DFARS CMMC clauses formalize cybersecurity as a contract condition, but the work happens on the shop floor: evidence, training, access, change control, and traceability. Here is how to frame CMMC and NIST 800-171 evidence so audits do not collide with manufacturing reality.