For most of its history, the manufacturing execution system lived in a server room down the hall from the shop floor. That was the safe assumption, especially in regulated industries. If the data mattered, you kept it on hardware you could walk up to.
That assumption has quietly flipped. Cloud MES software now runs production for companies building satellites, launch vehicles, aircraft components, and defense hardware, often under export control rules that once seemed to rule the cloud out entirely. The question most teams ask today isn't whether a cloud MES can work. It's what actually changes when they make the move, and what they need to get right.
This post walks through what cloud MES software is, how it differs from an on-premise MES in practice, what stays exactly the same, and how aerospace and defense manufacturers handle security and ITAR when their production data lives in the cloud.
What is cloud MES software?
Cloud MES software is a manufacturing execution system delivered over the internet and run on infrastructure managed by the vendor or a cloud provider, rather than on servers your team installs and maintains. Operators, technicians, quality engineers, and planners reach it through a browser or tablet on the shop floor.
The core job of an MES doesn't change in the cloud. It still sits between your planning systems (ERP, PLM) and the physical work, and it still handles the same essentials:
Work instructions and procedures: guiding technicians step by step through builds, tests, and inspections.
As-built records: capturing who did what, when, with which parts, serial numbers, and tools.
Quality and nonconformance: logging deviations, routing them for disposition, and closing the loop.
Traceability and genealogy: linking every component and lot back to the finished assembly.
Production visibility: showing work in progress, bottlenecks, and status in real time.
It also helps to separate two things that both get called "cloud." A true SaaS (software as a service) cloud MES is built for the cloud: one shared codebase, continuous updates, and multi-tenant or single-tenant hosting run by the vendor. A hosted MES is traditional on-premise software lifted onto a cloud virtual machine. It runs somewhere else, but you still own upgrades, patches, and much of the operational burden. Most of the benefits people associate with cloud MES come from the first model, not the second.
Cloud MES vs. on-premise MES: what actually changes
The biggest shift isn't where the software runs. It's who carries the operational load, and how fast the system can change. Here's how the two models compare on the points that matter most day to day.
| Area | On-premise MES | Cloud MES |
|---|---|---|
| Infrastructure | Your servers, database, backups, and disaster recovery | Managed by the vendor and cloud provider |
| Upgrades | Large, scheduled projects, often years apart | Frequent, smaller releases on a predictable cadence |
| Validation | Re-validate after each major upgrade | Validate against release notes and vendor test evidence on an ongoing basis |
| Access | Plant network, VPN for remote users | Browser access from any approved device and site |
| Multi-site | Separate instances per plant, hard to compare | One system across sites, shared standards and data |
| Integrations | Custom point-to-point code, fragile on upgrade | APIs and webhooks designed to survive updates |
| Cost model | Up-front licenses plus hardware and IT staff | Subscription that bundles hosting and maintenance |
| Time to value | Months of install and configuration | Weeks to first production use |
Upgrades stop being projects
On-premise MES upgrades are notorious. Teams delay them for years because each one means downtime, regression testing, and broken customizations. A cloud MES flips that. Updates arrive in small increments, so new features reach the floor faster and no one is stuck on a version from 2017.
The trade-off is that you need a process for absorbing change continuously. Good vendors publish release notes ahead of time, offer a sandbox environment for testing, and let you control when certain changes take effect.
Validation becomes continuous
In regulated manufacturing, validation is where cloud skeptics usually push back. With on-premise software, you validate once and freeze the system. With cloud MES, the system keeps evolving.
The answer is a risk-based approach. You rely on the vendor's documented testing for core platform behavior and focus your own validation on the configurations and workflows that are specific to your products. Ask vendors what validation package they provide and how they communicate changes that might affect your validated state.
IT shifts from maintenance to governance
Your IT team no longer patches servers or babysits database backups. Their job moves to access control, identity management, integration oversight, and vendor security review. That's usually a better use of a small team, but it's a real change in responsibilities.
