CMMC Level 2 program leadership
One thread from the first drawing map to your assessment.
Precision machine shops
CMMC for the shop that machines to someone else's print.
Your prime's drawing becomes a CAM file, a G-code program, a CMM routine and a paper traveler. Capital Cyber helps build-to-print CNC shops work out which of those carry CUI and what NIST SP 800-171 asks of each. Capital Cyber, based in Leesburg, Virginia, leads CMMC Level 2 work for precision machine shops and works on-site across Northern Virginia.
For milling and turning job shops supplying defense primes and higher-tier subcontractors.
Where does CUI show up?
CUI AND FCIMarked drawings and 3D models
PDFs, STEP files and native CAD models from the prime, often carrying a distribution statement B through F or a CUI banner. DFARS 252.204-7012 names engineering drawings and specifications as examples of technical information, so a restrictive statement is a strong sign you hold controlled technical information.
CAM projects and G-code
A toolpath built from a controlled model carries the same geometry. The CAM project, the posted program and the setup sheet made from a CUI drawing are usually handled as CUI too.
Programs on the machine
Programs stored in control memory, in a DNC folder, or on the USB stick that carried them from the programming station to the machine.
Inspection records
CMM programs, first article inspection reports and ballooned drawings record the controlled dimensions and tolerances of the part.
Paper prints and travelers
The printed drawing that rides with the job through saw, mill, deburr and inspection is CUI on paper. Media protection in NIST SP 800-171 covers paper as well as disks.
Quote packages and purchase orders
RFQ packages often arrive with the technical data package attached before you have won the job. The purchase order and its delivery schedule are FCI.
Where does scoping get hard?
SCOPINGCNC controls as Specialized Assets
Machine controls running old embedded Windows that the builder will not let you patch fit the Operational Technology category in 32 CFR 170.19. They are listed, drawn on the network diagram and described in the SSP, not tested against every requirement, but only if the SSP explains how you manage them.
The DNC network
A DNC server that pushes programs to the floor stores CUI. If it sits on the same flat network as the office PCs, the line between the machines and the CUI environment blurs.
Shared operator logins
One Windows account on the programming or inspection PC shared by every shift runs into IA.L2-3.5.1 and AU.L2-3.3.2, because the log cannot say which person opened or changed the program.
USB sticks to the controls
Carrying programs to a machine by thumb drive is removable media under MP.L2-3.8.7, and a stick in a toolbox with no named owner runs into MP.L2-3.8.8.
The estimating inbox
The prime's drawing package usually lands first in a shared sales or estimating mailbox, which pulls that mailbox and everyone who reads it into scope.
CMMs and their exports
A CMM with its own PC can be treated as Test Equipment, a Specialized Asset. The inspection reports exported from it to the quality server are ordinary CUI on an ordinary system.
Does a job shop really hold CUI if the prime only sends a drawing?
Usually, yes. DFARS 252.204-7012 defines controlled technical information as technical information with military or space application that is subject to controls on access and dissemination, the kind that would carry distribution statements B through F, and lists engineering drawings, specifications and process sheets as examples. If the drawing arrives with one of those statements, or the purchase order carries the clause, treat it as CUI until the prime tells you otherwise in writing.
Missing marks do not settle it. If a print looks controlled and carries no marking, ask the prime and keep the reply. Whether a document is CUI is the government's and the prime's call, not something to guess at on the floor.
What does an assessor look at on the shop floor?
They follow the drawing: from the email or supplier portal to the estimator, to the CAM seat, to the post-processor, to the control, to the CMM, to the cabinet where old travelers are kept. Each stop raises the same questions. Who can open it here, is that person signed in as themselves, and what happens to it when the job ships?
Expect to be asked to log in at the programming station, to show which account pushed a program to a machine, to explain how a USB stick is issued, and to say where yesterday's printed drawings are now.
What do you do with CNC controls that cannot be patched?
Stop trying to make them look like office PCs. Under the CMMC scoping rule, Operational Technology and Test Equipment can be treated as Specialized Assets: listed in the asset inventory, shown on the network diagram, and described in the SSP with the risk-based way you manage them. The assessor reviews that description rather than testing the control against all 110 requirements.
