What Boeing Requires
- CMMC Level 2. Boeing's signed supplier letter asks suppliers to prepare for Level 2 with a certified third party assessor, and makes the level in each solicitation a condition of award. Boeing CMMC supplier letter, 2025
- A cybersecurity questionnaire before work starts. Complete Boeing's questionnaire before your contract takes effect, and update it at least every 2 years. SP5 §6.3, §6.4, June 2026
- A yearly review. Review or audit your own systems at least once a year, and agree a risk treatment plan within 30 days of a finding. SP5 §6.5, §6.6
- DFARS 7012. Boeing's supplier cybersecurity page lists DFARS 252.204-7012 and FAR 52.204-21. boeingsuppliers.com cybersecurity page
How Boeing Checks
- ESLC profile. Keep your Enterprise Supplier Lifecycle profile current with a named cyber contact. ESLC is where you submit your CMMC level and evidence. SP5 §6.1, ESLC User Guide Rev 8
- Audit reports. Give Boeing your audit reports when it asks. SP5 §6.8
- SPRS. Boeing publishes its own SPRS instructions for suppliers. Boeing doc 1253-25-00215
Incidents and Questions
Report a cyber incident within 72 hours to abuse@boeing.com (SP5 §8.1). Supplier cyber questions go to Cscrmonboarding@boeing.com.