System Security Plan, policy and POA&M for aerospace parts suppliers
An SSP that describes your shop, not a template.
We write the System Security Plan, the policy set and the POA&M for aerospace suppliers, describing the controllers, inspection equipment and prime portals you actually run. Capital Cyber, based in Leesburg, Virginia, provides System Security Plan, policy and POA&M for aerospace parts suppliers and works on-site across Northern Virginia.
For aerospace suppliers who know their gaps and need the documents an assessor reads.
What does an aerospace supplier's SSP have to describe?
Where the prime's data lives and moves: the portal downloads, the engineering storage, the CAM and programming PCs, the controllers, the CMM, the quality system, and any transfer to an outside processor. For each requirement it says how you meet it and who is responsible.
A template written for an office does not mention a controller or a CMM, and that gap is the first thing an assessor notices in a machine shop.
How do you write up CNC controllers and CMMs?
Usually as Specialized Assets. The scoping rule asks for three things: list them in the asset inventory, describe in the SSP how you manage them with your own risk-based policies, and show them on the network diagram. The assessor reviews that description rather than testing the controller against every requirement.
So the write-up has to be specific: which network segment they sit on, who can load programs, how programs are transferred, and how memory is cleared before a machine is sold.
Which policies read differently for a parts supplier?
Media protection covers printed travelers, drawings at the machine, and FAI packages in the quality office. Physical protection covers the inspection room and the programming area. Personnel and access policies point to your export compliance procedure for foreign persons, so the two documents agree.
What goes on the POA&M?
Every requirement not yet met, what closing it takes, and who owns it. In an aerospace shop that often includes the shared login on the programming PC, drawings printed without matching marks, or an outside processor whose flow-down was never documented.
Which requirements does this touch?
NIST SP 800-171CA.L2-3.12.4
System Security Plan
The SSP describes the boundary, including the controllers and CMMs as Specialized Assets and the portal download path. Evidence is a plan whose diagrams match what the assessor sees on the floor.
CM.L2-3.4.1
System Baselining
Baseline configurations and an inventory that includes the programming PCs, CMM computers and controllers. Evidence is an inventory that names each machine and its software version.
MP.L2-3.8.1
Media Protection
Paper counts as media. Evidence is a procedure for where printed drawings and travelers are kept, and a floor that follows it.
PE.L1-3.10.1
Limit Physical Access
The inspection room and programming area are limited to authorized people. Evidence is an access list and a door that enforces it.
CA.L2-3.12.2
Plan of Action
A POA&M that names each open requirement, the fix and the owner. Evidence is a document someone updates, not one dated the day it was written.
What do you receive?
SCOPED PER CLIENTA System Security Plan for your shop
Written against your environment as it actually is, controllers, CMMs and prime portals included.
The policy set behind it
Each policy mapped to the requirements it satisfies.
A POA&M
Every open requirement, what closing it requires, and who owns it.
Documents you keep
Plain documents your own team can maintain when machines, software or customers change.
Written from your current state
From a recent gap assessment's findings, or starting with one if you do not have it.
What does this service not include?
Documentation, not remediation: we write the plan and the policies, we do not implement the controls they describe or collect your evidence under this engagement. We are not an Authorized C3PAO.
The full service, for any industry: System Security Plan, policy and POA&M. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Can our SSP treat CNC controllers as Specialized Assets?
Often, yes. The rule asks you to list them in the asset inventory, describe in the SSP how you manage them, and show them on the network diagram. The assessor then reviews the SSP description for those assets.
Can our AS9100 quality manual stand in for security policies?
No. It is a quality document. Your security policies need to address the NIST SP 800-171 requirements directly, although they can live in the same document control system.
Do you implement the controls the SSP describes?
Not under this service. We write the plan, the policies and the POA&M. Implementing the controls and collecting evidence is separate work.
What if we have no gap assessment yet?
We start with one. A plan written before the gaps are known describes an environment nobody has checked.
More for aerospace parts suppliers
System Security Plan, policy and POA&M in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.