CMMC Level 2 program leadership for precision machine shops
One thread from the first drawing map to your assessment.
Capital Cyber runs the CMMC Level 2 program for precision machine shops, sequencing the work around the production schedule. We prepare you for whichever assessment your contract requires; we do not perform it. Capital Cyber, based in Leesburg, Virginia, provides CMMC Level 2 program leadership for precision machine shops and works on-site across Northern Virginia.
For CNC shop owners who want one party sequencing the work instead of several vendors each doing a piece.
Why does a machine shop need the work sequenced, not just listed?
A gap list for a job shop mixes things that take an afternoon, like a session lock on the estimating PC, with things that change how the floor runs, like splitting the shared programming login or moving the DNC server onto its own network. Worked in the wrong order, the hard items are still open when the assessment arrives.
Program leadership puts the boundary decision first, because whether the controls are documented as Specialized Assets on a separate network decides how much of the rest applies to them.
What gets decided first?
Where CUI is allowed to live. For most shops that is a short list: the inbox or portal the prime uses, the CAM and programming stations, the DNC store, the quality server and the drawing cabinet. Everything else, the front office, the tool crib, the saw, is argued out of scope in writing.
How does remediation fit around production?
Changes to the machine network get scheduled like a maintenance window, not dropped on a Monday morning. A change to the programming stations is tried on one seat before the rest.
Evidence collection starts early, because an assessor wants to see that logging, reviews and media records have been running, not that they were switched on the week before.
What does the evidence package look like for a shop?
It is organized control by control: the screen showing named accounts on the programming PC, the issue log for the sticks that go to the machines, the network diagram showing the machine network, the visitor log from the front desk, the destruction record for scrapped prints. Each item points at the requirement it proves.
What happens at the assessment itself?
We support you through whichever assessment your contract requires, whether that is a self-assessment you post to SPRS or a certification assessment run by a C3PAO. We are not an Authorized C3PAO and we do not perform the assessment. Whether we attend a third-party assessment is between you and the C3PAO.
Which requirements does this touch?
NIST SP 800-171CA.L2-3.12.1
Security Control Assessment
Checking periodically that controls still work, on the floor as well as in the office: are operators still signing in as themselves, is the machine network still separated. Evidence is a dated assessment record with its findings.
CA.L2-3.12.2
Operational Plan of Action
Every open item, from the shared inspection PC login to an unlogged program stick, written down with what closing it takes and who owns it. Evidence is the current plan and its history.
AU.L2-3.3.1
System Auditing
Logs on the CAM workstations, DNC server and file share, kept so you can investigate who opened or moved a program. Evidence is the logging configuration and a sample of retained records.
SC.L2-3.13.1
Boundary Protection
The firewall between the office network, the machine network and the internet, with rules that match the network diagram. Evidence is the rule set and the diagram side by side.
What do you receive?
SCOPED PER CLIENTA scoped CUI boundary
Written down for your shop: which inboxes, CAM stations, DNC store, quality systems and drawing storage hold CUI, and which areas stay out.
A remediation sequence
In the order that protects your calendar, with evidence collection started early.
An evidence package
Organized control by control for your assessment, from account screens to media logs.
Support through the assessment
Through whichever assessment your contract requires. We prepare you; we do not perform it.
A start from a gap assessment
The program starts with a gap assessment, or from the findings of a recent one if you already have it.
What does this service not include?
We prepare you for the assessment; we do not perform it, and a self-assessment does not produce a certification. Whether we attend a C3PAO assessment is between you and the C3PAO, and we are not an Authorized C3PAO ourselves.
The full service, for any industry: CMMC Level 2 program leadership. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Does program leadership include the assessment itself?
No. Capital Cyber prepares a machine shop for whichever assessment its contract requires and supports it through that assessment. We do not perform the assessment, a self-assessment does not produce a certification, and we are not an Authorized C3PAO.
How are changes to CNC machines handled during the program?
Changes to the machine network are scheduled with the shop, sequenced after the boundary decision, and tried on one machine or station before the rest. Many controls are documented as Specialized Assets rather than reconfigured, so much of the work happens around the machines rather than on them.
Do we need a gap assessment first?
The program starts with one. If your shop already has a recent gap assessment, the program starts from its findings instead of repeating it.
How is this different from buying a gap assessment on its own?
A gap assessment scores where your shop stands, once. Program leadership is everything after it: setting the boundary around drawings, programs and machines, sequencing the fixes, and preparing the evidence for your assessment.
More for precision machine shops
CMMC Level 2 program leadership in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.