Country Briefs
Germany Market-Entry Brief
What a German sensor or electromechanical manufacturer builds in the US to win DoD work: the US-person data boundary, the NIST SP 800-171 floor, and the path American Rheinmetall proved across six US plants.
Garrett Partridge · July 16, 2026 · Market-Entry Brief
A German defense or aerospace manufacturer wins US Department of Defense work by standing up a real US operation, not by shipping across a border. The build is three things: a US entity, a US-person data boundary that keeps controlled technical data inside the American operation, and a floor built to the 110 security requirements of NIST SP 800-171, which DFARS clause 252.204-7012 puts in the contract and flows down to subcontractors. Under 22 CFR 122.1, a US manufacturer of defense articles registers with the Directorate of Defense Trade Controls even if it never exports. Germany's DFARS qualifying-country status earns your end products a procurement preference, not a waiver of ITAR, of the safeguarding rules, or of FOCI. The path is proven: American Rheinmetall reached CMMC Level 2 across all six of its US manufacturing plants in April 2026.
The proof is German, and part of it sits in New England
German industry is already doing this build, and one of them published what it took. On April 14, 2026, Rheinmetall announced that American Rheinmetall had achieved CMMC Level 2 certification across all six of its US manufacturing plants.
The release lists the states: Maine, Michigan, and Ohio, and names the Maine site as Biddeford. A German-parented defense manufacturer runs a Level 2 floor in New England today, which makes the landing zone in this brief a fact rather than a projection.
HENSOLDT, at the top of Germany's sensor base, calls itself a market leader in civilian and military sensor solutions. Below it sits the tier this brief is written for: the pressure, position, and force sensor makers and the electromechanical suppliers who have the parts a DoD platform needs, and not yet the US compliance posture that sells into it. That tier is who I build for.
A German parent cleared the Level 2 bar across six US plants, and one of them sits in New England. That is the existence proof.
What the build actually took
The Rheinmetall release includes the part most vendors leave out. Reaching Level 2 across those plants required several years of preparation, and coordinated effort across IT, leadership, operations, compliance, and the broader workforce.
Their chief executive, Matt Warnick, put it plainly: "Security is not just a technical methodology, it's a mentality." It must be driven by leadership, enabled by IT, and embraced across the organization, he said.
That is an operating build, not an IT project, described by a German group that just finished doing it. The compliance vendors sell you the tool. The operation is what gets assessed.
- The bar: the 110 security requirements in NIST SP 800-171, mapped to more than 320 assessment objectives.
- The scope: all six US manufacturing plants, brought into full compliance together.
- The assessor: a Certified Third-Party Assessor Organization, with the final audit completed in February 2026.
Rheinmetall brought six running plants into compliance. You are building one floor from nothing. That is the Mittelstand's advantage: a tight footprint, a tight CUI enclave, and the controls designed in before the first part ships.
The certificate moved. The obligation did not.
On July 13, 2026, the Department suspended Phase II of the CMMC program, which had been scheduled to begin on November 10, 2026, and opened a reform review. Phase I stayed in place. That is the status in July 2026, and it will move again.
What did not move is the part that matters. DFARS clause 252.204-7012 still requires adequate security on every covered contractor information system, still points at the NIST SP 800-171 requirements, and still flows down to subcontractors without alteration. The Department says it will enforce through self-assessments and select government-led assessments during the review. Level 2 now runs on a self-assessment every three years and an annual affirmation into the Supplier Performance Risk System.
Take the third-party assessor out and put your own affirmation in, and the weight shifts onto the operation. An affirmation is a statement your organization makes to the government about controls it either runs or does not. Your government-contracts counsel owns that statement's legal exposure. I own whether the floor actually runs the controls you affirm.
The certification schedule moved in July. The clause in your contract did not. Build to the 110 requirements and the assessment mechanism becomes a scheduling question instead of a strategy.
Your work class, and who owns what
Know which class of work you are chasing before anyone quotes you a timeline. Commercial and dual-use parts need a US entity and a clean quality system. Classified work needs a facility clearance and FOCI mitigation negotiated with DCSA, which stays with your cleared-facility counsel. Between them sits the class that carries most sub-tier DoD manufacturing: controlled technical data, CUI, ITAR-controlled, unclassified. A foreign-owned US entity reaches it without a facility clearance, and it is the class I build and run.
The thing under control is your design package, not the part in the crate. Your export-control counsel makes that call for your parts, and I build the boundary that holds once they do.
