What is a CMMC Level 2 Certified Machine Shop and What Does it Mean?

What Is CMMC Level 2?

The Cybersecurity Maturity Model Certification (CMMC) is a U.S. Department of Defense framework requiring all defense contractors and their suppliers to demonstrate compliance with cybersecurity and controlled unclassified information (CUI) standards. As of 2025–2026, DoD is actively enforcing CMMC requirements on all solicitations — meaning suppliers without verified compliance are being removed from bid consideration.

CMMC Level 2 is the benchmark required for most defense manufacturing contracts involving CUI. It aligns with the 110 security practices of NIST SP 800-171 and requires third-party assessment by a Certified Third-Party Assessor Organization (C3PAO).

Borg Design, a US small business, has achieved C3PAO-verified CMMC Level 2 certification — one of a small number of precision machine shops in New England to hold this designation. When you work with Borg Design, your supply chain meets DoD compliance requirements from day one.

What This Means for Prime Contractors

DoD is enforcing CMMC compliance on all contracts involving Controlled Unclassified Information (CUI). If your Tier 2 or Tier 3 suppliers are not CMMC Level 2 verified, you are at risk of losing program eligibility. Borg Design’s C3PAO-verified compliance protects your supply chain — and your bid status.

Borg Design’s Full Defense Compliance Stack
We don’t just meet minimum requirements. Borg Design holds a comprehensive certification and registration profile built for the most demanding defense and aerospace programs.

Certification / Registration What It Covers Status

• CMMC Level 2 (C3PAO) 110 NIST SP 800-171 cybersecurity practices. Required for all DoD contracts involving CUI. Third-party verified. Download certificate (.pdf)
• AS9100D Aerospace Quality Management System. The gold standard for aerospace, defense, and aviation manufacturing suppliers. Certified Download certificate (.pdf)
• ISO 9001:2015 International Quality Management System standard. Foundation for all quality-critical manufacturing programs. Certified Download certificate (.pdf)
• DDTC / ITAR Registered U.S. State Department registration for the manufacture, export, and handling of defense articles and services under ITAR. Registered DDTC/ITAR code: M32272
• JCP/DD2345 Certified

Precision Machining Capabilities for Defense Programs
From prototype to full production, Borg Design’s 58,000 sq. ft. facility and 50+ precision CNC machining centers are built for the complexity and traceability demands of defense and aerospace programs.

• CNC Milling & Turning 3-, 4-, and multi-axis CNC milling. CNC turning with live tooling. Parts up to 120″ x 40″ travel. 12,000 RPM high-speed machining. Complex geometries, tight tolerances, exotic alloys.
• Defense-Grade Quality Control In-house CMM inspection. First Article Inspection (FAI / AS9100 FAIR). Full dimensional reporting. Material certifications and traceability documentation for all programs.
• Prototype to Production Rapid prototype machining for development programs. Seamless transition to low- or high-volume production. Kanban and blanket order management. Short lead times.
• Design & Engineering Support Registered Mechanical Engineers on staff. SolidWorks 3D CAD/CAM. Design for Manufacturability (DFM) consulting. Reverse engineering. Fixture and tooling design.
• Collaborative Robotics Collaborative robotic systems integrated on the production floor for enhanced throughput, consistency, and capacity on high-volume defense programs.
• Fabrication Services Welding and sheet metal fabrication. Bending, stamping, waterjet, laser cutting. Single-source machining + fabrication for complex defense assemblies.

Defense and Aerospace Programs We Support
Borg Design has 80 years of experience machining mission-critical components for the programs and industries where quality failure is not an option.

