Services
CMMC and NIST 800-171 Readiness for Defense Suppliers Near Vandenberg
Most defense suppliers between Santa Maria and Goleta are small firms several tiers below a prime contractor. This page covers what your contracts likely require, where CMMC stands in October 2026, and what to do first.
Who is in the local defense supply chain
Lompoc sits next to Vandenberg Space Force Base, and businesses from Santa Maria to Goleta sell into defense programs. Very few of them are aerospace manufacturers. Census County Business Patterns (2023) counts only about 4 aerospace product and parts manufacturing establishments in Santa Barbara County, and about 4 in San Luis Obispo County. The local supplier pool is mostly small engineering, electronics, machining and services firms that sell to primes, often a tier or two down.
In practice, that might be any of these:
- A Santa Maria machine shop quoting from a prime's drawings
- A Goleta electronics or engineering firm near UCSB doing design work
- A Lompoc services company handling schedules and reports
These are examples of business types, not specific firms.
The rules scale by the information you handle, not by company size. A five-person shop that receives controlled technical drawings carries the same NIST SP 800-171 obligations for that information as a much larger company.
Keith Systems is not affiliated with or endorsed by Vandenberg Space Force Base or any government agency. It does not represent any prime contractor.
What flows down from your prime contract
Primes pass cybersecurity clauses down to subcontractors. These matter most:
- FAR 52.204-21: 15 basic safeguarding requirements for systems that process Federal Contract Information (FCI).
- DFARS 252.204-7012: protect covered defense information using NIST SP 800-171 Rev. 2 (110 requirements), report cyber incidents to DoD within 72 hours, and flow the clause down. Reporting requires a DoD-approved medium assurance certificate.
- DFARS 252.204-7019 and 252.204-7020: a NIST SP 800-171 self-assessment with a score posted in the Supplier Performance Risk System (SPRS).
- DFARS 252.204-7021: the CMMC clause, which states the level a contract requires.
Read your purchase orders and subcontract terms. If they are unclear, ask your prime's contracts contact which clauses apply. DFARS text is published through acq.osd.mil.
FCI or CUI: the question that sets your scope
FCI is information not intended for public release that is provided by or generated for the government under a contract, such as order details and delivery schedules. It maps to CMMC Level 1.
CUI is a narrower category that law, regulation or policy requires to be safeguarded. Here it is often technical data, drawings or specifications. It is sometimes export controlled and usually marked. It maps to CMMC Level 2 and the full 110 requirements.
If CUI never touches your systems, your scope is much smaller. If it does, keeping it inside a defined enclave can shrink the work considerably. The alternative is letting it spread across every laptop and inbox.
The smart stuff matters here too. Printers, cameras, door controllers, thermostats and other connected devices often share a flat network with the computers that hold drawings. Separating them on the network side keeps scoping cleaner. The FCI and CUI guide has examples.
Where CMMC stands in October 2026
- Phase 1 began November 10, 2025: Level 1 and Level 2 self-assessments, with annual affirmations in SPRS.
- On July 13, 2026, DoD suspended Phase 2 pending a review. Phase 2 was planned for November 10, 2026 and would have made Level 2 third-party C3PAO assessments mandatory. No replacement date has been announced.
- Phase 1 remains. DFARS 252.204-7012 and NIST SP 800-171 Rev. 2 obligations remain in force.
The suspension delays one type of assessment. It does not remove the duty to protect the information. Because this is changing, check your contract and dodcio.defense.gov/cmmc.
What to do first
- List your clauses. Note which FAR and DFARS clauses appear in recent orders.
- Map the information. Track where drawings and contract files arrive, live and get shared: email, file shares, laptops, shop-floor computers.
- Set scope. Decide which people and systems handle FCI or CUI, and whether an enclave makes sense.
- Self-assess honestly against the 15 FCI requirements or the 110 NIST SP 800-171 requirements.
- Write it down. Prepare a system security plan (SSP) and a plan of action and milestones (POA&M).
- Post an accurate score in SPRS. Scores range from 110 down to -203. Inaccurate affirmations can create False Claims Act exposure, so involve your attorney if unsure.
- Fix high-risk gaps first, such as MFA, account control and tested backups.
Free help worth using first
The Golden State APEX Accelerator offers free government-contracting counseling to small businesses in Santa Barbara, San Luis Obispo, Ventura and Kern counties. It is a good place for questions about registrations, solicitations and contracting basics. Keith Systems has no relationship with it. It is simply useful. Keith Systems fits in once you need hands-on technical readiness work inside your own environment.
How Keith Systems helps
Readiness help covers:
- FCI and CUI scoping
- A gap assessment against the 110 requirements
- SSP and POA&M drafting support
- SPRS score preparation
- Policies and evidence collection
- Hardening your existing IT network and accounts
See the CMMC and NIST 800-171 readiness service and the Level 2 readiness guide.
To be clear, Keith Systems is not a C3PAO, CMMC assessor or authorizing official, doesn't issue certifications, and isn't a law firm.
Jacob Keith holds the CISSP, CompTIA CySA+ and CompTIA SecurityX and has about six years of security compliance work on government systems.
Working together locally
Keith Systems is based in Lompoc. On-site work covers Santa Barbara County and southern San Luis Obispo County, and remote work is available anywhere. See Lompoc, Santa Maria and Goleta. Every engagement starts with a free security consult, and the fee is stated in writing before work begins. Call (805) 800-8163.
Questions
Before you call.
Does the Phase 2 suspension mean we can stop working on CMMC?
No. The July 2026 announcement suspended the planned mandatory Level 2 third-party assessments. Phase 1 self-assessments and annual affirmations remain. DFARS 252.204-7012 and NIST SP 800-171 obligations also stay in force wherever your contract includes them. Check your contract and dodcio.defense.gov/cmmc for updates.
We only receive drawings from our prime. Is that CUI?
It might be. Look for CUI markings, export control notices or distribution statements on the files. Also check whether DFARS 252.204-7012 is in your subcontract. If you cannot tell, ask your prime in writing how they classify what they send you. That answer largely determines your scope.
Can Keith Systems certify us or perform our CMMC assessment?
No. Keith Systems is not a C3PAO or a CMMC assessor and does not certify anyone. The work is readiness help: scoping, gap assessment, documentation support, SPRS score preparation and fixing gaps in your existing IT. The goal is to prepare you for a self-assessment or a future third-party assessment.
What is an SPRS score?
It is the result of your NIST SP 800-171 self-assessment under the DoD Assessment Methodology, posted in the Supplier Performance Risk System. A full score is 110. Points are subtracted for each unmet requirement, down to -203. Primes and contracting officers can view it, so it needs to be accurate and supported by your SSP.
Not sure if we're a fit? Call (805) 800-8163 or send a message anyway. If it's not something I do, I'll say so and help you figure out where to look.
Start with a free security consult.
A short call to understand your business, what you have to protect, and what to do first. No obligation.