CMMC Level 2 program leadership
From data package intake to your assessment, one plan.
Defense electronics manufacturers
CMMC Level 2 for boards, harnesses and box builds.
Gerber files, schematics, BOMs and test procedures from a defense customer are often controlled technical information. We help you find where they sit on your line, from the data package to the test station, and document how they are protected. Capital Cyber, based in Leesburg, Virginia, leads CMMC Level 2 work for defense electronics manufacturers and works on-site across Northern Virginia.
For PCB assembly, cable and wire harness, box build and contract electronics manufacturers with defense customers.
Where does CUI show up?
CUI AND FCIThe customer data package
Gerber and drill files, fabrication and assembly drawings, the BOM and the approved vendor list. When it would carry a distribution statement B through F, it is controlled technical information.
Schematics and netlists
A schematic says how the product works, not only how to build it. It often gets tighter handling from the customer than the assembly drawing.
Test procedures and test data
Acceptance test procedures, fixture designs, and the serialized results you produce. Results you generate to perform the contract can fall inside the definition of covered defense information.
Firmware images and programming files
The DFARS definition of technical information includes computer software executable code and source code, so a firmware image you load onto a board can be controlled data in its own right.
Machine programs built from customer data
Pick-and-place, solder paste inspection, AOI and X-ray programs are generated from the customer's CAD data and carry its placement and layout details.
Federal Contract Information on the order
Even with no controlled data, the non-public details of a defense order, such as quantities, schedules and part numbers, can be FCI under FAR 52.204-21.
Where does scoping get hard?
SCOPINGLine equipment
Pick-and-place machines, AOI, SPI, X-ray and reflow ovens are operational technology. Functional testers, in-circuit and flying probe testers are test equipment. Both can be Specialized Assets, documented rather than tested against every requirement.
The CAM translation station
The computer where Gerbers and centroid files become machine programs is a CUI Asset. So is the share the programs are pushed from.
Firmware programming stations
A bench PC that holds firmware images and flashes boards is a CUI Asset when the images are controlled, even if it sits on the line.
Sending the BOM out for quote
Distributors and brokers quoting your BOM receive part of the data package. Whether that BOM is controlled decides whether quoting is a flow-down question.
File exchange with the customer
Data packages arrive by email, portal or file transfer, and test data goes back the same way. Each route is a boundary crossing you have to describe.
Where does CUI sit on an electronics line?
Follow one job. The data package arrives and is stored. An engineer reviews the BOM and the drawings. The CAM station turns the CAD data into programs for the printer, the placement machines and inspection. Firmware is loaded at a programming bench. The finished assembly is tested, and the results go back to the customer.
Every computer that holds the package, the programs, the firmware or the results along that path is a scoping decision. The machines themselves usually are too, but a different kind.
Are the test stations in scope?
Test equipment is one of the Specialized Asset types named in the CMMC scoping rule. You list it in the asset inventory, describe in the SSP how you manage it with your own risk-based policies, and show it on the network diagram. The assessor reviews that description.
That only holds up if the stations are actually managed: a known configuration, a controlled way to load test programs, and no casual internet browsing from the tester PC.
Is firmware CUI?
It can be. The DFARS definition of technical information covers executable code and source code, and controlled technical information is technical information with military or space application that is subject to controls on its release. If the customer marks the firmware or the contract identifies it, treat the image and the programming station accordingly. If it is unclear, ask the customer in writing.
What happens when you send a BOM out for quote?
A BOM with manufacturer part numbers may or may not be controlled. If it is, the distributor or broker receiving it is part of your CUI path. One option is a stripped list with only the part numbers needed for pricing. Decide which applies with your customer, and keep the answer.
Which clauses will you see?
DFARS AND FARDFARS 252.204-7012
Safeguard covered defense information, including controlled data packages and firmware, using NIST SP 800-171, report cyber incidents within 72 hours of discovery, and flow the clause to suppliers whose work involves that information.
DFARS 252.204-7019
To be considered for award, have a current NIST SP 800-171 assessment, not more than 3 years old, for each covered system relevant to the offer.
DFARS 252.204-7020
Give DoD access for Medium or High assessments, and do not award a subcontract subject to NIST SP 800-171, such as to a harness or board fabrication supplier, without a current Basic Assessment.
DFARS 252.204-7021
Where your contract carries it: hold the CMMC status the contract names, only process FCI or CUI on systems with that status, and affirm continuous compliance every year in SPRS.
FAR 52.204-21
The 15 basic safeguarding requirements for any system holding Federal Contract Information, including the ERP that holds your defense orders.
What can we do for defense electronics manufacturers?
SCOPED PER CLIENTSystem Security Plan, policy and POA&M
An SSP that names every station on your line.
CUI enclave design
Keep the data package in one place.
Supply Chain Risk Management
Your BOM goes further than your building.
Fractional CISO
Someone who owns security as your line changes.
CMMC Level 2 gap assessment
Where most of these start: all 110 requirements scored against your environment. $5,000, one time, for most small and mid-sized contractors.
Or let us run it inside an environment we provide: CMMC In A Container™.
Where do we work on-site?
Capital Cyber Compliance is based in Leesburg, Virginia, and works on-site across Northern Virginia, including:
Questions we hear
Are Gerber files CUI?
They are when the customer controls them, for example with a distribution statement B through F, a CUI marking, or a contract that identifies them. Unmarked files are not automatically uncontrolled, so check the contract and ask the customer in writing.
Do our pick-and-place and AOI machines need to meet all 110 requirements?
Usually they are documented as Specialized Assets: listed in the asset inventory, described in the SSP, and shown on the network diagram. The assessor reviews that description. The computer that generates their programs is a CUI Asset and is assessed in full.
Is our firmware programming bench in scope?
If it holds controlled firmware images, yes. DFARS defines technical information to include executable code and source code.
Our customer sends data packages through their own portal. Is that enough?
The portal covers the customer's side. Once the package is downloaded, it is on your systems, and your boundary starts at the download location.
Do component distributors need NIST SP 800-171?
Only if they receive covered defense information to do their part. A stripped quote list may avoid that. Decide with your customer and keep the decision on file.
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Ready to see where you actually stand?
A CMMC Level 2 gap assessment scores all 110 requirements against your real environment. Tell us what you make or deliver and we will tell you where to start.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.