Most state pages about compliance are the same page with the state name swapped. This one is built on a specific measurement: every recipient in NAICS 332710 — machine shops — with a Department of Defense prime award performed in Florida since October 2024, pulled from USAspending, then checked against what each company publishes on its own website.
What the pull found
- 38 distinct recipients, 36 of them registered in Florida — the other two hold Florida places of performance from out-of-state addresses.
- 102 awards between them, totalling about $5.6 million.
- 22 of the 36 Florida shops took less than $100,000 across the whole period. Only two cleared half a million.
- 18 Florida cities represented, with repeat appearances in Panama City, Pensacola, Jacksonville, Saint Petersburg, Pinellas Park and Delray Beach.
- The Defense Logistics Agency and the Navy account for nearly all of it; the Army and Air Force appear once each.
The size distribution is the point
A shop reading about CMMC could be forgiven for assuming the requirement is aimed at somebody bigger. In this population there is almost nobody bigger. The median Florida machine shop in the data is a sub-$100k supplier — a handful of people, one building, work that arrives through DLA and the Navy in small increments.
That is exactly the population CMMC lands on, and the size that makes it hardest: the same 110 requirements, the same System Security Plan, and no compliance department to hand it to. The saving grace is that a small shop with a tight boundary is genuinely cheaper to make assessment-ready than a large one — provided somebody draws the boundary deliberately.
Where the work clusters
The Panhandle shows up repeatedly, which is unsurprising given the density of Navy activity around Panama City and Pensacola. Jacksonville, the Tampa Bay corridor from Saint Petersburg through Pinellas Park and Largo, and a South Florida group around Delray Beach, Doral and Davie make up most of the rest.
Clustering matters for one practical reason: primes and DLA buyers work these regions as pools. If your neighbours are being asked for SPRS scores, you are in the same pool, and the request is coming whether or not it has arrived yet.
What Florida shops show the public
Of the shops in this set with a findable website, we checked two public signals: whether the site says anything about security or compliance, and whether the company's email domain publishes a DMARC record. Neither is a security assessment — both are things any prime can look up in a minute, and some do.
- Fifteen had a website we could find and confirm was theirs.
- Exactly one mentioned CMMC anywhere on it.
- Two more mentioned ITAR registration or NIST 800-171 without mentioning CMMC.
- The other twelve said nothing about security or compliance at all.
- Eight published no DMARC record, meaning nothing stops someone spoofing their domain to a customer. Five had an enforcing policy.
One shop in fifteen mentions the requirement that reshapes their contracts in November, and twelve say nothing about security at all. That is the opportunity and the warning in the same sentence.
Is there anything Florida-specific about the rules?
No — and that is worth saying plainly, because state pages often imply otherwise. CMMC is a federal acquisition requirement that reaches you through your contract, not through Tallahassee. There is no Florida CMMC level, no state exemption, and no state registration that changes what your prime asks for.
What is genuinely local is the shape of the work: heavy DLA and Navy exposure, small award sizes, and a supplier base concentrated near the bases. Those affect how soon the request reaches you and how much runway you have, not what the requirement says.
Where a Florida shop should start
Establish whether CUI actually reaches your systems, get a defensible SPRS score on paper, and shrink the boundary before spending on tooling. Those three steps are the same everywhere; what the data above should change is your sense of urgency, because the shops around you are, on this evidence, no further along than you are.
The free calculator scores all 110 requirements with the official DoD weights and takes about twenty minutes. If it returns a negative number, that is normal and it is where most of this population would start.
Method, so you can check it: USAspending prime award search, NAICS 332710, awarding agency Department of Defense, place of performance Florida, award types A–D, start dates from 1 October 2024, deduplicated by recipient. Public-surface signals were read from company websites and public DNS records; no systems were touched and nothing was scanned.