CMMC Level 2 program leadership for aerospace parts suppliers
One plan from the prime's print to your assessment.
We run the Level 2 program for aerospace suppliers: scope the path a drawing takes through your shop, sequence the remediation around production, and build the evidence package for whichever assessment your contract requires. Capital Cyber, based in Leesburg, Virginia, provides CMMC Level 2 program leadership for aerospace parts suppliers and works on-site across Northern Virginia.
For aerospace suppliers with a Level 2 requirement and nobody running the program from start to finish.
Why does sequencing matter more in an aerospace shop?
Your machines, your inspection room and your first article schedule cannot stop for a security project. Changing the network the controllers sit on, or the login on the programming PC, touches delivery. The order of the work has to respect that.
So the program starts with the boundary, because every later fix depends on knowing which computers hold the prime's data. Identity and logging come next, and evidence collection starts early, because an assessor wants to see records with history behind them.
What gets scoped first?
The drawing path: portal or email, engineering storage, CAM, the controller, the inspection room, the traveler, any outside processor, and shipping. Each hop gets a named system and a named group of people.
That written boundary is the first deliverable, and it decides which remediation is worth paying for.
How does export control change the program?
If your data is ITAR or EAR controlled, the access design has to match what your export compliance owner has decided about foreign persons. We build that decision into the boundary and the user list. We do not make export determinations ourselves.
What does the evidence package look like for a parts supplier?
It is organized control by control. For an aerospace shop that typically means the authorized user list for the data package folder, logs that tie a file change to a named person, the procedure for checking prints for markings on receipt, the record of who holds the controller cabinet keys, and the flow-down records for outside processors.
Where does program leadership stop?
We prepare you for the assessment. We do not perform it, a self-assessment does not produce a certification, and we are not an Authorized C3PAO. Whether we attend a C3PAO assessment is between you and the C3PAO.
Which requirements does this touch?
NIST SP 800-171AC.L2-3.1.3
Control CUI Flow
The drawing should only move along paths you approved: portal to engineering storage to CAM to controller. Evidence is the CUI flow diagram and a configuration that blocks the paths it does not show, such as personal email or an unmanaged USB stick.
AU.L2-3.3.2
User Accountability
On a programming PC three machinists share, an assessor asks which person changed a program. Evidence is named accounts and logs that answer that without a sign-in sheet.
MP.L2-3.8.4
Media Markings
Travelers, setup sheets and FAI reports made from a marked drawing need matching marks. Evidence is a marked sample and the procedure your floor follows.
CA.L2-3.12.2
Plan of Action
Open items are tracked with an owner and a date, not left in a meeting note. Evidence is a current POA&M that matches what the assessor finds on the floor.
What do you receive?
SCOPED PER CLIENTA gap assessment to start
The program starts with a gap assessment, $5,000 one time for most small and mid-sized contractors, or from the findings of a recent one you already have.
A written CUI boundary
Which systems, work areas and people handle the prime's drawings, specs and inspection data, written down.
A remediation sequence
The fixes in the order that protects your production calendar, with evidence collection started early.
An evidence package
Organized control by control for your assessment, using records from your own shop.
Support through the assessment
Support through whichever assessment your contract requires.
What does this service not include?
We prepare you for the assessment; we do not perform it, and a self-assessment does not produce a certification. Whether we attend a C3PAO assessment is between you and the C3PAO, and we are not an Authorized C3PAO ourselves.
The full service, for any industry: CMMC Level 2 program leadership. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Do you run the CMMC assessment for aerospace suppliers?
No. We prepare you for whichever assessment your contract requires, self-assessment or certification. We are not an Authorized C3PAO and we do not perform the certification assessment.
How does program leadership start for an aerospace shop?
With a gap assessment, or from a recent one you already have. Its findings set the boundary and the order of the remediation work.
Will the program interrupt production or first articles?
The remediation sequence is built around your production calendar so changes to controllers, networks and logins are planned rather than sprung on the floor. Some changes still need machine downtime, and those get scheduled with you.
Do you decide who can see our ITAR data?
No. Your export compliance owner makes that call. Program leadership builds that decision into the boundary, the authorized user list and the SSP.
More for aerospace parts suppliers
CMMC Level 2 program leadership in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.