A 50-person Fort Worth aerospace supplier needs CMMC Level 2 when a prime contract sends it controlled unclassified information, and that means meeting all 110 NIST SP 800-171 requirements. Your contract sets the level. Your headcount doesn’t.
If you cut brackets, build harnesses, or machine parts for a prime in Tarrant County, somebody has probably described CMMC to you as a deadline. Right now it isn’t one. This guide sits under our work on manufacturing IT services in Fort Worth and takes the question a plant owner really asks, which is what Level 2 means once you’re a tier-2 or tier-3 shop with about 50 people and one IT person, or none.
I pulled a year of federal subaward records for Tarrant County to see who sits on the receiving end of these flow-downs. The pattern surprised me.
A Fort Worth shop with 50 employees needs Level 2 only when a prime flows CUI down to it, and DFARS 252.204-7012 has required NIST SP 800-171 since 2017. DoD’s own small-entity estimate is $34,277 for a first-year Level 2 self-assessment and $101,752 for a C3PAO certification, before any fixes. Phase 2 is suspended. Phase 1 self-assessments aren’t.
Does a 50-person Fort Worth shop need CMMC Level 2?
CMMC Level 2 is the Department of Defense certification level for companies that handle controlled unclassified information, or CUI, under a defense contract. It covers the 110 security requirements in NIST SP 800-171 Revision 2. Whether a shop needs it depends on what information the contract sends, not on headcount or revenue.
The rule that matters is 32 CFR 170.23, which makes primes require compliance from subcontractors at all tiers, matched to what each subcontract sends them.
| What the subcontract sends you | Status the rule requires | How you prove it |
|---|---|---|
| Federal contract information only | Level 1 (Self) | Annual self-assessment and affirmation in SPRS |
| CUI, and the prime contract asks for Level 2 (Self) | Level 2 (Self), as the minimum | Self-assessment every 3 years, affirmation every year |
| CUI, and the prime contract asks for Level 2 (C3PAO) | Level 2 (C3PAO) | Third-party assessment by an authorized assessor |
| CUI, and the prime contract asks for Level 3 | Level 2 (C3PAO), at least | Third-party assessment, plus whatever the prime adds |
Read the table again for what’s missing. Nothing in it asks how many people you employ. A 12-person machine shop holding CUI drawings owes the same 110 requirements as a 500-person plant.
Two wrinkles. The prime decides, solicitation by solicitation, whether the contract calls for a self-assessment or a C3PAO. You don’t pick. And a prime’s own certificate doesn’t cover you. Each tier needs its own status.
Where does a 50-person shop sit in Tarrant County’s defense supply chain?
Smaller than the headlines assume. Bigger than its neighbors. The BLS Quarterly Census of Employment and Wages counted 56 aircraft and parts establishments in Tarrant County in 2025, employing 22,742 people, which is about 406 per site. The same data shows 89 machine shops averaging 11.8 jobs and 336 fabricated metal shops averaging 30.3, which makes a 50-person shop roughly 4 times a typical machine shop and an eighth of a typical aircraft and parts site. That’s the tier-2 and tier-3 zone, where the primes buy parts and labor and then send you their paperwork.
To see what that paperwork looks like, I queried USAspending.gov for Department of Defense contract subawards dated October 1, 2024 through September 30, 2025, where the subcontractor sits in Tarrant County. It returned 1,510 subaward records going to 122 Tarrant firms, worth $999 million in total. Here’s who sent them.
| Prime contractor, spellings merged | Subaward records to Tarrant firms | Share of the 1,510 |
|---|---|---|
| Lockheed Martin | 435 | 28.8% |
| Sikorsky | 200 | 13.2% |
| Boeing | 150 | 9.9% |
| Raytheon | 145 | 9.6% |
| Bell Textron | 55 | 3.6% |
| Northrop Grumman | 50 | 3.3% |
| 95 other primes | 475 | 31.5% |
Lockheed leads by a mile. Three numbers jumped out. Of the 122 firms, 47 (39%) took subawards from 2 or more different primes, and 25 took them from 3 or more. The median subaward was $55,268, and 87% were under $250,000. And 82 of the 122 firms, 67%, had under $1 million in total reported subawards for the year, with a median of $341,571.