The description has to be true. A separate machine network with a firewall between it and the office, no internet path from the controls, one defined way programs reach them, and restricted access to program memory make the story credible. A control on the same switch as the estimator's laptop does not.
Why is the shared shop login the hardest fix?
Because it is habit, not technology. A programming station or inspection PC with one account everybody knows is how many shops have always run. NIST SP 800-171 asks that each action be traced to one person, so that account has to become named logins, with multifactor authentication where the requirement calls for it.
The fix that sticks keeps sign-in fast for an operator between cycles: per-person accounts with a quick sign-in method, or a remote desktop where the floor PC only shows the screen and never holds the file. A sign-in sheet beside a shared account does not fix it, because the system log still shows one user.
Which clauses will you see?
DFARS AND FARDFARS 252.204-7012
Implement NIST SP 800-171 on every system that handles the prime's controlled drawings and models, report a cyber incident to DoD within 72 hours of discovery, and include the clause in subcontracts with any outside machinist or processor who will receive covered defense information.
DFARS 252.204-7019 and 252.204-7020
A current NIST SP 800-171 assessment summary score posted in SPRS, not more than 3 years old unless the solicitation says otherwise, and access for DoD if it chooses to run a Medium or High assessment of your shop.
DFARS 252.204-7021
Names the CMMC level the contract requires and asks you to flow the correct level to any subcontract that will involve processing, storing or transmitting FCI or CUI, with an affirmation of continuous compliance by an affirming official.
FAR 52.204-21
Basic safeguards for the purchase order and other FCI on your systems, including limiting physical access to equipment and sanitizing media before disposal. It flows to subcontractors whose systems will hold FCI.
ITAR, 22 CFR 120.33
If the part is a defense article, its blueprints and drawings are technical data under ITAR, which brings export controls on who may receive them in addition to the CUI safeguarding rules.
What can we do for precision machine shops?
SCOPED PER CLIENTSystem Security Plan, policy and POA&M
An SSP that describes your shop floor, not a template's.
CUI enclave design
Keep the drawing in the enclave and the floor PC out.
Supply Chain Risk Management
Your prime asks about you. You have to ask about your outside processors.
Fractional CISO
Someone who owns security when a new machine lands on the floor.
CMMC Level 2 gap assessment
Where most of these start: all 110 requirements scored against your environment. $5,000, one time, for most small and mid-sized contractors.
Or let us run it inside an environment we provide: CMMC In A Container™.
Where do we work on-site?
Capital Cyber Compliance is based in Leesburg, Virginia, and works on-site across Northern Virginia, including:
Questions we hear
Is a CNC machine in scope for CMMC?
It depends on how it is used and documented. A CNC control that stores programs built from controlled models can be treated as a Specialized Asset under the CMMC scoping rule, as Operational Technology. It is listed in the asset inventory, drawn on the network diagram and described in your System Security Plan, and the assessor reviews that description rather than testing it against every requirement.
Are G-code programs CUI?
They can be. A program posted from a controlled model carries the same part geometry and dimensions, so CAM files, posted programs and setup sheets made from CUI drawings are usually handled as CUI themselves. If you are unsure about a specific program, ask the prime in writing and keep the answer.
Can operators share one login on the shop floor?
Not on a system that handles CUI. NIST SP 800-171 requires that users be uniquely identified and that their actions can be traced to them, which a shared account cannot do. Named accounts with a fast sign-in, or a remote desktop session per person, are the usual fixes.
Do printed drawings and travelers count?
Yes. Media protection in NIST SP 800-171 covers paper as well as digital media. Printed drawings need to be controlled while they are on the floor, stored securely when they are not, and destroyed properly when the job is done.
Where does a machine shop start?
By mapping where the prime's drawing goes: how it arrives, who opens it, which PCs and machines it touches, and where the paper ends up. That map sets the scope. Capital Cyber's gap assessment starts there and scores all 110 NIST SP 800-171 requirements against what it finds, $5,000 one time for most small and mid-sized contractors.
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Ready to see where you actually stand?
A CMMC Level 2 gap assessment scores all 110 requirements against your real environment. Tell us what you make or deliver and we will tell you where to start.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.