CMMC Level 2 program leadership for engineering and design firms
Get the design office ready, in the right order.
We run the CMMC Level 2 program for engineering and design firms from first assessment through to whichever assessment your contract requires, without stopping billable design work to do it. Capital Cyber, based in Leesburg, Virginia, provides CMMC Level 2 program leadership for engineering and design firms and works on-site across Northern Virginia.
For engineering firms with a Level 2 requirement and no one free to run the program.
Why does sequencing matter so much in an engineering firm?
Because the systems that hold CUI are the ones your engineers bill from. Rebuilding the PDM permissions, moving CAD to a new environment or changing how files reach the prime all touch live projects. Done in the wrong order, the program costs you design hours twice.
We sequence remediation so the changes that close the most scope come first, such as deciding where the vault lives and how remote engineers reach it, and the changes that ride on those come after.
What gets settled first?
The boundary. Which workstations open controlled models, where the vault and its backups sit, whether the license server and plotter are in or out, and how drawings move between you and the prime. Until that is written down, every later decision is a guess about scope.
When should evidence collection start?
Early. Log reviews, access reviews on the vault, vulnerability scans and change records only count as evidence if there is history behind them. We start collecting as soon as each control is in place rather than in the weeks before the assessment.
What does the evidence package look like for a design firm?
Organized control by control: vault permission exports, the list of people authorized to handle controlled drawings, screenshots of encryption on engineering laptops, the file transfer configuration used with the prime, plotter disposal records, and the SSP sections that tie each one to the boundary.
Which requirements does this touch?
NIST SP 800-171AC.L2-3.1.3
Control CUI Flow
How a drawing package moves from the prime to the vault and back. Evidence is the CUI flow diagram plus the email or file transfer settings that stop controlled files going to personal accounts.
AU.L2-3.3.2
User Accountability
Every check-in, check-out and release in PDM traces to one named engineer. A shared drafting login fails this regardless of who sits at the desk.
SC.L2-3.13.11
CUI Encryption
FIPS-validated cryptography on laptops carrying models and on the transfer channel to the prime. Evidence is the validated module and the configuration that enforces it.
CA.L2-3.12.2
Plan of Action
Open items such as plotter drive sanitization or the remote engineer setup, tracked with owners and target dates so the program has a visible order.
What do you receive?
SCOPED PER CLIENTA written CUI boundary
Which workstations, servers, vaults and devices handle controlled drawings, written down.
A remediation sequence
In the order that protects your design schedule, with evidence collection started early.
An evidence package
Organized control by control for your assessment, drawn from your vault, workstations and transfer setup.
Support through the assessment
Preparation for whichever assessment your contract requires. We do not perform the assessment itself.
A gap assessment to start
The program starts with a gap assessment, or from the findings of a recent one if you have it.
What does this service not include?
We prepare you for the assessment; we do not perform it, and a self-assessment does not produce a certification. Whether we attend a C3PAO assessment is between you and the C3PAO, and we are not an Authorized C3PAO ourselves.
The full service, for any industry: CMMC Level 2 program leadership. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Will a CMMC program stop our engineers from working?
It should not. Remediation for an engineering firm is sequenced around live projects, so changes to the vault, workstations and file transfer are planned with the people who use them rather than switched on overnight.
Do you perform our CMMC assessment?
No. Program leadership prepares an engineering firm for whichever assessment its contract requires, self-assessment or certification. We are not an Authorized C3PAO and do not perform certification assessments.
How does a program for an engineering firm start?
With a gap assessment of the environment that holds your drawings and models, which is $5,000 one time for most small and mid-sized contractors. If you already have a recent gap assessment, the program starts from its findings.
What if our prime asks about our progress mid-program?
The POA&M and the evidence package give you a written, current answer: what is met, what is open, who owns it and when it is due. You answer the prime from documents rather than from memory.
More for engineering and design firms
CMMC Level 2 program leadership in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.