Cybersecurity in Aerospace Supply Chains: Contract Duties and CMMC

An aerospace component order brings together physical parts and the information needed to supply them. Drawings, specifications, and contract documents also move between buyers and suppliers. In defense work, the obligations attached to that information can shape how an order is discussed and performed. Cybersecurity therefore belongs alongside the technical and commercial details of the supply relationship.

The Information in the Supply Chain Matters

FCI and CUI Are Different Categories

Federal Contract Information (FCI) generally covers nonpublic information provided by or generated for the government under a contract. Controlled Unclassified Information (CUI) requires safeguarding or dissemination controls established by applicable law, regulation, or government policy. Public information is not automatically FCI, and an engineering document is not automatically CUI simply because it concerns an aircraft.

For a component supplier, the relevant question is what information the work actually requires it to receive, create, store, or transmit. DFARS 252.204-7021 defines the information categories and connects CMMC requirements to contractor systems handling them. Those obligations follow the information and the contract, rather than the industry label alone.

Contract Clauses Define the Safeguarding Duties

DFARS 252.204-7012 addresses covered defense information and cyber incident reporting. Where it applies, it requires adequate security for covered contractor information systems and specifies the relevant NIST SP 800-171 obligations.

The clause also requires reporting qualifying cyber incidents within 72 hours of discovery. Relevant system images and monitoring or packet-capture data must be preserved for at least 90 days from submission of the incident report. These are contractual information-security duties, separate from whether a component meets its physical specification.

A published standard and a contract's applicable standard are not necessarily the same revision. NIST published SP 800-171 Revision 3 in May 2024, while the CMMC Level 2 model in the cited regulation uses Revision 2. The solicitation, incorporated requirements, and authorized contractual direction determine the applicable obligations.

The CMMC Model and Its Current Implementation

Three Levels of Protection

The model in 32 CFR 170.14 has three levels. Level 1 draws on the 15 basic safeguarding requirements in FAR 52.204-21. Level 2 uses the 110 requirements in NIST SP 800-171 Revision 2. Level 3 adds 24 selected enhanced requirements from NIST SP 800-172 to the Level 2 foundation.

These levels describe protection and assessment requirements. They are different from the phases used to introduce requirements into contracting. A three-level framework does not mean every supplier needs Level 3, or that every assessment route is required across all procurements.

Rollout Status as of October 20, 2026

The official CMMC program update states that implementation of Phase II, originally planned for November 10, 2026, was suspended on July 13, 2026. Phase I self-assessment requirements remain in place. The accompanying program overview states that the pause does not remove the information-protection duties under DFARS 252.204-7012.

A rollout announcement should not be read as a blanket release from a requirement written into a particular solicitation or subcontract. Any uncertainty about an existing requirement needs to be resolved through the responsible contracting authority.

Assessments, SPRS, and Remediation

The Supplier Performance Risk System (SPRS) records assessment information used in defense procurement. Under DFARS 252.204-7019, an offeror subject to the relevant NIST obligations must have current assessment information for the covered systems relevant to its offer. The provision generally defines current as no more than three years old, unless the solicitation specifies a shorter period.

A self-assessment is not a third-party certification. DFARS 252.204-7020 distinguishes a contractor's Basic Assessment from government Medium and High Assessments. Accurate scope and supporting documentation matter when interpreting any reported result.

A Plan of Action and Milestones (POA&M) is also not an unrestricted substitute for implementation. 32 CFR 170.21 prohibits POA&Ms for Level 1 and permits them only under specified conditions at higher levels. Where a conditional CMMC status is permitted, the required closeout assessment must occur within 180 days of that status date.

Requirements Follow Information into Subcontracts

Suppliers need the requirements relevant to their portion of the work. DFARS 252.204-7012 provides for flowdown where subcontract performance involves covered defense information or designated operationally critical support. The CMMC clause has its own flowdown conditions for FCI and CUI and an exclusion for commercially available off-the-shelf items.

Suppliers do not necessarily have identical obligations. The information passed downstream and the applicable contract clauses matter. In a component procurement, controlling the accompanying data is part of defining the supply relationship, even when the physical item itself is familiar.

Compliance Costs Extend Beyond an Assessment

The assessment event is only one part of the effort. Documenting the system boundary, implementing required protections, maintaining evidence, and addressing permitted remediation can involve different amounts of work for different organizations. The Basic Assessment's reliance on a system security plan illustrates why preparation and documentation cannot be separated from the reported result.

A fixed price based only on a CMMC level would hide those differences. Budgeting should reflect the actual environment and assessment route rather than assume that a historical industry estimate is a current quote.

For general hydraulic fitting product information, explore HGW's public fitting resources.