CMMC Level 2 program leadership
One plan from the prime's print to your assessment.
Aerospace parts suppliers
CMMC Level 2 for suppliers who build to a prime's print.
When a defense aerospace prime sends you drawings, process specs or a technical data package, the CUI rules follow that data through your programming station, your inspection room and the outside processors you send parts to. We help you scope that path and document it. Capital Cyber, based in Leesburg, Virginia, leads CMMC Level 2 work for aerospace parts suppliers and works on-site across Northern Virginia.
For machine shops, foundries, forge shops, carbon fiber layup shops, assemblers and repair shops that supply defense aerospace primes.
Where does CUI show up?
CUI AND FCIDrawings, models and the technical data package
The part drawing, the 3D model and the data package attached to the purchase order. Controlled technical information is the kind that would carry a distribution statement B through F, and it often arrives with a CUI banner and an export warning on the same sheet.
The prime's process specifications
Heat treat, plating, welding, nondestructive testing and layup and cure specs the prime controls. A process spec can reveal more about a part than the drawing does, so it gets the same handling.
First article inspection reports and CMM data
An FAI report records every characteristic against the drawing, and CMM programs and results carry the controlled dimensions. Information you develop to perform the contract can fall inside the DFARS 252.204-7012 definition of covered defense information, so these records belong in the scope conversation.
Files pulled from a prime's supplier portal
A portal download lands in the Downloads folder of whichever computer did the pulling. That folder is where your CUI path starts, whether anyone planned it or not.
Export-controlled technical data
Much defense aerospace data is also controlled under the ITAR or the EAR. The CUI Registry lists Export Controlled as its own category, so export-controlled data you receive on a DoD contract usually sits inside your CUI scope as well.
Federal Contract Information on the order
Even with no controlled drawing, the non-public details of a defense order, such as quantities, schedules and part numbers, can be FCI under FAR 52.204-21.
Where does scoping get hard?
SCOPINGThe inspection room
The CMM, the vision system and the computers that run them hold programs and results built from controlled dimensions. Whether each one is treated as test equipment or as a CUI Asset is a decision you document and defend in the SSP.
CNC controllers and the programming PC
Controllers that store programs are usually Specialized Assets. The PC that posts the program and sends it to the machine is a CUI Asset, and a shared shop login on it is one of the first findings an assessor writes.
Outside processors
Platers, heat treaters, NDT labs and anodizers often receive the drawing or the process spec with the parts. Each one is a flow-down question you answer before the parts leave.
Foreign persons with access
A foreign national engineer, a visiting customer, or an offshore IT provider who can open the file share is an export control question first. It still has to be answered in your access design.
The quality system and ERP
An electronic quality system or ERP that attaches drawings to travelers and nonconformance reports puts CUI in a system nobody thought of as engineering.
Where does CUI enter an aerospace supplier?
Usually in three places: the prime's supplier portal, an email from a buyer or supplier quality engineer, and paper that arrives with a kit or a repair job. From there it moves to the engineering PC, the CAM software, the controller, the inspection room, the traveler on the floor, and sometimes out the door to a processor.
Mapping that path, one hop at a time, is the scoping work. It usually shows that a defined set of computers and work areas handle the prime's data, which is what you want to protect and what an assessor will test.
How does ITAR fit with CMMC?
They are separate regimes. The ITAR, 22 CFR parts 120 to 130, is a State Department regulation about who may receive defense articles and technical data. CMMC and NIST SP 800-171 are about how you safeguard the information on your systems. Meeting one does not satisfy the other.
They meet in your access design. Under the ITAR, releasing technical data to a foreign person inside the United States is a deemed export, and so is giving that person access information that lets them view unencrypted technical data. Your export compliance owner decides who may see the data. Your SSP shows how your systems enforce that decision.
Does AS9100 count toward CMMC?
AS9100 is a quality management standard, not a security standard, and an assessor scores the 110 NIST SP 800-171 requirements on their own. Do not count on your quality certificate as evidence for any of them.
Your quality system still matters here, for a different reason: document control, FAI packages and calibration records often hold controlled dimensions, so the quality system is frequently inside the CUI boundary.
What about the special processes you send out?
If a heat treater or plater needs the prime's spec or drawing to do the work, the data leaves your boundary with the parts. DFARS 252.204-7012 asks you to decide whether the information a subcontractor needs keeps its identity as covered defense information, and if it does, the clause goes into that subcontract.
Sometimes the processor only needs the spec number and the parameters, not the drawing. That is a decision for you and your prime, made before the shipment and kept on file.
Which clauses will you see?
DFARS AND FARDFARS 252.204-7012
Safeguard covered defense information on your systems using NIST SP 800-171, report cyber incidents to DoD within 72 hours of discovery, and put the clause into subcontracts with outside processors whose work involves covered defense information.
DFARS 252.204-7019
To be considered for award, have a current NIST SP 800-171 assessment, not more than 3 years old, for each covered system relevant to the offer.
DFARS 252.204-7020
Give DoD access for Medium or High assessments, and do not award a subcontract subject to NIST SP 800-171 to a supplier without a current Basic Assessment.
DFARS 252.204-7021
Where your contract carries it: hold the CMMC status the contract names, affirm continuous compliance every year in SPRS, and flow the clause to suppliers that will handle FCI or CUI.
FAR 52.204-21
The 15 basic safeguarding requirements for any system that holds Federal Contract Information, including the office systems that hold your defense orders.
What can we do for aerospace parts suppliers?
SCOPED PER CLIENTSystem Security Plan, policy and POA&M
An SSP that describes your shop, not a template.
CUI enclave design
Draw the line around the drawings first.
Supply Chain Risk Management
Your heat treater sees the drawing too.
Fractional CISO
Someone who owns the program while you ship parts.
CMMC Level 2 gap assessment
Where most of these start: all 110 requirements scored against your environment. $5,000, one time, for most small and mid-sized contractors.
Or let us run it inside an environment we provide: CMMC In A Container™.
Where do we work on-site?
Capital Cyber Compliance is based in Leesburg, Virginia, and works on-site across Northern Virginia, including:
Questions we hear
Our drawings say ITAR. Does that make them CUI?
Export-controlled data received under a DoD contract is usually treated as CUI, because the CUI Registry lists Export Controlled as a category. The ITAR obligations still apply separately. Whether a specific document is CUI is for the prime and the government to determine, so ask in writing when the marking is unclear.
We are AS9100 certified. Are we most of the way there?
Not for CMMC purposes. AS9100 is a quality management standard. Your document control habits help, but the 110 NIST SP 800-171 requirements are scored on their own, with their own evidence.
Is our CMM in scope?
It can be treated as a Specialized Asset, test equipment, if you document it in the asset inventory, describe how you manage it in the SSP, and show it on the network diagram. The computer that stores CMM programs and results needs its own decision, written down.
Do our outside processors need to meet NIST SP 800-171?
If their work involves covered defense information, the DFARS 252.204-7012 clause flows to them and so does the NIST SP 800-171 requirement. If they can do the job from a spec number and parameters alone, the question may go away. Decide with your prime before the parts ship.
Can a foreign national employee work on our defense jobs?
That is an export control question for your export compliance owner and, if needed, counsel. What we do is make sure your access design and SSP reflect the decision, so systems only let the people who are authorized reach the data.
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Ready to see where you actually stand?
A CMMC Level 2 gap assessment scores all 110 requirements against your real environment. Tell us what you make or deliver and we will tell you where to start.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.