Fractional CISO for precision machine shops
Someone who owns security when a new machine lands on the floor.
Capital Cyber provides a part-time CISO for precision machine shops: owning the security and CMMC plan from inside the business, chairing the reviews, and speaking to the program when a prime asks. Capital Cyber, based in Leesburg, Virginia, provides fractional CISO services for precision machine shops and works on-site across Northern Virginia.
For machine shops with a CMMC requirement and nobody whose job it is to own the security program.
Why does a machine shop need someone owning this after the assessment?
Because the shop keeps changing. A new five-axis machine arrives with a builder's laptop and a remote support connection. A programmer leaves and still knows the password to the old DNC box. A new customer sends models through a portal nobody has used before. Each change touches the SSP, and the affirmation gets signed again every year.
What decisions does the role make?
The ones that sit between the floor and the office: whether a new control goes on the machine network or needs its own segment, whether a builder may connect remotely and under what supervision, whether a new customer portal is approved, and when a gap goes on the POA&M.
Each one is recorded in a review: what was decided, by whom, and what changed.
Who speaks to the prime?
When a prime's supplier quality or cybersecurity team asks about your program, the fractional CISO can speak to it. That means knowing the boundary, the score, the open items, and why each machine on the floor is treated the way it is.
How does it fit with the shop's own people?
Most shops have an IT contractor or office manager handling accounts and a lead programmer who knows the machines. The role does not replace them. It owns the plan they work to and keeps the SSP and POA&M current between assessments.
Which requirements does this touch?
NIST SP 800-171CM.L2-3.4.3
System Change Management
A new machine, a new CAM release or a new DNC path is tracked, reviewed and approved before it reaches the floor. Evidence is the change record.
CM.L2-3.4.4
Security Impact Analysis
Before a new control joins the network, someone asks what it changes about the boundary. Evidence is the recorded review and its decision.
MA.L2-3.7.5
Nonlocal Maintenance
When a machine builder or CAM vendor connects remotely to an in-scope system, the session uses multifactor authentication and is ended when the work is done. Evidence is the approval and the session record.
PS.L2-3.9.2
Personnel Actions
When a programmer or operator leaves, their accounts are disabled and any shared credentials they knew are changed. Evidence is the departure checklist with dates.
RA.L2-3.11.1
Risk Assessments
Periodic review of risk to the shop, including the machines that cannot be patched. Evidence is the dated risk assessment and the decisions it led to.
What do you receive?
SCOPED PER CLIENTA security and compliance lead
Working from inside your shop, part-time.
Recorded reviews
What was decided, by whom, and what changed, from new machines to new customer portals.
A current plan and POA&M
The plan and the POA&M kept current between assessments.
Someone to speak to the program
When a prime or an assessor asks about it.
A scoped start
A scoping call to agree the shape of the role. If there is no recent gap assessment, the role starts with one.
What does this service not include?
We are not an Authorized C3PAO and we do not certify anyone. A fractional CISO is a part-time role we provide, not a full-time hire, and what we can commit to is our own accountability rather than what a third party will do.
The full service, for any industry: Fractional CISO. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Is a fractional CISO a full-time hire?
No. It is a part-time role Capital Cyber provides, working from inside the business rather than advising from outside it. Engagement shape and cadence are scoped per client.
Does the fractional CISO replace our IT contractor?
No. Your IT contractor and lead programmer keep doing the hands-on work. The fractional CISO owns the security plan they work to, chairs the reviews, and keeps the System Security Plan and POA&M current.
Will the fractional CISO sign our annual affirmation?
No. The affirmation is made by an affirming official of your own company. The fractional CISO keeps the program current so that the person affirming knows what they are signing.
What if our shop has never had a gap assessment?
Then the role starts with one, so the plan is built on a scored picture of your shop rather than a guess about it.
More for precision machine shops
Fractional CISO in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.