rule followed on November 10, 2025. That date started Phase 1, in which contracts could require CMMC Level 1 or Level 2 self-assessments.

Phase 2, which would have made third-party Level 2 certification standard for many contracts beginning November 10, 2026, was suspended by the Department on July 13, 2026, pending a program review. On September 3, 2026, a revised DFARS class deviation made that suspension binding on contracting officers. As of this writing, the results of the review have not been made public.

What still applies:

• DFARS 252.204-7012, which requires contractors handling CUI to implement the security requirements in NIST SP 800-171.
• Self-assessment scores submitted to the Supplier Performance Risk System (SPRS).
• CMMC Level 1 and Level 2 self-assessment requirements where contracts include them.
• Your prime contractors' own flow-down expectations.

Because policy is still evolving, confirm current requirements with your contracting officer, your prime customers, and qualified advisors. The safest assumption is that the underlying security work still matters, regardless of when third-party assessments return.

What a Readiness Partner Does

A CMMC readiness partner helps you prepare. That usually includes:

• Identifying where CUI lives in your business and defining your assessment scope.
• Comparing your current practices against NIST SP 800-171.
• Building a prioritized plan to close gaps.
• Helping implement technical controls.
• Writing your System Security Plan (SSP) and Plan of Action and Milestones (POA&M).
• Preparing for self-assessments and, eventually, third-party assessments.

A readiness partner is different from a C3PAO, the authorized third-party organization that performs certification assessments. Organizations generally shouldn't rely on the same firm to both prepare them and certify them.

Questions to Ask a Potential Partner

"How will you help us limit our scope?"

Scope drives cost. A good partner looks for ways to isolate CUI to a smaller part of your environment, such as specific systems, users, or an enclave, rather than treating your entire company as in scope.

"How do you stay current on CMMC policy changes?"

Given how much changed in 2026, your partner should be able to explain the current status clearly and tell you how they track updates.

"Will you help implement, or only advise?"

Some firms only produce assessments and documents. Others also configure systems, deploy tools, and manage ongoing security. Know which you're getting.

"What do your SSP and POA&M deliverables look like?"

Ask to see redacted examples. Documentation should describe your actual environment, not a generic template.

"How do you handle our shop floor?"

Manufacturers have CNC machines, CAD/CAM workstations, and engineering files that may contain CUI. Your partner should understand production environments, not just offices.

"What's your experience with Microsoft 365 GCC or GCC High?"

Many defense suppliers need cloud environments suited to CUI. Your partner should be able to explain when these are needed and what migration involves.

"What will this cost, and what drives the cost?"

Expect an honest explanation based on your size, scope, current maturity, and whether you need implementation help. Be cautious of anyone guaranteeing certification.

Red Flags

• Guaranteeing you will pass an assessment.
• Offering to both prepare and certify you.
• Selling a single product as "CMMC compliance in a box."
• Using fear about deadlines that may no longer apply.
• Producing documentation that doesn't match how you actually work.

Use the Pause Wisely

The suspension of Phase 2 gives many small suppliers more time. The suppliers in the strongest position will be the ones who use that time to improve their actual security, keep their SPRS scores accurate, and build documentation that reflects reality. If third-party assessments return, they'll be ready. If requirements change, the security improvements still protect the business. We discuss similar hidden risks in the compliance blind spot.

A Local Readiness Partner

Maise Technology provides CMMC readiness support for small manufacturers and defense suppliers through our compliance services, backed by hands-on IT and security implementation. Learn more about our manufacturing work on our IT services for manufacturing companies page.

Want an honest look at your CMMC readiness? Schedule A 15 Minute Discovery Call.

This article reflects publicly reported information as of its date and is not legal or contracting advice. CMMC requirements are subject to change.

Manufacturers are used to evaluating suppliers. You track on-time delivery, quality rates, and responsiveness. When a supplier keeps missing the mark, you start looking for alternatives.

Your IT provider deserves the same scrutiny. Unlike a materials supplier, though, IT problems often build slowly. A slow response here, an unexplained outage there, and before long the plant has learned to work around technology instead of with it.

Here are the signs that your manufacturing company may need a new IT provider.

1. They Don't Understand the Plant Floor

Many IT providers are comfortable with office computers and email but uneasy around production. If your provider treats machine workstations like office laptops, pushes updates in the middle of a shift, or can't explain how your production network connects to the office, that's a problem.

