Common Cyber
CMMC for FAA Part 145 Repair Stations
Holding a Part 145 certificate does not put you in CMMC scope. What you are contracted to do, and what information the prime sends you, is what decides it.
Does a Part 145 repair station need CMMC?
It depends on the contracts you hold and the information you receive. A repair station performing work for a defense prime and receiving technical data may be in scope.
The determining factors are DFARS clauses or other flow-down requirements in the contract, whether FCI or CUI is received, and what the prime requires under the rules in force at the time of award.
What does CUI look like in a repair station?
Any of it can be CUI: technical data packages, engineering drawings, technical orders, maintenance procedures, repair instructions, performance data, specifications — anything that arrives from a prime or a government customer.
Why is a repair station harder than an office?
You cannot draw a network boundary around a shop floor the way you can around an office. The information moves through physical production, not just email and shared drives.
- Shared shop floors and workbenches
- Technicians, inspectors, and office staff on the same systems
- Contractor and vendor access to controlled areas
- Multiple facilities and field work
- The machines on the floor and the computers in the office, side by side
Can commercial and defense work share one facility?
Yes, but the boundary has to show exactly where defense information travels and who can see it.
When the same technicians and systems serve both lines of work, workflow changes or segmentation may reduce scope. Any recommendation is subject to discovery and validation.
Why does federal experience matter here?
Federal authorization experience changes how we treat boundaries, evidence, and control claims.
CMMC Level 2 assesses 110 controls drawn from NIST SP 800-171, which derives from NIST SP 800-53. Our founders worked under that framework in Special Access Program and Intelligence Community environments at prior employers, where the baseline is higher, the overlays are additional, and the tolerance for a control that cannot be evidenced is lower.
They have also worked through real authorization processes with government assessors. That is closer to the experience of a C3PAO assessment than most compliance consulting provides, and it shapes how we prepare an organization: define the boundary early, build the evidence as you implement, and never mark a control satisfied if it could not survive a question.
What does readiness cost and produce?
The CMMC Readiness and Scope Assessment is a fixed fee of $30,000.
Remediation is scoped separately after the assessment.
- Gap and risk register
- Scope analysis and boundary recommendations
- NIST SP 800-171 readiness baseline
- Prioritized statement of work
- Budgetary planning assumptions
- Executive findings briefing
A fixed-fee path to a clear boundary.
The assessment clarifies applicability, maps scope, establishes a readiness baseline, and builds a prioritized statement of work.
CMMC Readiness and Scope Assessment
A defined first step that establishes scope, readiness, and a practical remediation path.
Frequently asked questions
Does my repair station need CMMC certification?
The requirement depends on contract terms, whether the repair station handles FCI or CUI, what the prime requires, and the rules in force at the time of award. The FAA certificate type alone does not decide applicability.
Is technical data from a prime contractor considered CUI?
Technical data can be CUI when the government or an authorized holder designates it as controlled and the contract, markings, or information owner identifies the handling requirement. Not every file from a prime is automatically CUI.
Can we limit CMMC to part of our facility?
A limited boundary may be possible when CUI is restricted to defined people, systems, and workflows. The boundary must match actual information flow and remains subject to discovery and validation.
What happens if we do not pursue CMMC?
The business effect depends on the opportunities pursued and the requirements in the applicable contract. An organization may decide not to pursue work that requires a CMMC status, but Common Cyber does not guarantee eligibility or award outcomes.
How long does CMMC readiness take for a repair station?
The timeline depends on the validated boundary, current control implementation, evidence quality, and remediation dependencies. A reliable schedule can be built only after discovery.
Do we need CMMC if we only do commercial work?
Commercial aviation work without a relevant defense contract or flow-down generally does not create a CMMC requirement. Contract terms and information handled must still be reviewed before reaching a conclusion.
What does a CMMC readiness assessment cost?
The Common Cyber CMMC Readiness and Scope Assessment has a fixed fee of $30,000. Remediation and implementation are scoped separately.
Assess Your Defense Readiness
A clear next step
Define the boundary before you build.
The fixed-fee assessment clarifies what is in scope and turns the findings into a practical statement of work.
Start an Assessment