CMMC-compliant ERP for machine shops that hold CUI
Published 2026-10-22
No ERP is CMMC compliant. Your shop is assessed, and the ERP is one of the systems inside the assessment. In a machine shop it is often the system that matters most, because that is where the customer's drawings, the travelers and the inspection reports end up. Once CUI is in it, the rule asks three things of it: a cloud edition that meets FedRAMP Moderate or its equivalent under DFARS 252.204-7012, logins behind multifactor authentication IA.L2-3.5.3, and logs that show who opened and changed what AU.L2-3.3.1. Paper it prints must carry the CUI marking MP.L2-3.8.4.
We read six vendors' own pages against those rows, and the FedRAMP Marketplace for each one. Quoting and scheduling, the features shops usually choose on, sit outside the boundary in our table: all six do them. If you do not yet know which of your records hold CUI, start with the CMMC scoping worksheet.
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
ProShop ERP
The only one of the six that states US-persons-only hosting in AWS GovCloud and a 3PAO assessment against the FedRAMP Moderate baseline, so the hosting question comes with paperwork.
Read the ProShop ERP notesEpicor Kinetic
On-premises and hybrid installs are still offered, and its own page states MFA and detailed audit logs: the two controls you would otherwise have to bolt on.
Read the Epicor Kinetic notesFulcrum
Built for CNC and sheet-metal work, hosted in Azure Government, MFA you can require for everyone, and its own FedRAMP listing to watch.
Read the Fulcrum notes
Where CUI sits in a job-shop ERP
An ERP does not create CUI. It collects it, one attachment at a time. The customer's marked drawing arrives with the RFQ, gets attached to the quote, copied to the job, printed on the traveler and measured on the inspection report. Each of those records now holds what the drawing holds. That is why the question is never "is this ERP compliant" but "which of its records carry the drawing, and where are they stored".
| Record | Where its content comes from | It carries CUI |
|---|---|---|
| Customer drawing or 3D model | The RFQ or the purchase order package | When the customer marked it CUI. A drawing of a defense article is also ITAR technical data. |
| Quote package | The drawing attached to the quote, or its notes copied in | When the marked drawing or its content travels with the quote. |
| Traveler or router | Printed for the floor with the drawing or its critical dimensions | When it carries the drawing or content copied from it. It is paper, so it needs the banner too. |
| CNC program and setup sheet | Written from the model | Ask your prime in writing. Many treat a program made from a controlled model as controlled. |
| Inspection report or first article | Every characteristic and dimension from the drawing | When it reproduces the marked drawing's content. |
| PO, packing slip, invoice | Part number, quantity, amounts, dates | Usually contract information, not technical data, unless a marked drawing is attached. |
Often inside the boundaryUsually outside it
The rule that decides it is the marking. A designator must put a CUI banner on all CUI, and anyone holding it must apply the markings uniformly and conspicuously. For ITAR, drawings and blueprints of a defense article are technical data by definition. If you are not sure whether a job is CUI or only contract information, read FCI vs CUI and what counts as CUI before you choose where the ERP lives.
Six ERPs against the rule
Rows inside the boundary are what the rule asks of a system that holds CUI. Rows outside it are the features shops usually compare, kept here to show they do not decide anything. Every word was read on the vendor's own pages, or the FedRAMP Marketplace, on 2026-10-22. "Not stated" means we did not find it, not that the product lacks it.
