CMMC · San Diego, California
CMMC Level 2 compliance for San Diego contractors
A maritime supplier base built on fabrication and repair, where the CMMC problem is rarely the office network and usually the shop floor.
What the San Diego supplier base looks like
Shipyards, fabricators, machine shops, marine electronics and repair contractors — businesses where a meaningful share of the value is produced by equipment rather than by people at desks.
The programmes and commands that shape it:
- One of the largest concentrations of US Navy fleet activity in the country
- Naval shipbuilding, ship repair and maintenance yards
- A substantial unmanned and maritime systems sector
We work with contractors in this region remotely, from South Florida. We do not have an office here, and we would rather say so on the page than have you find out on the call — almost all of this work is delivered remotely regardless of where the provider sits.
The shop floor is where this gets expensive
Maritime and fabrication contractors tend to have a manageable office environment and an unmanageable production one. A CNC machine, a CMM, an inspection rig or a test bench running an operating system that stopped receiving updates years ago is not an unusual finding — it is the normal one.
That equipment frequently cannot meet the requirements, and cannot be updated either, because the controller software is tied to the machine and the vendor stopped supporting it. The options are compensating controls, isolating it from anything in scope, or replacing capital equipment. Only one of those is cheap, and it is not the third.
This is why an honest scoping conversation matters more here than almost anywhere. Certifying an entire yard is a very different proposition from establishing a boundary that keeps controlled technical data away from equipment that will never be compliant. Getting that line right is usually the difference between a project that is affordable and one that is not.
What the engagement involves
The same work wherever you are, in the same order — what changes by region is which part turns out to be the hard one.
- Establishing scope first. How much of your business sits inside the boundary moves the cost more than everything else combined.
- Assessing against all 110 requirements of NIST SP 800-171, producing a System Security Plan and a POA&M.
- Closing the gaps, most of which are configuration rather than purchase.
- Getting the environment right — which for some contractors means Microsoft 365 GCC High and for others does not.
- Keeping it true. The affirmation is annual and the environment keeps changing, so this is operational rather than a project that ends.
Related: whether Level 1 is all you need, what this costs and why we scope before quoting, and which controls stay yours.
Questions from San Diego contractors
We have machinery running unsupported operating systems. Does that disqualify us?
No, and it is one of the most common situations in this region. Equipment that cannot be updated is dealt with through isolation and compensating controls rather than replacement in most cases — the requirement is not that every device is modern, it is that controlled information is protected. What matters is that the boundary is real in the configuration and not only on a diagram, and that the reasoning is documented well enough to show an assessor.
Does CMMC apply to a subcontractor doing repair work?
It depends on what reaches you, not on the type of work. If your contract or a prime's flowdown includes DFARS 252.204-7012 and you receive Controlled Unclassified Information — drawings, specifications, technical data — then it applies. If all you hold is Federal Contract Information, the obligation is the lighter one at CMMC Level 1, and a good number of contractors are quoted for more than their contracts require.
Other defense industrial base regions
-
Huntsville, Alabama
Missile, aviation and space programmes, and the densest concentration of export-controlled technical data in the country. The region where GCC High is most often genuinely required rather than defensively bought.
-
Northern Virginia
Services, IT and professional-services contractors clustered around the Pentagon. Usually already cloud-first, which makes scoping a question about people and documents rather than machinery.
-
Dayton, Ohio
Air Force research and sustainment, with a supplier base spanning aerospace engineering and university research — where the boundary question is complicated by collaboration.
-
Colorado Springs, Colorado
Space and missile-warning systems, with a supplier base skewing toward newer and smaller technology businesses meeting CMMC for the first time.
Start with a real assessment
We offer a free CMMC gap assessment for qualifying contractors — where you stand against all 110 requirements, and what your scope would actually be.
Schedule a call