CMMC Level 2 program leadership
Get the design office ready, in the right order.
Engineering and design firms
CMMC for the firm whose product is the drawing.
Your deliverable is controlled technical information: the model, the drawing set, the analysis. We help engineering and design firms work out where it lives and get it documented for whichever assessment your contract requires. Capital Cyber, based in Leesburg, Virginia, leads CMMC Level 2 work for engineering and design firms and works on-site across Northern Virginia.
For engineering and design firms doing DoD design, analysis or drafting, directly or for a prime.
Where does CUI show up?
CUI AND FCICAD models and assemblies
Native part and assembly files, neutral exports such as STEP, and the derived files you hand to a prime. If the source drawing carries a restrictive distribution statement, the model behind it is controlled technical information too.
Drawings with distribution statements
Title blocks marked with Distribution Statement B through F. The DFARS definition of controlled technical information points straight at those statements, so a restrictive letter on the sheet is the clearest signal you hold CUI.
Analysis results and reports
FEA and CFD runs, loads and stress reports, thermal studies, trade studies. The DFARS clause lists studies, analyses, data sets and technical reports as examples of technical information.
Technical data packages
The drawing tree, parts lists, specifications and process notes a prime sends you to work from, and the package you send back at each design review.
Contract and program correspondence
Statements of work, review comments, schedules and the email threads around them. Most of this is Federal Contract Information at minimum, and some of it quotes the technical data directly.
Where does scoping get hard?
SCOPINGThe PDM or PLM vault is the easy part
Everyone knows the vault holds CUI. The hard part is every local working copy, the scratch folder on each workstation, and the exports that leave the vault for email.
CAD license servers
A license server rarely holds a drawing, but it usually sits on the same network as the engineering workstations. You either show it is separated or put it in scope and document why.
Cloud CAD and cloud file sync
If a cloud service stores, processes or transmits covered defense information, DFARS 252.204-7012 requires the provider to meet security requirements equivalent to the FedRAMP Moderate baseline. Check the service and the tier before the first model goes up.
Engineers working from home
A laptop with a local copy of the assembly is a CUI Asset at the kitchen table. A laptop that only reaches a virtual desktop, configured so nothing but keyboard, video and mouse crosses, can be kept out of scope.
Plotters and large-format printers
They print the drawing and many keep the job on an internal drive. That drive is media containing CUI when the printer is serviced or replaced.
Subcontract designers
A contract drafter working on their own machine is part of your CUI flow. Either the work happens inside your environment or the clause and the questions go to them.
How do you know your drawings are CUI?
Start with the sheets the prime sends you. DFARS 252.204-7012 defines controlled technical information as technical information with military or space application that is subject to controls on access, use, release or dissemination, and says it would meet the criteria for distribution statements B through F under DoD Instruction 5230.24. Distribution Statement A means approved for public release.
Then look at what you produce. Covered defense information includes information developed by or for the contractor in support of performing the contract, so the model you build from a controlled drawing and the analysis you run on it are usually in the same category as the input.
Where does an engineering firm's CUI actually live?
In more places than the vault. A typical flow: the drawing package arrives by email or a prime's portal, lands in a downloads folder, gets checked into PDM, gets checked out to a workstation, gets exported to PDF for a review, gets plotted for a redline session, and goes back to the prime as a revised package.
Every step in that chain is a system the assessment will ask about. Writing the chain down, one arrow at a time, is usually the first useful thing a firm does, because it shows which machines and accounts are really in scope and which can be argued out.
What does an assessor look at in a design office?
Who can open the vault and who can change permissions on it. Whether each CAD action can be traced to one person, which fails on a shared drafting login. Whether exported PDFs carry the same markings as the source drawing. Whether the laptop that left the building last night was encrypted with validated cryptography.
They will also ask to see the plotter, the file transfer method you use with the prime, and how a departing engineer's access and local copies were dealt with.
Can a remote engineering team stay small in scope?
Yes, if the work happens on a virtual desktop rather than on the laptop. The CMMC scoping rules treat an endpoint running a virtual desktop client as out of scope when it is configured to allow nothing beyond keyboard, video and mouse to pass. CAD on a virtual desktop has real performance questions, so the design has to be tested with your actual models before you commit to it.
Which clauses will you see?
DFARS AND FARDFARS 252.204-7012
Protect covered defense information, including your CAD models and controlled drawings, with NIST SP 800-171, report cyber incidents within 72 hours, use cloud services that meet FedRAMP Moderate equivalent requirements, and flow the clause to any subcontract designer who handles the data.
DFARS 252.204-7019 and 252.204-7020
Have a current NIST SP 800-171 assessment for the systems that hold the design data, posted in SPRS, before award, and give DoD access if it decides to run a Medium or High assessment.
DFARS 252.204-7021
Meet the CMMC status the contract names, keep it current, and flow it to subcontractors who will process, store or transmit FCI or CUI.
FAR 52.204-21
The basic safeguards for Federal Contract Information on any system that holds it, including the contract paperwork around a design job that carries no CUI.
What can we do for engineering and design firms?
SCOPED PER CLIENTSystem Security Plan, policy and POA&M
An SSP that describes how your drawings actually move.
CUI enclave design
Put the controlled design work in one place.
Supply Chain Risk Management
Your contract drafters touch the same drawings you do.
Fractional CISO
Someone owns security while the engineers engineer.
CMMC Level 2 gap assessment
Where most of these start: all 110 requirements scored against your environment. $5,000, one time, for most small and mid-sized contractors.
Or let us run it inside an environment we provide: CMMC In A Container™.
Where do we work on-site?
Capital Cyber Compliance is based in Leesburg, Virginia, and works on-site across Northern Virginia, including:
Questions we hear
Is every drawing a prime sends an engineering firm CUI?
No. A drawing marked Distribution Statement A is approved for public release. Drawings marked B through F, or marked CUI, or identified as controlled in the contract, are the ones that bring NIST SP 800-171 into play. If a sheet carries no marking and the contract is silent, ask the prime in writing.
Does a model we create from a controlled drawing count as CUI?
Usually yes. Covered defense information under DFARS 252.204-7012 includes information developed by or for the contractor in support of performing the contract, so a model built from a controlled drawing generally carries the same controls. Confirm with the prime or the contracting officer where it is unclear.
Can we keep using a cloud CAD or PDM service?
Only if the provider meets security requirements equivalent to the FedRAMP Moderate baseline and the incident reporting terms in DFARS 252.204-7012, for the tier you are actually on. Many commercial tiers are not set up for that, so check before uploading controlled files.
Are our engineering workstations in scope even if they only run CAD?
If they open, edit, render or store controlled models, they are CUI Assets and are assessed against all 110 requirements. That includes the local cache and temporary files CAD software writes on its own.
Do you work on-site at engineering offices?
Yes. Capital Cyber Compliance is based in Leesburg, Virginia, and works on-site across Northern Virginia. We are not an Authorized C3PAO and do not perform certification assessments.
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Ready to see where you actually stand?
A CMMC Level 2 gap assessment scores all 110 requirements against your real environment. Tell us what you make or deliver and we will tell you where to start.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.