| What the rule asks | ProShop ERP | Fulcrum | JobBOSS² | ECI M1 | Epicor Kinetic | Global Shop Solutions |
|---|---|---|---|---|---|---|
| Inside the boundary | ||||||
| Cloud edition at FedRAMP Moderate, or equivalent to itDFARS 252.204-7012(b)(2)(ii)(D) | Vendor states equivalency | Initial Implementation | Not in Marketplace | Not in Marketplace | Not in Marketplace | Not in Marketplace |
| On-premises edition you run inside your own boundary32 CFR 170.19; NIST SP 800-171 Rev 2 | On-prem files | Not stated | On-prem stated | Not stated | On-prem stated | On-prem stated |
| US-persons-only hosting or support, for ITAR drawings22 CFR 120.50, 120.56, 120.62 | US persons only | Azure Government stated | ITAR claim stated | ITAR claim stated | Not stated | Not stated |
| Prints a CUI banner on travelers, drawings and quotes32 CFR 2002.20(b); MP.L2-3.8.4 | Not stated | Not stated | Not stated | Not stated | Not stated | Not stated |
| Audit logs of who opened and changed what, that you can exportAU.L2-3.3.1, AU.L2-3.3.2 | Logs stated | Logs stated | Not stated | Not stated | Logs stated | Logs stated |
| Multifactor authentication for every userIA.L2-3.5.3 | MFA stated | Can require MFA | Cloud MFA stated | Cloud MFA stated | MFA stated | Cloud MFA stated |
| Outside the boundary | ||||||
| Quoting and estimating | Stated | Stated | Stated | Stated | Stated | Stated |
| Scheduling | Stated | Stated | Stated | Stated | Stated | Stated |
| Shop-floor data collection (tablets, kiosks) | Stated | Stated | MES add-on | Not stated | Stated | Stated |
What the words mean
- MeetsUS persons onlyMFA statedStatedCan require MFAOn-prem stated
- The vendor's own documentation, or the official register, says so. Read on the date shown.
- PartialVendor states equivalencyOn-prem filesLogs statedAzure Government statedITAR claim statedCloud MFA statedMES add-on
- Covers part of the requirement, or the vendor claims it and the official register does not show it.
- Check with vendorNot statedInitial ImplementationNot in Marketplace
- Not stated in what we read. Ask the vendor in writing before you rely on it.
Three ways to keep the ERP inside the rule
Where the ERP runs decides who carries which controls. There are three honest answers, and a shop can mix them: a hosted ERP that meets the cloud clause, an ERP on your own server, or an ERP that never holds the drawings at all. The cloud clause is short:
Drawings and travelers live in a hosted ERP. DFARS 7012 then asks the provider to meet FedRAMP Moderate or an equivalent.
The vendor carries
- The data centre, network and backups
- Encryption of the stored data
- The controls its Customer Responsibility Matrix marks as inherited
It stays yours
- Who gets an account, and removing it on the day someone leaves
- MFA for every user, if the ERP leaves it to you
- The laptops and shop-floor screens that open the ERP
- Putting the vendor's responsibility matrix in your SSP
Ask before you sign
- A FedRAMP Marketplace listing at Moderate or High, or the equivalency evidence the DoD CIO memo of 2023-12-21 describes: 100 percent of the Moderate baseline, assessed by a FedRAMP-recognized 3PAO, handed to you
- The Customer Responsibility Matrix
- Who in support can see your data, and whether they are US persons
The third route is the cheapest to buy and the hardest to keep. It works only if nobody ever attaches a marked PDF to a job, because the rule puts an asset out of scope when it is physically or logically separated from CUI assets, and one attachment ends the separation. The drawings then need a home that meets the clause: compare CMMC enclaves and ITAR-ready file sharing. What the clause asks beyond hosting, including 72-hour incident reporting, is in DFARS 252.204-7012 explained.
ITAR drawings: who can open them
CMMC and ITAR overlap in the ERP because they both care about the drawing. Under the ITAR a drawing of a defense article is technical data, and releasing it to a foreign person in the United States is a deemed export to every country of that person's citizenship or permanent residency.
An ERP exposes the drawing to two groups. Your own users you control with roles. The vendor's people, support staff and the admins of the hosting, you control only by contract, so ask who they are. A US person means a citizen, a lawful permanent resident, a protected individual, or a company incorporated to do business in the United States. This is what the six vendors said about it on their own pages:
| Vendor | What its pages say |
|---|---|
| ProShop ERP | US persons only |
| Fulcrum | Azure Government stated |
| JobBOSS² | ITAR claim stated |
| ECI M1 | ITAR claim stated |
| Epicor Kinetic | Not stated |
| Global Shop Solutions | Not stated |
"Complies with ITAR" on a product page is a claim about the vendor, not a certificate: there is no ITAR certification for a product, and Microsoft says as much of its own government clouds. Get the hosting region and the US-person rule for support in writing. One exemption is often misread: storing technical data is not an export if, among other conditions, it is end-to-end encrypted with FIPS 140-validated modules and the means of decryption are never given to a third party. A hosted ERP that shows you the drawing in a browser normally decrypts it on its own servers, so ask the vendor whether it claims that exemption at all before you rely on it. The ITAR compliance checklist covers the rest of the shop, and ITAR compliance software covers licences and screening, which no ERP here claims to do.