A good manufacturing IT partner asks about shift schedules, maintenance windows, and which systems can never go down unexpectedly.

2. Downtime Keeps Surprising You

Every plant experiences occasional problems. The warning sign is when outages come without warning, repeat often, or take far too long to resolve. Proactive monitoring should catch failing drives, full storage, and network issues before they stop the line.

If you're constantly discovering problems before your provider does, they're not monitoring effectively.

3. Response Times Don't Match Production Reality

A two-day response may be acceptable for a broken printer in accounting. It's not acceptable when the shipping station can't print labels. Your provider's service commitments should reflect how your plant actually operates, including second and third shifts if you run them.

Our guide on what to look for in a managed IT support SLA explains which commitments matter most.

4. Security Questions Go Unanswered

Customers increasingly send security questionnaires. Insurance carriers ask about multifactor authentication and backups. Defense supply chain customers ask about NIST 800-171. If your IT provider can't help you answer these accurately, you're carrying risk you may not even see.

5. Nobody Can Tell You If Backups Work

Ask your provider a simple question: "When did we last test restoring our ERP and machine programs?" If the answer is vague, or if machine programs aren't backed up at all, it's time for a serious conversation.

6. Your ERP Partner and IT Provider Point Fingers

When something breaks, does your ERP vendor blame the network while your IT provider blames the software? A strong IT partner takes ownership of coordinating with vendors until the problem is solved.

7. There's No Plan, Only Reactions

Your provider should help you plan for equipment replacements, software upgrades, security improvements, and growth. If every conversation is about fixing today's problem and none are about next year, you're missing strategic value. Regular planning conversations, like those described in six questions smart companies ask their IT provider every quarter, should be routine.

8. Your Team Has Stopped Calling

This might be the most telling sign. When supervisors and operators stop reporting problems because "it won't get fixed anyway," productivity quietly drops. Workarounds become standard procedure, and small issues grow.

What to Look for in a Replacement

If several of these signs sound familiar, look for a provider who offers:

• Experience with manufacturing environments and production networks.
• Proactive monitoring and maintenance scheduled around production.
• Clear service commitments that fit your shifts.
• Cybersecurity expertise, including support for customer and compliance requirements.
• Tested backup and disaster recovery for both office and production systems.
• Regular planning meetings with leadership.
• Willingness to coordinate with your equipment and software vendors.

Switching providers can feel disruptive, but a well-planned transition protects production. For broader warning signs that apply to any business, see five signs you need to switch your managed IT support provider.

Making the Switch Without Stopping Production

A good transition plan includes documenting your current systems, collecting passwords and vendor contacts from the outgoing provider, scheduling changes during planned downtime, and running both providers in parallel briefly if needed.

A Partner That Understands Manufacturing

Maise Technology supports manufacturers throughout Utah with IT services built around production schedules and real plant-floor needs. Learn more on our IT services for manufacturing companies page.

If you recognized your plant in this list, Schedule A 15 Minute Discovery Call. We'll listen to what's happening and give you an honest view of your options.

Northern Utah has a manufacturing story worth telling. From Brigham City through Ogden, Layton, Clearfield, and into Cache Valley, the region supports aerospace suppliers, composites and advanced materials, food processing, outdoor products, and precision machining. Many of these companies are small and family-owned. Many also sit inside supply chains for much larger customers.

That combination brings real opportunity. It also brings cybersecurity challenges that look a little different here than they do in other parts of the country.

Challenge 1: Supply Chain Expectations Are Rising

Northern Utah's proximity to Hill Air Force Base and its long aerospace and defense history means many local shops supply parts or services to defense contractors. Those customers increasingly expect suppliers to protect sensitive technical information.

Defense contracts that involve controlled unclassified information (CUI) carry requirements under DFARS 252.204-7012, which points to the security controls in NIST SP 800-171. The CMMC program added a certification framework on top of that. In July 2026, the Department suspended the planned shift to mandatory third-party CMMC assessments, but self-assessment and NIST 800-171 obligations remain in place.

Even manufacturers outside defense see similar pressure. Large customers in medical devices, automotive, and consumer products now send security questionnaires and expect clear answers.

Challenge 2: A Tight Labor Market for IT Talent

Northern Utah manufacturers compete with the Wasatch Front's growing tech sector for skilled IT people. A 50-person plant often can't justify a full-time security specialist, and the one IT person on staff is usually busy keeping printers, ERP, and the network running.

