Supply Chain Risk Management for engineering and design firms
Your contract drafters touch the same drawings you do.
Engineering firms often send controlled design work to independent drafters, analysis shops or partner firms. We work out what flows down to each of them and support them through their own self-assessments. Capital Cyber, based in Leesburg, Virginia, provides Supply Chain Risk Management for engineering and design firms and works on-site across Northern Virginia.
For engineering firms that subcontract design or analysis, and the designers who answer to them.
Why is subcontracted design a supply chain question?
Because the drawing leaves your environment. DFARS 252.204-7012 requires the clause in subcontracts where performance will involve covered defense information, and puts the decision on you as the higher-tier contractor: does the information the sub needs keep its identity as covered defense information.
If a contract drafter works from a controlled drawing on their own laptop, that laptop is now part of the program, whether or not anyone wrote it down.
Can you avoid flowing data to a design sub at all?
Sometimes. A sub who works inside your environment, on your accounts and your systems, under your processes, may not need their own assessment. A sub who receives files on their own equipment does. Deciding which model each sub uses is often the cheapest supply chain control you have.
What should you ask a design subcontractor?
Whether they have a current NIST SP 800-171 assessment posted in SPRS, what systems the drawings will sit on, how files move between you, whether their cloud storage meets the FedRAMP Moderate equivalent requirement, and who reports an incident and how fast. Questions with evidence behind the answers, not a checkbox.
What if you are the sub, not the prime?
Then a prime is asking you the same questions. Reading the clauses in your subcontract and knowing what each one asks of you lets you answer accurately the first time.
Which requirements does this touch?
NIST SP 800-171AC.L1-3.1.20
External Connections
Connections to a sub's systems, or a sub's access to yours, are verified and controlled. Evidence is a list of external systems that touch controlled drawings and the agreement behind each.
AC.L2-3.1.3
Control CUI Flow
Controlled files reach a design sub only through an approved path. Evidence is the CUI flow diagram showing the sub as an endpoint.
IR.L2-3.6.2
Incident Reporting
The sub knows how to report a cyber incident to DoD and passes the incident report number up to you. Evidence is the flow-down language and the sub's procedure.
What do you receive?
SCOPED PER CLIENTA read of your prime contract clauses
The DFARS and CMMC clauses in your prime contracts and what each requires of you.
A map of your design subs
Which drafters, analysis shops and partner firms the obligations flow down to, and at what level.
Self-assessment support
Support for your design subs through their own NIST SP 800-171 self-assessments, so their answers can be relied on.
Flow-down language and supplier questions
For your own subcontracts, ready for your counsel to review.
What does this service not include?
Scoped to CMMC and NIST SP 800-171 flow-down. Broader supply chain risk, such as counterfeit parts or foreign ownership, is outside it. Each subcontractor's self-assessment and affirmation remain its own; we support them, we do not sign them. Contract and requirements work, not legal advice, and not a substitute for your own counsel reviewing language before it goes into a signed agreement.
The full service, for any industry: Supply Chain Risk Management. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Does every subcontract designer need their own assessment?
Not always. A designer working entirely inside an engineering firm's own environment, under its processes, may not. A designer who receives controlled drawings on their own equipment is handling covered defense information and the clauses flow down to them.
Who decides if a drawing we send a sub is still CUI?
DFARS 252.204-7012 places that determination on the contractor passing the information down, with the option to consult the contracting officer if needed. Write the decision down for each sub.
Do you sign our subcontractors' self-assessments?
No. Each subcontractor's self-assessment and affirmation remain its own. We support them through it so the answers an engineering firm receives can be relied on.
Is the flow-down language you provide legal advice?
No. We provide flow-down language and supplier questions for your counsel to review before anything goes into a signed subcontract. We are not a law firm.
More for engineering and design firms
Supply Chain Risk Management in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.