The traveler on the cart needs a banner
A shop prints more CUI than it emails. Every traveler, router and inspection sheet that carries a marked drawing's content is CUI on paper, and the rule wants it marked: every CUI document carries a banner, CUI or CONTROLLED, applied uniformly and conspicuously.
None of the six vendors says, on the pages we read, that its ERP prints a CUI banner on travelers, quotes or reports. That does not mean it cannot: most job-shop ERPs let you edit report headers. It means you test it before you buy, with your own jobs:
- 01Open a job you have flagged as CUI and print its traveler, its quote and its inspection report.
- 02Look at the top of each page. The banner, CUI or CONTROLLED, should be there without anyone typing it.
- 03Print a job that is not CUI. The banner should not appear, or people learn to ignore it.
- 04Ask the vendor whether a job or customer flag can drive the header on every report, and who can switch it off.
The vendors, one by one
ProShop ERP
What it is. A paperless ERP, MES and quality system for precision machine shops. Its SAFE hosting runs in AWS GovCloud with US-persons-only access, and ProShop says an outside 3PAO assessed that environment against the FedRAMP Moderate baseline. ProShop also says plainly that it is not FedRAMP Authorized.
Who it fits. A build-to-print shop whose drawings and travelers already live in the ERP, and that wants the hosting question answered by the vendor with a responsibility matrix for its SSP.
| What the rule asks | What we found |
|---|---|
| Cloud edition at FedRAMP Moderate, or equivalent to it | Vendor states equivalency |
| US-persons-only hosting or support, for ITAR drawings | US persons only |
| Audit logs of who opened and changed what, that you can export | Logs stated |
Checked on proshoperp.com, 2026-10-22
Check with the vendor before you buy.
Fulcrum
What it is. A cloud ERP, MRP and shop-floor system for CNC shops and sheet-metal fabricators, with quoting, nesting and automatic scheduling. Fulcrum hosts its ITAR customers in Azure Government and has its own FedRAMP Marketplace listing, at the Initial Implementation stage and not yet certified on 2026-10-22.
Who it fits. A fabricator or CNC shop that wants a cloud-only system, is happy to wait for the FedRAMP result, and wants every login behind MFA from day one.
| What the rule asks | What we found |
|---|---|
| Cloud edition at FedRAMP Moderate, or equivalent to it | Initial Implementation |
| US-persons-only hosting or support, for ITAR drawings | Azure Government stated |
| Multifactor authentication for every user | Can require MFA |
Checked on fulcrumpro.com, 2026-10-22
Check with the vendor before you buy.
JobBOSS²
What it is. ECI's ERP for job shops and mixed-mode manufacturers: quoting, job costing, scheduling and inventory, with MES and other add-ons. ECI offers it three ways in the US: multi-tenant cloud, a private hosted cloud, or on-premise, and says it complies with ITAR standards.
Who it fits. A job shop that wants to choose where the server sits, including on its own premises inside the boundary it already draws.
| What the rule asks | What we found |
|---|---|
| On-premises edition you run inside your own boundary | On-prem stated |
| US-persons-only hosting or support, for ITAR drawings | ITAR claim stated |
| Cloud edition at FedRAMP Moderate, or equivalent to it | Not in Marketplace |
Checked on ecisolutions.com, 2026-10-22
Check with the vendor before you buy.
ECI M1
What it is. ECI's ERP for discrete, make-to-order and engineer-to-order manufacturers, sold for aerospace and defense suppliers. ECI names an M1 cloud ITAR solution and a Government Compliance Cloud platform, without naming the hosting or a FedRAMP status on the pages we read.
