Fractional CISO for aerospace parts suppliers
Someone who owns the program while you ship parts.
A part-time security lead working inside your aerospace business: keeping the plan and POA&M current as machines, primes and people change, and speaking to the program when a prime asks. Capital Cyber, based in Leesburg, Virginia, provides fractional CISO services for aerospace parts suppliers and works on-site across Northern Virginia.
For aerospace suppliers with a Level 2 requirement and nobody whose job is the security program.
What changes in an aerospace shop after the score is posted?
A new five-axis machine arrives with its own PC. The CMM software is upgraded. A prime moves to a new supplier portal. You add an outside processor, or hire an engineer who is a foreign national. Each of these touches the SSP, and none of them waits for an annual review.
Who chairs the reviews?
The fractional CISO does, and the reviews are recorded: what was decided, by whom, and what changed. A typical agenda for a parts supplier covers new part numbers with controlled data, changes to controllers or inspection software, outside processor additions, and open POA&M items.
Who speaks when a prime's supplier quality team asks about security?
Primes ask suppliers how their data is protected. The fractional CISO can speak to the program, from the SSP and the review record, so the answer is accurate and consistent.
Who signs the annual affirmation?
A senior official of your company, not us. The fractional CISO's job is to keep the plan and the POA&M current, so the person signing is affirming facts rather than hoping.
Which requirements does this touch?
NIST SP 800-171CM.L2-3.4.3
System Change Management
A new machine PC or CMM software version goes through a tracked change. Evidence is a change log with approvals, matched to the inventory.
CM.L2-3.4.4
Security Impact Analysis
Before a controller is connected or a portal changes, someone asks what it does to the boundary. Evidence is a short written analysis attached to the change.
CA.L2-3.12.3
Security Control Monitoring
Controls are watched between assessments, not rediscovered at the next one. Evidence is the recorded reviews and what they found.
IR.L2-3.6.2
Incident Reporting
If a prime's data is exposed, someone knows the 72-hour reporting obligation and who files it. Evidence is an incident procedure with named roles and a tested exercise.
What do you receive?
SCOPED PER CLIENTA security lead inside the business
A part-time security and compliance lead working from inside your aerospace business.
Recorded reviews
What was decided, by whom, and what changed.
The plan and POA&M kept current
Updated as machines, software, primes and processors change, between assessments.
Someone to speak to the program
When a prime or an assessor asks about it.
A scoping call to start
To agree which reviews, how often, and what is already in place, with a gap assessment first if there is no recent one.
What does this service not include?
We are not an Authorized C3PAO and we do not certify anyone. A fractional CISO is a part-time role we provide, not a full-time hire, and what we can commit to is our own accountability rather than what a third party will do.
The full service, for any industry: Fractional CISO. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Is a fractional CISO a full-time hire for our shop?
No. It is a part-time role we provide. The shape and cadence are scoped per client.
Will the fractional CISO sign our annual affirmation?
No. A senior official of your company signs it. The fractional CISO keeps the plan current so that signature rests on facts.
Can the fractional CISO talk to our prime?
Yes, about the program, when the prime asks. We can commit to our own accountability, not to what the prime will decide.
What if we never had a gap assessment?
The role starts with one, so the plan it owns describes your shop as it actually is.
More for aerospace parts suppliers
Fractional CISO in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.