Supply Chain Risk Management for defense electronics manufacturers
Your BOM goes further than your building.
We map which board fabricators, harness subcontractors, distributors and test labs receive part of your customer's data package, what the DFARS and CMMC clauses ask of each, and help you answer your own customer's questions. Capital Cyber, based in Leesburg, Virginia, provides Supply Chain Risk Management for defense electronics manufacturers and works on-site across Northern Virginia.
For electronics manufacturers who buy from suppliers that see controlled data.
Who outside your company sees the data package?
The bare board fabricator gets the Gerbers and the fabrication drawing. A harness or cable subcontractor gets the drawing and wire list. Distributors and brokers see the BOM. An environmental or qualification test lab gets the test procedure. Each goes on the map with what it receives.
Does a bare board fabricator need the DFARS 252.204-7012 clause?
If its work involves covered defense information, the clause flows to it, and the Gerbers usually are that information when the customer controls them. You are also asked to decide whether the data a subcontractor needs keeps its identity as covered defense information.
If the fabricator is outside the United States, sending export-controlled data is an export. That is a question for your export compliance owner before the files go anywhere.
What should a distributor see?
Often only what pricing needs: manufacturer part numbers and quantities, not the assembly drawing or the full controlled BOM. Agreeing that with your customer can keep a distributor out of the flow-down question.
How do you answer your own customer's supplier survey?
Customers ask about your SPRS posting, your affirmation and how their data is protected. We help you answer from your own SSP, so the answer matches what an assessor would find.
What is outside this service?
Counterfeit part avoidance is a separate requirement and outside this service, as is foreign ownership review. Each supplier's self-assessment and affirmation remain its own. Flow-down language is for your counsel to review.
Which requirements does this touch?
NIST SP 800-171AC.L1-3.1.20
External Connections
A fabricator's upload portal is an external system. Evidence is a list of the external systems you send data packages to and the terms for each.
SC.L2-3.13.8
Data in Transit
Gerbers and drawings sent to a fabricator are encrypted in transit. Evidence is the approved method and a record that it was used.
MP.L2-3.8.5
Media Accountability
Paper drawings or media that travel to a harness subcontractor are accounted for. Evidence is a log of what went out and how it came back or was destroyed.
RA.L2-3.11.1
Risk Assessments
The supplier map feeds your risk assessment. Evidence is a written assessment naming suppliers who receive CUI and the risk each carries.
What do you receive?
SCOPED PER CLIENTA read of your contracts
The DFARS and CMMC clauses in your customer contracts, and what each one requires of you.
A supplier map
Which fabricators, subcontractors and suppliers those obligations flow down to, and at what level.
Subcontractor self-assessment support
Support for your suppliers through their own NIST SP 800-171 self-assessments, so the answers you receive can be relied on.
Flow-down language and supplier questions
Language for your purchase orders and questions for your suppliers, ready for your counsel to review.
A start from what you hold
The contracts you hold today and a list of the suppliers who touch that work.
What does this service not include?
Scoped to CMMC and NIST SP 800-171 flow-down. Broader supply chain risk, such as counterfeit parts or foreign ownership, is outside it. Each subcontractor's self-assessment and affirmation remain its own; we support them, we do not sign them. Contract and requirements work, not legal advice, and not a substitute for your own counsel reviewing language before it goes into a signed agreement.
The full service, for any industry: Supply Chain Risk Management. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Does our bare board fabricator need NIST SP 800-171?
If it receives covered defense information, such as controlled Gerbers, the DFARS 252.204-7012 clause and its NIST SP 800-171 requirement flow down to it.
Do component distributors need CMMC?
Only if they handle FCI or CUI on that order. Sending a pricing list without the controlled data may keep them out of it. Decide with your customer.
Do you check counterfeit parts?
No. Counterfeit part avoidance is a separate requirement and outside this service, which is scoped to CMMC and NIST SP 800-171 flow-down.
Is this legal advice?
No. It is contract and requirements work. Flow-down language is for your counsel to review before it goes into a signed agreement.
More for defense electronics manufacturers
Supply Chain Risk Management in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.