St. Louis's Defense Aerospace Base
St. Louis has a deep aerospace manufacturing heritage going back to the McDonnell Aircraft Corporation — the company that built Mercury and Gemini spacecraft and the F-4 Phantom. That legacy lives on in Boeing Defense, Space & Security, which operates its headquarters and primary production facilities in Berkeley, Missouri, just outside St. Louis city limits.
Today Boeing's St. Louis operations are executing some of the most significant fighter and unmanned aircraft programs in the US military. The F-15EX Eagle II is re-entering production for the Air Force. The F/A-18 Super Hornet line serves the Navy. The T-7A Red Hawk is the Air Force's next-generation pilot training aircraft. And the MQ-25 Stingray is the first carrier-based unmanned aerial refueling aircraft, a program that will change how the Navy operates its carrier air wings.
Each of these programs requires a sophisticated supply chain. Precision manufacturers, electronics assemblers, material suppliers, engineering services firms — hundreds of companies in the greater St. Louis metro support these programs. They all handle CUI. They all need CMMC Level 2.
The core Boeing Defense campus and primary production facilities. The surrounding area hosts Boeing suppliers, defense engineering firms, and aerospace services companies concentrated near Lambert International Airport and along the I-70 corridor.
Growing concentration of precision manufacturers, aerospace component suppliers, and defense electronics firms in St. Charles County. Companies that moved here to be near the Boeing supply chain without the congestion of the immediate Lambert area.
Legacy industrial base with defense manufacturers, specialty material suppliers, and defense services firms. Strong precision machining and metal fabrication community with Boeing and other prime contractor ties.
Scott Air Force Base across the river in Illinois is home to US Transportation Command and Air Mobility Command. St. Louis-area contractors supporting Scott programs — logistics, IT, transportation management — have a separate but equally real CMMC obligation.
Boeing is doing what Lockheed Martin did in Fort Worth — systematically reviewing their supplier list and making CMMC compliance a condition of new awards. If you're a Boeing St. Louis supplier who hasn't started, you're already behind schedule.
The free 2-minute assessment tells you your required CMMC level, likely gaps, and estimated cost. Get ahead of the compliance review before it shows up in a contract condition.
Take the Free Readiness Check →Major Defense Employers in St. Louis
- Boeing Defense, Space & Security — Headquartered in Berkeley, MO. Active programs: F-15EX Eagle II, F/A-18 Super Hornet, T-7A Red Hawk, MQ-25 Stingray. The dominant supply chain driver in the St. Louis defense market.
- Northrop Grumman — Significant St. Louis presence with systems integration, electronics, and space programs. Active supply chain compliance programs.
- BAE Systems — Defense electronics and systems with Missouri operations.
- Leonardo DRS — Defense electronics, vehicle systems, and advanced technologies with St. Louis area presence.
- Emerson Electric — Defense and aerospace systems including guidance, environmental controls, and systems management for military programs.
- Ruger / Planetary Systems — Defense component manufacturers in the greater metro.
- Scott AFB contractor community — Dozens of IT services, logistics, and professional services firms supporting USTRANSCOM and AMC programs across the river in Illinois.
The Boeing Supply Chain Pressure
Boeing has been communicating CMMC requirements to its supply chain for years — and the enforcement is getting real. Here's what St. Louis Boeing suppliers should understand:
Boeing's supplier portal requirements. Boeing's supply chain management systems require suppliers to have DFARS compliance documentation on file. If you don't have a current SPRS score, you're already flagged. New awards require demonstrated CMMC compliance status.
Flow-down is automatic. Boeing's prime contracts include DFARS 252.204-7012, 7019, and 7020. These flow down to every subcontract where CUI is involved. Boeing is your prime — so these requirements apply to you automatically, even if no one has specifically called you out on it.
New programs set the pace. The T-7A and MQ-25 programs are new enough that CMMC compliance was built into their contract structures from the start. Suppliers who are getting on these programs are getting CMMC requirements from day one. If you're already on older programs like F-15, the requirements are catching up to you faster than you might expect.
