CMMC Level 2 Compliance: Why Our RF Engineering Firm Didn't Wait for the Deadline

Some of us remember when starting the workday meant flipping on a CRT monitor and waiting for the picture to warm up while the coffee did the same. Those days are gone, and for good reason. The new routine is what it takes to protect defense information properly, and it's the result of a decision that surprised a few people this year: when the Department of Defense hit pause on Cybersecurity Maturity Model Certification (CMMC) audits, we kept going.

What Is the Cybersecurity Maturity Model Certification (CMMC)?

CMMC is the Department of Defense's framework for verifying that the companies in its supply chain protect Controlled Unclassified Information, or CUI. That's information that isn't classified but still needs safeguarding because it's tied to government work. CMMC Level 2 is the tier for companies that handle CUI, and it's built on the security requirements of NIST SP 800-171: encryption, access control, audit logging, incident response, and a documented policy for all of it.

CUI is everywhere. The schematics for a circuit, the mechanical drawings we send out for metal fabrication, and the PCB layouts we share with board houses for manufacturing and assembly can all qualify. 

The DoD Paused CMMC Level 2 Audits. Here's Why We Didn't.

On July 13, 2026, the Department of Defense suspended the planned November 2026 transition to CMMC Phase II, the point at which third-party Level 2 assessments would have become a condition of contract awards. The department cited the cost and administrative burden on small and mid-sized businesses and launched a review of the program. Baseline obligations didn't go away: contractors handling CUI still have to meet NIST SP 800-171 and the DFARS cybersecurity clause, and self-assessment requirements can still appear in solicitations.

By then, RDG was well down the road. We'd already decided to become compliant first and then go through a third-party audit for certification, and we saw no reason to stop.

It wasn't a small commitment. CMMC compliance represents a big investment in new hardware, new software, and consulting, and that's before counting the hours our team has put in. We value the compliance process. We value being able to say we've done this.

We’re currently taking the time to ensure documentation is airtight, so that when we do sit for the audit, we pass. We're targeting early 2027.

What CMMC Level 2 Compliance Looks Like Inside an RF Engineering Firm

Most of our existing processes could reasonably be called compliant. What we didn't have was the formal policies and procedures documenting it.

We started by building a complete inventory: every piece of hardware, every piece of software, every person with access. From there, we built a system of policies and procedures an auditor can read, trace, and verify against our records. 

On the technical side, that meant encrypting our servers end to end, so that even if someone gained access, the data would be useless to them. It meant upgrading to routers and firewalls that meet federal encryption standards, adding encrypted email for our exchanges with the DoD and contractors and with our metal and PCB suppliers, and committing to daily, weekly, and monthly reviews of the audit logs our systems generate.

We didn't do it alone. Farmhouse Networking, our local managed service provider, handles everything from desktop support to server upgrades, and they helped us find our compliance partner, Ancora Cyber. Ancora's team mapped out exactly what an auditor needs to see, and we worked backward from there.

Protecting Legacy RF Test Equipment in a CUI Enclave

One requirement hit us as an RF engineering firm especially hard: CMMC Level 2 restricts removable media. No USB drives, no CD drives, everything locked down.

The trouble is that some of our most specialized test equipment, including network analyzers and spectrum analyzers, runs on legacy OS. Those instruments can't be upgraded; they can only be replaced. Replacing the whole bench would run close to seven figures, easy, for instruments that still measure perfectly well.

So instead of scrapping good equipment, we segregated it. Those analyzers now live inside our CUI enclave with no network or internet connection at all. Test data comes off them on encrypted USB drives that meet government standards, checked out and checked back in by a responsible party, under procedures we wrote specifically for that purpose.

If that sounds familiar, it's because it's the same philosophy behind our obsolescence mitigation work: when a system still does its job, you don't throw it away. You find a way to keep it working, safely.

What CMMC Means for Clients of Our Custom Engineering Services

For our government and Navy contacts, our compliance work signals that we take the protection of their documentation as seriously as they do. When CMMC requirements flow down from a large defense contractor to its small-business partners, RDG can be the partner that's ready, rather than the one that gets passed over.

But the benefit doesn't stop at defense work. Every client of our custom engineering services, from an inventor with a patent-pending idea to a commercial company developing its next product, gets the same protection. Your schematics don't land on a server with holes everywhere. They go into the same locked-down environment we use for the Navy.

RDG values your intellectual property the same way we value controlled information for the government. No matter the industry, if protecting documentation matters to the client, then protecting documentation matters to us.

Future-Proofing RF Engineering Services for the Defense Industrial Base

CMMC third party audit requirements will return in some form; the question is when, not whether. We're taking it on the chin now to future-proof our offerings so our customers know their information is safe with us. We’re your valued partner pursuing government awards.

CMMC Level 2 FAQ

• Is CMMC Level 2 still required for defense contractors?

  As of July 13, 2026, the Department of Defense has suspended the requirement for third-party CMMC Level 2 assessments while it reviews the program. Contractors that handle CUI are still obligated to meet NIST SP 800-171 and DFARS 252.204-7012, and solicitations may still require CMMC Level 1 or Level 2 self-assessments.

• Is Radio Design Group CMMC Level 2 certified?

  Radio Design Group is completing CMMC Level 2 compliance and preparing for third-party assessment, which we expect to schedule in early 2027 once DoD's review settles. We'll share the news when certification is complete.

• Why would a small RF engineering firm pursue CMMC when it isn't required?

  Because the requirement is paused, not gone. Becoming compliant now means RDG is ready to support prime contractors whose CMMC obligations flow down to subcontractors, and it means every client's designs are protected to a federal standard today.

• Does CMMC matter if I'm a commercial client, not a defense contractor?

  Yes. The same encryption, access controls, and audit logging that protect government CUI at RDG protect your schematics, PCB layouts, and intellectual property too.

• How can a small business start preparing for CMMC Level 2?

  Start with a full inventory of your hardware, software, and personnel, then work with a managed service provider and a compliance consultant to map NIST SP 800-171 requirements against what you already do. Expect documentation to be the biggest part of the job.

---

Looking for RF engineering services from a partner who protects your designs like CUI? Schedule a call with our team to talk through your project.