Data becomes easier to connect
Cloud MES platforms are typically built API-first. That makes it much easier to pull production data into analytics tools, sync with ERP and PLM, or feed test results into engineering systems. On-premise systems can do this too, but the integrations tend to be custom and break during upgrades.
Remote and multi-site work gets simpler
Engineers can review a nonconformance from another building. A quality lead can approve a procedure change while traveling. A company with a test site in one state and an assembly plant in another can run both on the same system with the same standards.
What doesn't change
Moving to the cloud doesn't fix a broken process. A few things remain entirely your responsibility:
Process discipline. If work instructions are vague or out of date on paper, they'll be vague and out of date in software too.
Change control. You still decide who can edit procedures, who approves them, and how revisions are released.
Data ownership. Your production records are yours. Make sure your contract says so, and confirm you can export everything in a usable format.
Shop floor realities. Devices, Wi-Fi coverage, gloves, clean rooms, and ESD requirements all still matter. Plan for connectivity gaps and ask how the system behaves if the network drops.
Compliance accountability. The vendor can provide controls and evidence, but your company still answers to auditors, customers, and regulators.
Security and ITAR in a cloud MES for aerospace and defense
For aerospace and defense manufacturers, the cloud MES decision usually comes down to one question: can we keep export-controlled and controlled unclassified data where it's allowed to be? The answer is yes, but only if the platform and your own practices are built for it.
An MES in this industry holds exactly the kind of data regulators care about. Work instructions reference drawings and specifications. As-built records capture configurations of defense articles. Test procedures and results can describe performance characteristics. Much of this can qualify as ITAR technical data, EAR-controlled technology, or controlled unclassified information (CUI).
The rules that shape a cloud MES
| Regime | What it governs | What it means for a cloud MES |
|---|---|---|
| ITAR (22 CFR 120–130) | Defense articles and technical data on the U.S. Munitions List | Technical data in the MES can’t be accessed by foreign persons without authorization, including vendor staff and cloud provider personnel |
| EAR (15 CFR 730–774) | Dual-use items and technology | Similar access and location concerns for controlled technology, with license requirements varying by classification and destination |
| DFARS 252.204-7012 | Safeguarding covered defense information and incident reporting | Cloud services that store CUI generally must meet security requirements equivalent to the FedRAMP Moderate baseline |
| NIST SP 800-171 | The 110 security requirements for protecting CUI | The MES and the way you use it fall within the scope of your CUI controls |
| CMMC | Verification that contractors meet those requirements | Your MES vendor becomes part of your assessment scope and evidence |
Where the data lives and who can touch it
ITAR is fundamentally about access. Storing technical data on a server isn't the risk by itself. The risk is a foreign person being able to see it. That's why the most common approach for ITAR-ready cloud MES software is a dedicated U.S. environment, such as AWS GovCloud (US) or a comparable government cloud region, combined with administrative access restricted to vetted U.S. persons.
That combination matters because the cloud provider's controls only cover their layer. Your MES vendor also has engineers, support staff, and on-call responders. Ask directly whether everyone with access to production systems and customer data is a U.S. person, and how that's enforced and logged.
What the ITAR encryption carve-out does and doesn't cover
Since March 2020, the ITAR has included an end-to-end encryption carve-out at 22 CFR 120.54(a)(5). According to Akin Gump's summary of the rule, properly encrypted technical data can be sent, taken, or stored without DDTC authorization, provided it meets the rule's conditions. Those conditions include that the data is unclassified, encrypted with FIPS 140-2 validated modules or equivalent, and that the cloud provider is never given the means to decrypt it.
That last condition is the catch for a cloud MES. An MES has to display work instructions, render data, run searches, and generate reports. In most SaaS architectures, that means the application decrypts data on the server, so the provider has the means of decryption. Standard encryption at rest, where the provider holds the keys, doesn't qualify for the carve-out.
In practice, most A&D manufacturers don't rely on the carve-out for their MES. They rely on U.S.-only hosting and U.S.-person access controls instead, and treat encryption as defense in depth. Confirm the approach with your export compliance team and counsel before you move controlled data.
