Supply Chain Risk Management for aerospace parts suppliers
Your heat treater sees the drawing too.
We map which outside processors, casting and forging sources and tooling vendors receive your prime's data, what the DFARS and CMMC clauses ask of each, and help you answer your own prime's questions accurately. Capital Cyber, based in Leesburg, Virginia, provides Supply Chain Risk Management for aerospace parts suppliers and works on-site across Northern Virginia.
For aerospace suppliers who are a subcontractor to a prime and a buyer to their own processors.
Which of your suppliers touch CUI?
Start with every place a drawing, model or spec leaves your building: a heat treater or plater that gets the spec with the parts, a casting or forging source working from the model, an NDT lab, a fixture or tooling vendor. Each gets listed with what it receives and why.
What does DFARS 252.204-7012 make you put in a subcontract?
The clause goes into subcontracts whose performance will involve covered defense information, without alteration except to identify the parties. You are also asked to decide whether the information a subcontractor needs keeps its identity as covered defense information, and to consult the contracting officer if necessary.
Can you send a process spec without sending CUI?
Sometimes. A processor may only need a spec number and the parameters, not the drawing or the model. Deciding that with your prime, and keeping the decision on file, can take a supplier out of the flow-down question entirely.
If the supplier is outside the United States, sending export-controlled data is an export, which is a question for your export compliance owner before it is a CMMC one.
How do you answer your own prime's questions?
Primes ask for your SPRS posting, your affirmation, and how you protect their data. A straight, accurate answer is what the prime is asking for. We help you prepare it from your own SSP, so it matches what an assessor would find.
What is outside this service?
Counterfeit part avoidance and foreign ownership reviews are separate work. Each subcontractor's self-assessment and affirmation remain its own. Flow-down language is for your counsel to review before it goes into a signed agreement.
Which requirements does this touch?
NIST SP 800-171AC.L1-3.1.20
External Connections
A processor's portal or a casting source's file share is an external system. Evidence is a list of the external systems you exchange data with and the terms that apply to each.
SC.L2-3.13.8
Data in Transit
Specs and models sent to a supplier are encrypted in transit. Evidence is the approved transfer method and a record that it was used.
MP.L2-3.8.5
Media Accountability
Printed drawings that travel with parts to a processor stay accounted for. Evidence is a shipping log of controlled paperwork and how it comes back or is destroyed.
RA.L2-3.11.1
Risk Assessments
The supplier map feeds your risk assessment. Evidence is a written assessment that names the suppliers who receive CUI and the risk each carries.
What do you receive?
SCOPED PER CLIENTA read of your prime contracts
The DFARS and CMMC clauses in your purchase orders, and what each one requires of you.
A supplier map
Which processors, sources and vendors those obligations flow down to, and at what level.
Subcontractor self-assessment support
Support for your processors through their own NIST SP 800-171 self-assessments, so the answers you receive can be relied on.
Flow-down language and supplier questions
Language for your purchase orders and questions for your suppliers, ready for your counsel to review.
A start from what you hold
The prime contracts you hold today and a list of the suppliers who touch that work.
What does this service not include?
Scoped to CMMC and NIST SP 800-171 flow-down. Broader supply chain risk, such as counterfeit parts or foreign ownership, is outside it. Each subcontractor's self-assessment and affirmation remain its own; we support them, we do not sign them. Contract and requirements work, not legal advice, and not a substitute for your own counsel reviewing language before it goes into a signed agreement.
The full service, for any industry: Supply Chain Risk Management. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Does our heat treater need to meet NIST SP 800-171?
If its work involves covered defense information, the DFARS 252.204-7012 clause and its NIST SP 800-171 requirement flow down to it. If it can do the job from a spec number and parameters alone, that may change. Decide with your prime and keep the decision on file.
Do our suppliers need the same CMMC level as us?
Not automatically. A supplier's required level depends on the FCI or CUI it actually handles on that subcontract.
Will you sign our suppliers' self-assessments?
No. Each supplier's self-assessment and affirmation remain its own. We support them through the work.
Is this legal advice on our purchase order terms?
No. It is contract and requirements work. Any flow-down language is for your counsel to review before it goes into a signed agreement.
More for aerospace parts suppliers
Supply Chain Risk Management in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.