The result is a common pattern: security work gets pushed aside by daily support needs until a customer audit or an incident forces the issue.

Challenge 3: Older Equipment on Modern Networks

Many local plants have grown over decades. They run a mix of brand-new equipment and reliable older machines tied to aging computers. As plants connect equipment to ERP and cloud monitoring, those older systems become potential entry points.

Separating office and production networks and controlling remote vendor access are two of the most important steps a plant can take. Our plain-English guide to OT security explains why.

Challenge 4: Multi-Site Operations Across a Wide Region

Some Northern Utah manufacturers operate a main plant in one city and warehouses or satellite shops in another. Each site needs secure connections, consistent security settings, and backups. Without central management, sites drift apart and gaps appear.

Challenge 5: Seasonal and Weather Disruptions

Winter storms, canyon wind events, and power interruptions are part of life in Northern Utah. These aren't cybersecurity events, but they test the same recovery capabilities: backups, alternate connectivity, and clear procedures for restarting systems.

What Local Manufacturers Can Do

Know what you have to protect

Identify sensitive customer drawings, specifications, and contract data, and where they're stored. This is the starting point for any customer questionnaire or compliance effort.

Close the most common doors

Multifactor authentication on email and remote access, protected backups, and a separated production network address many of the incidents we see.

Prepare for customer questions

Keep a current, honest description of your security practices. Customers respond better to "here's what we do and what we're improving" than to vague promises.

Get help where it makes sense

Many plants pair their internal IT person with an outside provider for security monitoring, compliance preparation, and after-hours support.

A Regional Perspective

Northern Utah manufacturers succeed by being reliable partners: on-time, high quality, and easy to work with. Cybersecurity is becoming part of that reputation. Plants that can confidently answer a customer's security questions have an advantage over those that can't.

Maise Technology is based in Brigham City and supports manufacturers throughout the region. Learn about our local support through our Brigham City managed IT services and Ogden managed IT services pages, or see our full approach on our IT services for manufacturing companies page.

Have questions about where your plant stands? Get In Touch.

Most disaster recovery plans are written from the office out. They start with email, file servers, and accounting software, then add production systems at the end as an afterthought.

For a manufacturer, that order is backwards. The production line is what generates revenue. A disaster recovery plan should start there and work outward.

This guide walks through how to build a disaster recovery plan around production, including two terms every plant leader should understand: recovery time objective and recovery point objective.

Two Numbers That Shape Your Plan

Recovery time objective (RTO)

RTO is how long a system can be down before the impact becomes unacceptable. If your scheduling system can be offline for four hours before shipments start slipping, its RTO is four hours.

Recovery point objective (RPO)

RPO is how much data you can afford to lose, measured in time. If you back up your quality records nightly and a failure happens at 4 p.m., you could lose almost a full day of entries. If that's unacceptable, you need a shorter RPO and more frequent backups.

Put simply: RTO is how fast you need it back. RPO is how much you can afford to redo.

Step 1: Map Your Production-Critical Systems

Walk the floor with operations, maintenance, and quality leaders. List every system production depends on. Most plants find more than they expect:

• ERP and MRP systems for orders, materials, and scheduling.
• Machine programs stored on CNC controls or engineering workstations.
• PLC programs and HMI configurations.
• Quality management and inspection data.
• Label printing and shipping systems.
• Barcode scanners and inventory tracking.
• Network equipment that ties it all together.

Step 2: Set RTO and RPO for Each System

Not every system needs the same recovery speed. A simple worksheet helps:

These numbers are examples. Your targets should come from real conversations about customer commitments and production costs. Downtime has costs beyond the obvious; we break them down in the real cost of IT downtime.

Step 3: Match Backups to Your Targets

Once you know your RTO and RPO, check whether your backups can actually meet them. Questions to ask:

• How often is each system backed up?
• Where are backups stored, and is at least one copy protected from ransomware?
• Are machine programs and PLC files included, or only office data?
• How long does a full restore actually take?

A common surprise: backups exist, but restoring a large ERP database takes 12 hours, far longer than the 4-hour target. That gap is what the plan needs to close.

Step 4: Plan for Manual Operations

Some disruptions will outlast your best recovery targets. Decide in advance how the floor can keep working without systems:

• Print the next shift's schedule each day.
• Keep paper travelers and inspection forms on hand.
• Store copies of critical machine programs where they can be loaded locally.
• Know who can authorize running without the ERP.