Put those together. A shop in this tier often answers to several primes at once, each with its own supplier security questionnaire and its own flow-down language, and the work behind each one is small. You’ll comply once. You’ll get asked many times.
One limit on all of this. Primes report subawards and the federal reporting threshold is $30,000, so smaller purchase orders never show up, which means the figures here describe only the slice of your neighbors’ defense work that’s big enough to be reported. Treat the medians as a floor, not a ceiling.
What has DFARS 252.204-7012 already required since 2017?
Most of Level 2. That’s the part nobody puts on the slide.
DFARS 252.204-7012 tells a contractor to protect covered defense information with NIST SP 800-171, report a cyber incident to DoD within 72 hours of discovery, and use a cloud provider that meets the FedRAMP Moderate baseline when covered data sits in the cloud. Paragraph (m) says the clause goes into subcontracts without alteration, and a subcontractor who reports an incident has to give the prime the DoD report number, so the duty runs down every tier.
The Federal Register notice that created the CMMC program makes the same point from the other direction. DoD left implementation out of its cost estimate because, in its words, implementation is already required by DFARS 252.204-7012, which set a December 31, 2017 date. The clock started years ago.
So here’s my honest take. CMMC didn’t add the 110 requirements. It added the audit. If a purchase order from a prime already carries 7012, you’re on the hook for the controls today, whatever the certification calendar says.
What does Level 2 cost a shop this size?
DoD published numbers. They’re the only defensible starting point. Here are its small-entity estimates, set against the median Tarrant subcontractor’s $341,571 from the data above.
| DoD small-entity estimate | Year 1 | 3 years | Year 1 as a share of $341,571 |
|---|---|---|---|
| Level 2 self-assessment with affirmation | $34,277 | $37,196 | 10.0% |
| Level 2 certification by a C3PAO with affirmation | $101,752 | $104,670 | 29.8% |
| Annual affirmation in later years | $1,459 | $1,459 each year | 0.4% |
Read that table with 2 cautions. First, those figures price the assessment and not the fixing, because DoD didn’t count the cost of putting controls in place, so your remediation bill comes on top and depends entirely on what’s broken. Second, $341,571 is what primes reported to the government. Revenue may be higher.
Even so, a 30% first-year bite from certification alone is hard to swallow. That’s real money. For a shop at the median, a self-assessment is a project and a C3PAO certification is a strategic decision. Don’t let anyone tell you which one you’re doing before they’ve read the contract.
I won’t print a Fort Worth price for the remediation work, because it would be invented. What I’ll do is scope it from your CUI map. Our CMMC compliance cost in DFW guide walks through the budget lines, and our aerospace IT support cost guide shows how the clause your prime flows down moves a per-user price.
How do you reach 88 of 110 without rebuilding the shop?
Start by shrinking the problem. The scoring rules let you finish with some gaps open, but they punish a messy environment.
Under 32 CFR 170.21, a conditional Level 2 status needs a score of at least 0.8, which is 88 of 110, and every open item has to sit on a plan of action and milestones where nothing is worth more than 1 point. Read that twice. The lone exception is encryption that isn’t FIPS-validated, which can carry 3. Six requirements can never go on that plan, among them the system security plan, visitor escorts, and physical access logs. Close the plan within 180 days or the status lapses.
- Find where CUI really lives, in email, on a shared drive, on an engineer’s laptop, or in the CAD vault.
- Pull it into one place. A small enclave, for example a Microsoft 365 GCC High tenant or a virtual desktop, keeps the other 40 laptops out of scope.
- Score yourself against all 110. Write down what you can prove, not what you intend.
- Sort the gaps by point value. The 5-point and 3-point items come first because they can’t hide on the plan.
- Write the system security plan. It can’t go on the plan of action, so it can’t wait.
- Ask your prime whether the contract calls for a self-assessment or a C3PAO. Get it in writing.