I have been the foreign parent's operator in the US. I ran the North America operations of GEFRAN, an Italian sensor and automation multinational with a plant in North Andover, Massachusetts, and I am standing up US defense manufacturing operations for a Canadian-parent subsidiary now. New England is where I work, and where the primes, the supply base, and the compliance depth already are.
- Mine: the operating model, the floor, the IT and OT build, the US-person data boundary, and the readiness evidence for your gate.
- Your corporate counsel: entity formation and the FOCI instrument.
- Your export-control counsel: DDTC registration, the jurisdiction and classification calls, and any authorization to move data to the parent.
- A site-selection advisor: where the building goes.
Preferences and registrations open the door. Neither one builds the operation that walks through it.
Frequently asked
Direct answers.
American Rheinmetall needed several years. You say ninety days. Which is it?
Both, because they are different things. Rheinmetall retrofitted six plants that were already running, then had a third party assess them. That earns the years it takes. The ninety-day build stands up one new US floor at a Level 2 and ITAR-ready posture from the day it opens, with the readiness evidence sequenced against the gate you are racing. The assessment is its own event on its own clock. Designing the controls in before the first part ships is what keeps a new operation from repeating a multi-year retrofit.
The Department suspended CMMC Phase II. Can we wait?
Waiting assumes the certificate was the requirement. It was not. DFARS clause 252.204-7012 sits in the contract, requires adequate security against the NIST SP 800-171 requirements, and flows down to subcontractors without alteration. Level 2 now runs on a self-assessment and an annual affirmation into SPRS, which means your organization makes the statement instead of an assessor. Meanwhile your prime decides who it trusts with controlled technical data, and it decides on evidence rather than on a schedule.
We make sensors and electromechanical components, not weapons. Is this still ITAR and CMMC work?
Very likely, if the part goes into a defense program. The controlled item is the technical data, not the visible product. DFARS 252.204-7012 defines covered defense information to include controlled technical information, and its examples of technical information name engineering drawings, specifications, and process sheets. A pressure or position sensor's drawing set is exactly that once the part is specified into a DoD platform. The class of work decides the build, not the product category. Your export-control counsel makes the jurisdiction and classification call for your parts.
Is Germany's qualifying-country status an ITAR exemption?
No. DFARS 225.003 lists Germany as a qualifying country because Germany and the United States hold a reciprocal defense-procurement agreement to remove barriers to buying each other's defense supplies. That earns your end products a preference against Buy American restrictions. It is not an ITAR exemption, it does not waive the safeguarding requirements in your contract, and it does not clear FOCI. Registration works the same way: under 22 CFR 122.1, registering with DDTC confers no export rights or privileges, and a manufacturer that never exports still registers. Those regimes apply in full to a German-owned US operation, and building for them is the work.
Sources
- 1. American Rheinmetall achieves CMMC Level 2 certification across all six of its US manufacturing plants in ME, MI, and OH (Rheinmetall press release, 2026-04-14)
- 2. DoD CIO, About CMMC: the July 13, 2026 suspension of Phase II, the Phase 1 status, and the Level 2 self-assessment and annual affirmation against the 110 NIST SP 800-171 Rev 2 requirements
- 3. DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting: adequate security, the NIST SP 800-171 requirements, the definitions of covered defense information and controlled technical information, and the subcontract flowdown (current as of DFARS Change 5/7/2026)
- 4. DFARS 225.003 Definitions, qualifying countries, listing Germany (acquisition.gov, current as of DFARS Change 5/7/2026)
- 5. ITAR 22 CFR 122.1, Registration: requirements, exemptions, and purpose. A US manufacturer of defense articles registers with DDTC even without exporting, and registration confers no export rights or privileges (eCFR)
- 6. HENSOLDT, German defence and security electronics group and a market leader in civilian and military sensor solutions
- 7. DCSA, Foreign Ownership, Control, or Influence (FOCI) and facility-clearance mitigation
- 8. GEFRAN S.p.A., Italian sensor and automation multinational with a manufacturing plant in North Andover, Massachusetts
- 9. US market entry for German defense manufacturers
- 10. The US Market-Entry Playbook for Allied Defense Manufacturers
- 11. One Thread, Two Flags: the US-person data boundary for a foreign-parented defense operation
Take this with you
Download the print-ready PDF for the boardroom, or put this in front of an operator directly.