Step 5: Assign Roles and Communication

During a disaster, confusion wastes more time than technology. Your plan should name:

• Who declares a disaster and starts the plan.
• Who contacts customers about delays.
• Who works with IT and vendors on recovery.
• How employees get updates if email is down.

Step 6: Test, Then Test Again

An untested plan is a guess. Start small. Restore one machine program from backup. Time a database restore on a test system. Run a tabletop exercise where leaders walk through a ransomware scenario. Each test reveals gaps you can fix while the stakes are low.

Common Mistakes to Avoid

• Backing up office data but not machine programs.
• Storing every backup on the same network as production.
• Setting RTOs without checking how long restores actually take.
• Writing the plan once and never updating it after equipment changes.

Build the Plan Around What Matters

A production-first disaster recovery plan protects revenue, customer relationships, and your team's ability to keep working when things go wrong. Maise Technology helps manufacturers build and test plans through our disaster recovery services. Learn more about how we support plants on our IT services for manufacturing companies page.

Want help setting realistic RTO and RPO targets? Schedule A 15 Minute Discovery Call.

OT security, short for operational technology security, is the practice of protecting the systems that control physical equipment and processes. In a manufacturing plant, that means the controllers, sensors, operator screens, and networks that run machines, conveyors, ovens, presses, and packaging lines.

Regular IT security protects data. OT security protects operations. When OT is compromised, the result isn't just a stolen file. It can be a stopped line, damaged equipment, or a safety hazard.

OT in Plain Terms

If information technology (IT) is everything in the front office, operational technology is everything on the plant floor that makes things move. Common examples include:

• PLCs (programmable logic controllers): small industrial computers that control machines.
• HMIs (human-machine interfaces): the touch screens operators use to run equipment.
• SCADA systems: software that monitors and controls processes across a facility.
• Sensors and drives that measure temperature, pressure, speed, or position.
• Engineering workstations used to program and update equipment.

Together, these are often called industrial control systems, or ICS.

IT vs. OT: The Key Differences

These differences explain why you can't simply apply office security rules to the plant floor. Installing an update on a PLC in the middle of a shift could do more harm than the threat it was meant to stop.

Why OT Security Matters More Now

For years, many OT systems were "air-gapped," meaning they weren't connected to other networks. That's rarely true today. Plants now connect equipment to ERP systems for scheduling, to the cloud for monitoring, and to vendors for remote support.

Those connections bring real benefits. They also open paths that attackers can use to move from an office email account to production equipment.

Core Principles of OT Security

Know what you have

You can't protect devices you don't know about. An asset inventory lists every controller, screen, workstation, and network connection on the floor, along with software versions and who supports them.

Segment the network

Separate the plant network from the office network, and control what passes between them. This approach is a cornerstone of industrial security guidance and limits how far an attacker can travel.

Control remote access

Vendor and employee remote connections should be secured with strong authentication, logged, and turned off when not in use.

Limit who can change equipment

Only authorized people should be able to modify PLC programs or HMI settings. This reduces the risk of both attacks and honest mistakes.

Plan updates around production

OT patching should be tested and scheduled during maintenance windows. When an update isn't possible, use other protections, like isolation, to reduce risk.

Prepare for recovery

Keep current backups of PLC programs, HMI configurations, and engineering files. If a controller fails or is altered, you'll need a known-good version to restore.

These ideas connect closely with zero trust security, which assumes no device or user should be trusted automatically.

Where to Find Trusted Guidance

The National Institute of Standards and Technology publishes NIST SP 800-82, its Guide to Operational Technology Security. It's detailed and technical, but it's the leading U.S. reference for organizations that want to build an OT security program.

Frequently Asked Questions

Is OT security only for large factories?

No. A small machine shop with a few CNC machines and a networked quality station has OT. The scale is smaller, but the principles are the same.

Who should own OT security, IT or operations?

Both. Operations understands the equipment and production impact. IT understands networks and threats. The best results come when they plan together.

Does antivirus work on OT systems?

Sometimes, but not always. Some industrial software doesn't work well with standard antivirus. Always check with the equipment vendor before installing security tools on OT devices.

Getting Started

If you're new to OT security, start with an inventory and a simple network diagram. Those two documents reveal most of the big risks quickly.

Maise Technology supports plants with cybersecurity services that respect production schedules. Learn more about our IT services for manufacturing companies, or Get In Touch with your questions.