Who it fits. A growing shop with more than one site or engineer-to-order work that has outgrown a job-shop package.
| What the rule asks | What we found |
|---|---|
| US-persons-only hosting or support, for ITAR drawings | ITAR claim stated |
| Cloud edition at FedRAMP Moderate, or equivalent to it | Not in Marketplace |
Checked on ecisolutions.com, 2026-10-22
Check with the vendor before you buy.
Epicor Kinetic
What it is. A broad manufacturing ERP, cloud-first on Microsoft Azure with on-premises and hybrid deployments still offered, with SSO, MFA and detailed audit logs on its own page. Epicor's separate ECM GovCloud document product runs in AWS GovCloud for ITAR documents, through an early adopter program, with CMMC support promised for a future release.
Who it fits. A shop with planning and multi-site needs that wants to install the ERP on its own servers and keep the drawings in a separate document system.
| What the rule asks | What we found |
|---|---|
| On-premises edition you run inside your own boundary | On-prem stated |
| Multifactor authentication for every user | MFA stated |
| Audit logs of who opened and changed what, that you can export | Logs stated |
Checked on epicor.com, 2026-10-22
Check with the vendor before you buy.
Global Shop Solutions
What it is. An ERP for job shops and make-to-order manufacturers, sold on-premise (you buy it and choose the servers) or as a cloud service on AWS that Global Shop says is configured with the NIST cybersecurity framework, with MFA on cloud access.
Who it fits. A shop that wants to own the software and run it on its own hardware, inside the boundary it already maintains.
| What the rule asks | What we found |
|---|---|
| On-premises edition you run inside your own boundary | On-prem stated |
| Cloud edition at FedRAMP Moderate, or equivalent to it | Not in Marketplace |
| Multifactor authentication for every user | Cloud MFA stated |
Checked on globalshopsolutions.com, 2026-10-22
Check with the vendor before you buy.
How we read the vendors
Questions machine shops ask
Is there a CMMC-certified ERP?
No. CMMC assesses your company's systems, not a product. A vendor can carry part of the load, a hosting environment and the controls it inherits to you, and hand you a Customer Responsibility Matrix to put in your SSP. "CMMC compliant ERP" on a vendor page means the vendor thinks its product will not stand in your way.
Our ERP holds only job numbers, quantities and dates. Does it need FedRAMP?
Not under the cloud clause, which applies to a provider that stores, processes or transmits covered defense information. A provider holding neither CUI nor your security data (configurations, logs, passwords for in-scope systems) is not an External Service Provider under CMMC at all. The test is whether it stays that way: one attached drawing changes the answer. The scoping worksheet helps you write the rule down.
Do shop-floor PIN logins break the MFA requirement?
They can. The requirement is multifactor authentication "for local and network access to privileged accounts and for network access to non-privileged accounts", and a PIN on a shared kiosk is one factor. If the kiosk reaches a hosted ERP and shows CUI, an assessor may read that as network access to a non-privileged account. MFA used only for remote and privileged users costs 3 points in the score; no MFA costs 5.
Some ERPs separate the two: Fulcrum lets a worker clock jobs with a PIN, then asks for the password before the main site opens. Ask how your ERP does it, and show the kiosk in your SSP.
Does the Phase 2 suspension change any of this?
No. The suspension stops contracts adding third-party Level 2 and Level 3 assessments; DFARS 252.204-7012 still applies, and with it the cloud clause and NIST SP 800-171 Rev 2. An ERP chosen now is the one you will self-assess, and the one a C3PAO would see if third-party assessments return. What still applies today.
A vendor says it is FedRAMP Moderate equivalent. What should that come with?
The DoD CIO memo of 2023-12-21 sets the bar: 100 percent compliance with the current FedRAMP Moderate baseline, assessed by a FedRAMP-recognized 3PAO, with the body of evidence given to you, the contractor. Ask for that evidence and the Customer Responsibility Matrix, not a press release. An offering that is FedRAMP Moderate Authorized on the Marketplace needs no further assessment. The difference between the two programs is in CMMC vs FedRAMP.
Can we keep running our old ERP on our own server?
Yes, if it can meet the same requirements as everything else inside your boundary: supported and patched, behind MFA, logging, backed up and encrypted. An unsupported version that no longer gets security fixes is a finding waiting to happen. Walk it through the NIST SP 800-171 checklist before you decide.