# Defense Contractors Prepare for CMMC Level 2

CMMC Level 2 preparation is described as a substantial, information-heavy effort. Organizations report completing assessments, but also cite inconsistent reviews and interpretations of implementation. For manufacturers, whether CNC-related G-code is Controlled Unclassified Information (CUI) depends on whether it contains or reveals controlled defense technical information, including through its transfer or storage.

- Contractors can use the controls and assessment objectives to structure a readiness review, conduct a mock assessment, and seek qualified assessment support.
- Manufacturers should assess the content and handling of CNC G-code before determining whether it falls within CUI-related protections; the signal does not establish that all G-code is CUI.
- PreVeil and an associated managed service provider were cited as a resource for small organizations; contractors can evaluate whether that support fits their needs.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 08, 2026

### Vendors
- PreVeil ()

### Key Quotes
> G-code can be considered Controlled Unclassified Information (CUI) if it contains or reveals controlled technical information related to defense contracts.
> — Community commenter

### Sources
- [CMMC level 2](https://www.reddit.com/r/CMMC/comments/1x12z9s/cmmc_level_2) - reddit-cmmc