Step 2 does more than any other. A shop that lets CUI wander across 50 laptops has to prove 110 controls on 50 laptops, while a shop that confines it to 8 seats inside one enclave proves the same 110 controls on 8 machines and leaves the rest alone. The task force reviewing the program said much the same thing in October, recommending less CUI sent down the chain and virtual-desktop style limits on what reaches a subcontractor.
Where does the pause leave a Fort Worth supplier today?
In limbo. Not off the hook. DoD suspended CMMC Phase 2 on July 13, 2026, which pulled the 2026 start date for third-party assessments. The suspension doesn’t repeal anything. Phase 1 still runs. DFARS 7012 still binds.
The review task force handed its recommendations to the DoD CIO around September 11 and nothing was public as of mid-October, though on October 27 Federal News Network reported a summary of its findings. It said DoD could restart Phase 2 over 90 days for a narrower group of contractors, and that the POA&M window could stretch to 270 days, though only through rulemaking. The same story put the count of Level 2 certified companies above 2,300.
Nobody outside DoD can give you a restart date and I won’t pretend to, but I can tell you assessors are scarce, and that part you can plan around today. Secureframe’s March 2026 pull of the Cyber AB marketplace counted 103 authorized C3PAOs nationwide and 340 marketplace entries in Texas, so I’d expect a restart to clog the queue. Our CMMC timeline for Texas contractors tracks the dates as they change.
What does Uprite do on a CMMC project, and what doesn’t it do?
Uprite isn’t a C3PAO. We can’t assess you, certify you, or tell you that you passed. That’s the C3PAO’s job. We build and run the environment the assessor looks at, meaning the enclave, the logging, the patching, the access controls, and the evidence folder. We’re 42 people, our average response time is about 5 minutes, and we cover Fort Worth from our Dallas office. There’s no Fort Worth office, and a van only rolls when the fault is physical.
If you touch federal contract information and nothing more, you probably don’t need us for Level 2 at all. You need Level 1. Plus an afternoon of policy work. Where CUI is in play, read our pages on CMMC compliance in Dallas and CMMC compliance in Texas for how we scope, and our guide to IT compliance for DFW manufacturers for the ITAR side. If your shop also runs nights, what plant IT support costs in Fort Worth shows how shift coverage changes the bill.
Questions Fort Worth suppliers ask about Level 2
Does a 50-person Fort Worth shop need CMMC Level 2?
Only if a prime contract sends it CUI. Federal contract information alone calls for Level 1. Headcount and revenue don’t set the level, the information and the prime’s contract do.
Can I skip CMMC because my prime is already certified?
No. Under 32 CFR 170.23, each tier needs its own status for the information it handles, so a prime’s certificate never covers a subcontractor.
How much does CMMC Level 2 cost a small manufacturer?
DoD estimates $34,277 in year 1 for a small entity’s Level 2 self-assessment and $101,752 for a C3PAO certification. Those figures exclude fixing gaps, which depends on the shop and often costs more than the assessment.
Is CMMC Phase 2 still suspended?
Yes, as of this writing. DoD suspended it on July 13, 2026 and hasn’t published a restart date. Phase 1 self-assessments and DFARS 252.204-7012 still apply.
What’s the difference between a Level 2 self-assessment and a C3PAO certification?
Who scores you. A self-assessment is your own score, entered in SPRS and affirmed by a senior company official. A C3PAO certification is an authorized outside assessor’s score, valid for 3 years. Your prime’s contract decides which one you need, and that can change from one solicitation to the next.
Can a plan of action let me pass with gaps?
Partly. A conditional Level 2 status needs at least 88 of 110 points, only 1-point items can sit on the plan, and 6 requirements never can. You then have 180 days to close the plan or the status expires.
Is Uprite a C3PAO, and does it have a Fort Worth office?
No to both. Uprite builds and manages the IT environment an assessor reviews but can’t assess it, and it serves Fort Worth from its Dallas office, with remote fixes first and on-site dispatch when the problem is physical.
Send me the CUI marking from your last purchase order and the clause list from your prime’s terms. I’ll map which of the 110 requirements your shop owns and which ones a smaller environment would take off your plate.
Get a CMMC Scoping Review
