Metalphoto of Cincinnati Achieves CMMC Level 2 Certification: What It Means for Defense and Government Customers
Metalphoto of Cincinnati (MPC) has achieved Cybersecurity Maturity Model Certification (CMMC) Level 2 validation from an independent, accredited CMMC Third-Party Assessment Organization (C3PAO). This certification confirms that MPC meets all 110 security requirements outlined in NIST SP 800-171 for safeguarding the controlled unclassified information (CUI) our defense and aerospace customers entrust to us.
MPC has been providing defense, military and government organizations with Metalphoto photosensitive anodized aluminum nameplates, UID labels, front panels and data plates for more than 50 years. Today, ensuring the drawings, specifications and part data that go into these products are protected is just as important as ensuring the products themselves can withstand the harshest environments. This certification validates that MPC takes that protection seriously.
The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense’s (DoD) program to ensure that contractors throughout the defense supply chain adequately secure the government information they handle or store. This includes not just prime contractors but all suppliers down the chain, even manufacturers such as MPC that produce parts to customer drawings.
There are three levels of CMMC, corresponding to the sensitivity of the information:
| Level | Protects | Requirements |
| Level 1 (Foundational) | Federal Contract Information (FCI) | 15 basic safeguards |
| Level 2 (Advanced) | Controlled Unclassified Information (CUI) | 110 requirements of NIST SP 800-171 |
| Level 3 (Expert) | CUI on the most critical programs | Level 2 plus selected NIST SP 800-172 requirements |
Level 2 covers what most defense contractors will need to comply with, as most technical information shared on defense contracts is considered CUI.
Controlled Unclassified Information (CUI) refers to government information that has not been classified but still requires protection. For the nameplate and label manufacturer handling CUI, this can include engineering drawings, part specifications, UID/serialization information or technical specifications for military equipment. If that data fell into the wrong hands, an adversary could use it to replicate or better understand our nation’s defense systems.
Protecting that CUI on your systems is where NIST SP 800-171 comes into play. Published by the National Institute of Standards and Technology, NIST SP 800-171 outlines 110 security requirements across 14 categories. These include access control, multi-factor authentication, encryption, audit logging, incident response, physical security, and security awareness and training.
DFARS 252.204-7012 is a contract clause, “Safeguarding Covered Defense Information and Cyber Incident Reporting,” that imposed a mandatory requirement for defense contractors to comply with NIST SP 800-171 beginning in 2017. As part of that clause, companies also need to report cyber incidents to the government within 72 hours of detection. CMMC expands upon that clause with verification. Previously, companies only had to claim that they were in compliance. CMMC requires companies to prove they follow security best practices.
Defense contractors submit their NIST SP 800-171 scores to the Supplier Performance Risk System (SPRS), the database that government contracting officers and prime contractors review prior to awarding work. Scores range from 110 down to -203. Firms lose points for any requirement that they don’t fully meet.
MPC holds a score of 110, the highest possible score. It means that all 110 requirements are fully implemented and no plans of action are pending. MPC affirms that compliance in SPRS annually.
MPC’s certification is backed by an independent assessment, not just our own word. Not every CMMC Level 2 supplier can say that today.
Level 2 compliance can be achieved in one of two ways. A company can perform its own assessment and publish its score through SPRS. That grants the supplier Level 2 (Self) status. Alternatively, a company can undergo an assessment from a third-party authorized C3PAO. These are independent organizations accredited to evaluate systems, documentation and practices against each requirement. Companies that successfully pass the audit earn Level 2 (C3PAO) certification.
Originally, the program would require contractors to obtain a C3PAO assessment for contracts requiring CUI on November 10, 2026. That date was suspended by the DoD pending further review of costs and burden on suppliers by a reform task force. Until further notice, companies will only be required to conduct self-assessments for new contracts.
MPC opted to complete the C3PAO assessment anyway. We had our systems independently reviewed by Sera Brynn, an authorized C3PAO. That means MPC is now in the minority of suppliers who can claim their Level 2 status has been independently verified. For your organization, that means:
When you send a drawing to MPC for manufacturing a military nameplate, UID label, data plate or control panel faceplate, that file is secured from the moment it enters our network until the finished product ships. Only authorized personnel can access it, our systems are monitored, and the data is encrypted and managed with procedures that have been reviewed by an independent auditor.
Our CMMC Level 2 certification adds to the promises MPC customers already rely on:
Together, these commitments ensure our defense and aerospace customers can trust MPC for both long-lasting identification products and safe handling of the data that supports them.
If your program requires a supplier that can securely handle CUI, MPC is ready. Request a copy of our CMMC certification, confirm our SPRS status or discuss your next identification or asset tracking project by contacting our team or calling 800-528-4058.
Yes, if your drawings/specifications or UID/serialization data are marked or otherwise designated as CUI. MPC processes CUI from receipt through shipment of the completed product in a secure, certified environment.
Level 2 (Self) means a company assessed itself and posted its score to SPRS. Level 2 (C3PAO) means an accredited, independent organization audited the company against all 110 NIST SP 800-171 requirements. MPC holds the C3PAO certification, assessed by Sera Brynn.
No, for most new contracts. Requirement for November 10, 2026 C3PAO certification was suspended by DoD pending review. Self assessments will be accepted for the time being. Some prime contractors set their own stricter requirements, though, and MPC already meets them.
CMMC Level 2 (C3PAO) certifications will be valid for three years, if annual affirmations are made that the organization is in compliance. Level 2 self-assessments will go through a three-year assessment cycle with annual affirmations.
Contact MPC to request a copy of the certificate. Prime contractors and contracting officers can also confirm status through SPRS.
An SPRS score of 110 is the highest score achievable on the NIST SP 800-171 DoD Assessment Methodology. This means that all 110 requirements received full scoring on the assessment. Although a perfect score of 110 is favorable, it alone does not prove third-party CMMC certification.
No. CMMC certification relates to cybersecurity controls for protecting sensitive defense information, while International Traffic in Arms Regulations (ITAR) controls pertain to the export and transfer of defense articles, technical data, and defense services. Suppliers must remain in compliance with ITAR requirements if they work with ITAR-controlled material, regardless of their level of CMMC certification.
Yes. Partnering with a CMMC-certified subcontractor may help you meet applicable subcontractor cybersecurity requirements and mitigate supply chain risk when the subcontractor is certified to the level that addresses the work being performed. However, you are still responsible for your own CMMC requirements, such as safeguarding CUI in your systems and validating that subcontractors comply with applicable contractual requirements.
Our sales engineers are experts in automatic asset tracking, tagging and identification,a nd can answer all your questions. Get in touch now.
Lets Talk ›
