CUI enclave design for aerospace parts suppliers
Draw the line around the drawings first.
We design the CUI boundary for aerospace suppliers on Microsoft GCC High and Azure Virtual Desktop: where drawings, specs and inspection data live, who reaches them, and how that is evidenced. Design and documentation only. Capital Cyber, based in Leesburg, Virginia, provides CUI enclave design for aerospace parts suppliers and works on-site across Northern Virginia.
For aerospace suppliers building or reshaping their own CUI environment.
What goes inside an aerospace supplier's enclave?
The places the prime's data has to be: the portal download location, the data package storage, the CAD and CAM sessions, the FAI and CMM results, and the mailbox used with the prime. The front office, accounting and most of the floor can often stay outside it.
Why can't the CAM station always be a thin client?
An endpoint that only carries keyboard, video and mouse to a virtual desktop can be out of scope. But if the posted program has to reach the controller by USB or a DNC link, the file lands somewhere local, and that somewhere is in scope.
The design has to name that transfer path, the device that makes it, and how it is controlled, rather than pretending the thin client covers it.
How do foreign persons fit the access design?
Under the ITAR, giving a foreign person access information that lets them view unencrypted technical data counts as a release. So the access design names who may reach export-controlled data, and the enclave enforces it with accounts and groups. The decision about who is authorized stays with your export compliance owner.
What about the inspection room and the floor?
Controllers and CMMs are usually documented as Specialized Assets on their own network segment, with the rules for moving programs to them written down. The physical site diagram shows where prints and inspection data sit.
What do you get at the end?
A written boundary, an access design, and the scoping documentation that goes with them. We do not hold your CUI and we do not operate the environment under this engagement.
Which requirements does this touch?
NIST SP 800-171SC.L1-3.13.1
Boundary Protection
The boundary between the enclave, the office network and the machine segment is monitored and controlled. Evidence is the network boundary diagram and firewall rules that match it.
AC.L2-3.1.3
Control CUI Flow
Data moves from portal to enclave to controller along approved paths only. Evidence is the CUI flow diagram and settings that block other routes.
AC.L1-3.1.1
Authorized Access Control
Only authorized users reach the data package. Evidence is the authorized user list, matched to the groups in the tenant, including any export restrictions your compliance owner set.
MP.L2-3.8.7
Removable Media
If programs reach controllers by USB, the use of that media is controlled. Evidence is the written transfer procedure and device settings that enforce it.
SC.L2-3.13.11
CUI Encryption
FIPS-validated cryptography protects CUI in the enclave. Evidence is the configuration and the validation records for the products used.
What do you receive?
SCOPED PER CLIENTA written boundary
Which systems handle drawings, specs and inspection data, and which stay out of scope and why.
An access design
Who reaches CUI, from where, and how that access is evidenced.
Scoping documentation
The CUI flow diagram and network boundary diagram, written against your shop.
A start from where CUI enters
Which contracts bring it in, which people handle it, and which systems it touches today.
What does this service not include?
This is design and documentation only. We do not hold your CUI, we do not operate the environment under this engagement, and we are not an Authorized C3PAO.
The full service, for any industry: CUI enclave design. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Will you host our drawings in the enclave?
No. This is design and documentation only. We do not hold your CUI and we do not operate the environment under this engagement.
Can our shop floor PCs be out of scope with Azure Virtual Desktop?
A PC that only sends keyboard, video and mouse to the virtual desktop can be. If CUI has to land on it, for example to reach a controller, it is in scope and the design accounts for that.
Does the enclave design decide who can see ITAR data?
No. Your export compliance owner decides who is authorized. The design enforces that decision with accounts and groups and documents it.
Where does enclave design start?
With where CUI enters your business today: which contracts bring it in, which people handle it, and which systems it touches.
More for aerospace parts suppliers
CUI enclave design in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.