Your compliance package is built from your actual environment — Boeing supply chain, aerospace manufacturing data flows — and verified by practitioners who know St. Louis and won't scope it wrong.
Take the Free Readiness Check →Missouri Resources for CMMC
Missouri's procurement assistance network with St. Louis metro advisors familiar with the Boeing supply chain. Provides free initial CMMC guidance, help understanding DFARS clauses, and connections to regional consultants. A strong first call before engaging a private practitioner.
Missouri's Manufacturing Extension Partnership center. Offers CMMC gap assessments, cybersecurity training, and connections to vetted consultants with aerospace manufacturing experience. Their subsidized programs make initial compliance assessment significantly more affordable than private consulting. Start here.
Boeing maintains supplier-facing resources that include CMMC guidance, DFARS compliance information, and connection to Boeing's supply chain compliance team. If you're an existing Boeing supplier, check D1-4426 (Boeing's supplier cybersecurity requirements) and the Boeing Supplier Portal for current compliance requirements and timelines.
What St. Louis Defense Contractors Should Do Now
If you're a Boeing supplier or supporting Scott AFB programs, here's the honest assessment of where you need to be:
Check your SPRS score first. If you don't have a current score in the Supplier Performance Risk System, you're in violation of existing DFARS requirements — not just the upcoming CMMC rule. This is the most immediate issue and should be resolved before anything else.
Get your System Security Plan drafted. Your SSP is the foundation of CMMC Level 2 — the document that describes how you protect CUI in your environment. If you don't have one, start there. MyCMMC's platform can accelerate this significantly compared to building it from scratch with a consultant.
Understand your gap count. Of the 110 NIST 800-171 controls, most St. Louis aerospace manufacturers have 20–40 gaps. Understanding which gaps are technical versus procedural is the key to efficient remediation. Missouri Enterprise can give you this picture at subsidized rates.
See the full CMMC cost guide for a realistic picture of what Level 2 certification costs for a manufacturing company your size.
Frequently Asked Questions
Yes, if your work involves CUI. Boeing Defense has been aggressively implementing CMMC requirements in its supply chain. If you supply to Boeing defense programs — F-15, F/A-18, T-7A, MQ-25 — and your work involves technical data or specifications, you're handling CUI and need CMMC Level 2. Boeing is actively enforcing this in new contract awards.
Scott AFB is 30 miles east of St. Louis in Belleville, IL — home to US Transportation Command (USTRANSCOM) and Air Mobility Command. Contractors supporting USTRANSCOM and AMC programs handle logistics and transportation data that can be CUI. St. Louis-area firms supporting Scott should evaluate their CMMC obligations carefully.
Missouri Enterprise is Missouri's MEP center — federally funded, supporting small and mid-sized manufacturers with CMMC compliance. They offer gap assessments, cybersecurity workshops, and connections to vetted consultants. Their subsidized programs are significantly more affordable than private consulting as a starting point.
Boeing Defense's St. Louis operations produce the F-15EX Eagle II, F/A-18 Super Hornet, T-7A Red Hawk, and MQ-25 Stingray. All are active programs with substantial supply chains in the St. Louis metro. Each involves significant CUI — design data, manufacturing specifications, test data — that flows through the supply chain.
Missouri APEX Accelerator is a network of procurement assistance centers that help small businesses navigate government contracting requirements including CMMC. They have advisors in the St. Louis metro familiar with the Boeing supply chain and Scott AFB contracting community, providing free initial guidance and connections to regional compliance resources.
Get Your C3PAO-Ready Documentation — Built for the St. Louis Aerospace Market
Take the free readiness check and get a complete compliance package built from your actual environment and verified by practitioners who know the Boeing supply chain and St. Louis aerospace market.
Take the Free Readiness Check →Free · 2 minutes · No obligation
Or see pricing & packages →