At most offices, ransomware means locked files and a stressful week. At a manufacturing plant, it can mean idle machines, missed shipments, and a phone full of customers asking where their orders are.

That difference matters. Attackers know a stopped production line costs money every hour. That pressure is exactly what they count on when they demand payment. The good news is that manufacturers can take practical steps to make an attack less likely and a lot less damaging if one gets through.

Why Manufacturers Are Attractive Targets

Manufacturers often run a mix of new and old technology. A modern ERP system might sit on the same network as a shop-floor computer running software that hasn't been updated in years because the machine it controls still works fine.

That mix creates openings. Common weak spots include:

• Shared logins on floor workstations so any operator can use them.
• Flat networks where office computers and production equipment can all talk to each other.
• Vendor remote access that was set up for a single repair and never turned off.
• Older Windows systems tied to equipment that can't easily be upgraded.

None of these mean a plant is careless. They usually exist because keeping production running came first. But each one gives ransomware an easier path from a single infected email to the whole operation.

How an Attack Usually Spreads

Most ransomware doesn't start on the shop floor. It starts in the office. Someone opens a convincing invoice email or enters their password on a fake login page. The attacker then quietly explores the network, looking for backups to destroy and systems to lock.

If the office network and production network are connected without any barriers, the attacker can reach the computers that run scheduling, quality tracking, and machine controls. By the time the ransom note appears, the damage is already widespread.

For a deeper look at the general warning signs every business should know, see our guide on what every small business must do now to prevent ransomware.

Five Protections That Matter Most on the Plant Floor

1. Separate the office from production

Network segmentation means dividing your network into zones with controlled connections between them. Office email and web browsing stay in one zone. Production systems stay in another. Traffic between them is limited to what is actually needed. If ransomware lands in the office, segmentation can keep it from reaching your machines.

2. Give every person their own login

Shared accounts make it impossible to know who did what. They also mean one stolen password unlocks many systems. Individual accounts, combined with multifactor authentication (a second check like a phone prompt) for remote and administrator access, close a major door.

3. Control vendor access

Equipment vendors often need remote access for support. That's reasonable. But the access should be turned on when needed, monitored while in use, and turned off afterward. A permanent, always-on connection is one of the easiest ways in for an attacker.

4. Protect older systems you can't replace yet

Some machines depend on software that only runs on older operating systems. When replacement isn't practical, isolate those computers, remove internet access, and limit what can connect to them. This is called a compensating control. It reduces risk while you plan an upgrade.

5. Keep backups the attacker can't reach

Attackers look for backups first. If your backups sit on the same network with the same passwords, they can be encrypted or deleted along with everything else. At least one copy should be offline or protected so it can't be changed or erased. Just as important: test restoring from it.

Planning for the Day Something Gets Through

Strong defenses lower risk, but no plant can promise zero incidents. That's why recovery planning matters as much as prevention.

Ask your team these questions now, not during an emergency:

• Which systems must come back first to restart production?
• How long can each line be down before it affects customer commitments?
• Who decides whether to shut down network connections during an attack?
• How will you communicate with employees and customers if email is offline?
• Do you have paper work orders or manual procedures for critical steps?

Answering these ahead of time can turn days of confusion into hours of organized recovery. Federal guidance from the Cybersecurity and Infrastructure Security Agency, available through its StopRansomware resource hub, offers additional checklists worth reviewing.

A Quick Example

Picture a 60-person parts manufacturer. An office employee clicks a malicious link on a Friday afternoon. Because the plant had already separated its office and production networks, the infection stays on the office side. Email and accounting are disrupted, but the CNC machines keep running from local programs. The team restores office systems from protected backups over the weekend. Monday's shipments go out on time.

Now picture the same attack without segmentation or protected backups. The scheduling system, quality records, and machine programs are all encrypted. Production stops, and the company faces a hard choice between paying criminals or rebuilding from scratch.

The difference between those two outcomes wasn't luck. It was preparation.

Where to Start

You don't have to fix everything at once. Most manufacturers get the biggest improvement by starting with three things: separating networks, securing remote access, and verifying backups. From there, you can work through older systems and recovery planning in priority order.

Maise Technology works with manufacturers to strengthen cybersecurity services around real production needs, not office-only checklists. You can learn more about how we support plants and shops on our IT services for manufacturing companies page.

If you'd like to talk through where your plant stands today, Schedule A 15 Minute Discovery Call. We'll focus on your equipment, your schedule, and the risks that matter most to your production floor.