It's a systematic review of your network, systems, and processes to find and score security weaknesses — the same way an insurance inspector walks a building looking for fire hazards. For manufacturers, it carries extra weight because it's usually the first document a prime contractor, insurer, or CMMC assessor will ask for.

Beyond compliance, it answers a practical question every shop owner should be able to answer: if a machine controller, ERP system, or file server went down tomorrow, what would it cost, and how fast could you recover?

The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense's framework for verifying that contractors and subcontractors protect Controlled Unclassified Information and Federal Contract Information. It's built on the 110 security controls in NIST SP 800-171.

A risk assessment is how you find out which of those 110 controls you already meet, which you don't, and what it will take to close the gap — the foundation everything else in your CMMC path is built on.

Not quite. A cybersecurity risk assessment is the technical review — the actual work of finding and scoring gaps. A CMMC Level 1 or Level 2 self-assessment is the formal attestation you file based on that work, and it's what generates or updates your SPRS score.

Think of the risk assessment as the homework and the self-assessment as turning it in. If your CMMC requirement level calls for third-party certification instead of self-attestation, a C3PAO handles that separately — but they'll expect the same underlying gap analysis to already exist.

Example: A tier-2 automotive supplier in the Wiregrass region used its risk assessment findings directly as the source document for its CMMC Level 1 self-assessment, cutting weeks off the filing process.

A risk assessment is broad and administrative — it reviews policies, configurations, access controls, backups, and documentation across the whole environment to build a complete gap list. A penetration test is narrow and adversarial — it actively tries to break into specific systems the way an attacker would.

Most manufacturers pursuing CMMC need both eventually: the risk assessment to document your 800-171 posture, and periodic penetration testing to validate that your defenses actually hold up under a real attempt.

A properly scoped assessment covers both. Office IT — email, file servers, laptops, Wi-Fi — is the more familiar half. The shop floor is where most generic assessments fall short: PLCs, CNC controllers, SCADA systems, and machine monitoring often run on outdated firmware, flat networks, and default credentials because "it's not connected to the internet" — until a laptop, a vendor's remote access tool, or a shared network segment connects it anyway.

A manufacturing-aware assessment specifically checks IT/OT network segmentation, remote vendor access into machine controllers, and whether a compromise on the office side could reach production.

For a shop in AllTech's typical range — 15 to 100 employees, 25 to 250 endpoints — a full assessment usually runs one to three weeks: discovery and interviews, technical scanning of the network and endpoints, an OT/shop-floor review if applicable, and a findings report with a prioritized remediation plan. Larger or multi-site operations take longer; a single-site shop with straightforward IT can move faster.

A findings report mapped to NIST SP 800-171 control families, a plain-language explanation of each gap and why it matters, and a prioritized remediation roadmap — typically split into immediate fixes, 90-day items, and longer-term investments.

Most shops also walk away with the documentation needed to calculate or update a SPRS score, and a System Security Plan (SSP) and Plan of Action & Milestones (POA&M) — the two documents DoD contract reviews most often request.

Cost scales with endpoint count, number of sites, and whether OT/shop-floor systems are in scope — a single-site shop with 40 endpoints and office-only IT costs less to assess than a multi-site operation with networked production equipment.

Example: for AllTech's typical client — 40 to 75 endpoints, one primary site — the assessment itself is usually a modest fixed-fee project, separate from any ongoing managed security services used to close the gaps it finds.

Without a documented assessment, you can't produce a current SPRS score, an SSP, or a POA&M on request — and DoD flow-down clauses generally require you to have these ready, not to start building them once asked.

In practice this shows up as a stalled bid, a paused subcontract, or a compressed scramble to produce documentation under a deadline — all more expensive and more stressful than doing the assessment on your own timeline.

Annually at minimum, and any time something material changes — new production equipment, a new facility, a new ERP or MES system, a merger, or a significant change in your DoD contract scope. SPRS scores are also expected to reflect your current environment, not a snapshot from years ago.

Look for a provider that has actually assessed manufacturing environments before, understands OT/IT segmentation, and can speak fluently about NIST SP 800-171, SPRS, and DFARS 252.204-7012 — not just generic IT security.

Also ask what happens after the report: a partner who can both assess and remediate saves you from handing a stack of findings to a second vendor to actually fix.

1. We assess office IT and shop-floor OT together, not as separate projects.

2. Findings map directly to NIST SP 800-171 control families and your SPRS score.

3. You get a prioritized roadmap, not just a list of problems.

4. We can move straight from assessment into remediation through managed security services.

5. Annual reassessment keeps your documentation current as your contracts and equipment change.