Where CMMC stands
CMMC deserves a status check, because the timeline moved this year. Phase 1, which requires Level 1 or Level 2 self-assessments in applicable contracts, began on November 10, 2025. Phase 2 was supposed to make third-party (C3PAO) Level 2 certification a condition of award starting November 10, 2026.
On July 13, 2026, the Department of War suspended Phase 2 and launched a 60-day review of the program, as Holland & Knight reported. That pause does not remove the underlying obligations. DLA Piper notes that DFARS 252.204-7012, self-assessments, SPRS reporting, and annual affirmations all still apply. The NIST SP 800-171 controls your MES needs to support haven't changed. Check the DoD CIO CMMC page for the latest before you plan around a date.
Controls to expect from an A&D-ready cloud MES
U.S.-only hosting in a government cloud region or equivalent, with data residency you can verify.
U.S.-person-only access for vendor staff who can reach production systems or customer data.
FedRAMP Moderate equivalency documentation, or a FedRAMP authorization, to support DFARS 7012.
A customer responsibility matrix that maps which NIST 800-171 controls the vendor covers and which remain yours.
Single sign-on and role-based access so you can restrict controlled procedures to authorized users.
Complete audit trails of who viewed, edited, signed, and approved each record.
Encryption in transit and at rest using FIPS-validated modules.
Incident reporting commitments that support the 72-hour reporting window under DFARS 7012.
Questions to ask a cloud MES vendor
Use these to separate cloud MES platforms that are genuinely ready for regulated manufacturing from those that are still catching up.
Architecture and operations
Is this a true SaaS platform or on-premise software hosted on a cloud VM?
How often do you release updates, and how much notice do customers get?
Is there a sandbox environment for testing changes before they reach production?
How does the system behave on the shop floor if network connectivity drops?
Security and compliance
Where is our data hosted, and can you guarantee it stays in the United States?
Is everyone with access to production systems and customer data a U.S. person?
Can you provide FedRAMP Moderate equivalency documentation and a customer responsibility matrix?
What third-party audits do you hold, such as SOC 2 Type II?
How quickly will you notify us of a security incident?
Data and validation
What validation documentation do you provide with each release?
Can we export all of our records, including audit trails, in a standard format?
What APIs are available for integrating with our ERP, PLM, and quality systems?
The bottom line
Moving your MES to the cloud changes who runs the infrastructure, how quickly the system evolves, and how easily your teams and sites can work together. It doesn't change your responsibility for good processes, sound change control, or compliance.
For aerospace and defense manufacturers, cloud MES software is no longer a compliance gamble. With U.S.-only hosting, U.S.-person access controls, and documented alignment to NIST SP 800-171, a cloud MES can hold ITAR and CUI data with controls that often exceed what a small on-premise IT team can maintain. The work is in asking the right questions up front and choosing a vendor built for the regulated world from the start.
Frequently Asked Questions (FAQ)
-
Cloud MES software is a manufacturing execution system hosted and maintained by the vendor or a cloud provider and accessed through a browser. It manages work instructions, as-built records, quality, and traceability without requiring on-site servers.
-
It can be. Look for U.S.-only hosting, U.S.-person-only vendor access, FedRAMP Moderate equivalency, and clear mapping to NIST SP 800-171 controls.
-
Yes, if the environment prevents unauthorized foreign-person access. Most manufacturers achieve this with a U.S. government cloud region and U.S.-person access controls, rather than relying on the ITAR end-to-end encryption carve-out. Confirm your approach with your export compliance team.
-
Not much. Phase 2's third-party certification mandate is suspended, but DFARS 252.204-7012 and the NIST SP 800-171 requirements still apply. Your cloud MES still needs to support those controls.
-
It depends on scope, but cloud MES deployments typically reach first production use in weeks rather than months, because there's no hardware to install. Migrating procedures and integrating with ERP or PLM usually drive the timeline.
-
You shouldn't. Your contract should confirm you own your data and can export it, including audit trails, at any time.