• U.S. Army / DoD Ground Systems
• Missile Defense Systems
• Radar & Electronic Warfare
• Aerospace Structures & Components
• Unmanned Systems
• Naval Systems & Subsystems
• Medical Device & Surgical Instruments
• Transportation & Ground Vehicle Systems

Why Defense Prime Contractors Choose Borg Design

• C3PAO-Verified CMMC Level 2 — Not Self-Attested. Many shops claim cybersecurity compliance. Borg Design’s CMMC Level 2 certification was assessed and verified by an accredited C3PAO — the highest level of third-party validation available. Your program office and prime contractor auditors will have nothing to question.
• 80 Years of Manufacturing Continuity. Founded in 1945, Borg Design has operated through every defense cycle, technology shift, and supply chain disruption for eight decades. The operational stability and institutional knowledge that comes with that history is rare — and valuable on long-program-lifecycle defense contracts.
• Scale for Critical Programs. 58,000 sq. ft. of production floor space. 50+ precision CNC machining centers. Collaborative robotics. In-house inspection. The capacity to handle surge production demands without compromising quality or lead time.
• Full CUI Data Security Posture. As a CMMC Level 2 compliant facility, Borg Design has implemented the complete 110-practice NIST SP 800-171 security framework across all systems handling Controlled Unclassified Information. Having completed the CMMC audit, and understanding how to handle sensitive information and data, Borg Design understands how to handle controlled documents in manufacturing environments, including CNC machine shops. Your technical data packages, drawings, and program information are handled with DoD-required security protocols.

Our strategic location is located near prime contractor facilities throughout Greater Boston and Southern New England, however we service the entire USA.

Frequently Asked Questions

What is CMMC Level 2 certification and why does my supply chain need it?

• CMMC Level 2 is the U.S. Department of Defense’s cybersecurity certification standard for suppliers handling Controlled Unclassified Information (CUI). Having the certification means your organization is fully capable of managing CUI handling requirements. It aloes means you understand and implement modern security standards, understand advanced persistent threats, and cyber threats. Starting in 2025–2026, DoD is enforcing CMMC compliance on all solicitations — meaning any supplier in your chain that is not verified will disqualify your bid. Borg Design’s C3PAO-verified CMMC Level 2 certification means your supply chain is DoD-compliant from the moment you engage us. Our company culture, employee training, quality managers, and service provider ecosystem is built around advanced machining, and support for critical market needs.

What is the difference between CMMC self-attestation and C3PAO verification?

• CMMC Level 1 allows self-attestation. CMMC Level 2 requires third-party assessment by a Certified Third-Party Assessor Organization (C3PAO) — an accredited body that independently verifies all 110 NIST SP 800-171 security practices are implemented and operational. Borg Design has completed the full C3PAO assessment process. Self-attested Level 2 claims are not equivalent and will not satisfy DoD contract requirements as enforcement ramps up. Our security includes advanced access controls, physical access restrictions, multi-factor authentication and continuous security monitoring.

Is Borg Design ITAR registered for defense machining work?

• Yes. Borg Design is registered with the U.S. State Department’s Directorate of Defense Trade Controls (DDTC) under the International Traffic in Arms Regulations (ITAR). We are authorized to manufacture, handle, and support defense articles and services as defined under the ITAR. All controlled technical data and program information is handled in accordance with ITAR requirements.

Can Borg Design handle First Article Inspection (FAI) for AS9100D programs?

• Yes. As an AS9100D certified manufacturer, Borg Design performs First Article Inspection (FAI) in accordance with AS9102 requirements, including full dimensional reporting, material certifications, and functional test documentation. Our in-house CMM inspection capability supports complete FAI packages for aerospace and defense programs.

Where is Borg Design located and what programs are near your facility?

• Borg Design is located in Hudson, Massachusetts — approximately 35 miles west of Boston in the heart of New England’s defense and aerospace industrial corridor. We are within close proximity to numerous defense prime contractors and Tier 1 suppliers throughout Greater Boston and Southern New England.

Ready to Qualify Borg Design for Your Defense Program?
Contact us to discuss your projects, or even better, send a technical data package or RFQ. Our team will review your requirements, confirm compliance alignment, and provide a detailed quote — typically within 48 hours.