Supply Chain Risk Management for precision machine shops
Your prime asks about you. You have to ask about your outside processors.
Capital Cyber maps which of a machine shop's suppliers touch controlled drawings, reads the clauses in the contracts above you, and drafts the questions and flow-down language for your purchase orders, for your counsel to review. Capital Cyber, based in Leesburg, Virginia, provides Supply Chain Risk Management for precision machine shops and works on-site across Northern Virginia.
For machine shops in the middle of the chain: answering a prime and sending work out to others.
Why is a machine shop on both sides of the flow-down?
Your prime flows DFARS 252.204-7012 down to you because you receive its controlled drawings. The same clause asks you to include it in subcontracts with anyone you send covered defense information to: the outside shop that takes your overflow, the grinder, the heat treater or the plater who receives a print with the part.
Each of those suppliers is a decision. Do they need the drawing, or only the part and a routing?
Do outside processors really need the drawing?
Often they need less than they get. A plater may need the specification callout and the masking areas, not the full model. Sending a sanitized drawing or only the process requirement can keep a supplier out of CUI, which changes what flows down to them. That is a question for the prime and your counsel, and worth asking before the next purchase order goes out.
What should we ask our suppliers?
Whether they have a current NIST SP 800-171 assessment posted in SPRS when the work requires one, how they receive and store your drawings, who on their floor can open them, and how they report an incident. A ticked box on a supplier survey is not an answer you can rely on.
What does your prime want from you?
Straight answers about your own status: your SPRS score and its date, your System Security Plan, and whether your outside processors receive CUI. A shop that cannot say which suppliers see its prime's drawings is a harder supplier to keep.
Which requirements does this touch?
NIST SP 800-171AC.L2-3.1.20
External Connections
A prime's supplier portal, a customer file-share link and an outside machinist's systems are external systems. Evidence is a list of approved external systems and the terms for using each.
AC.L2-3.1.3
Control CUI Flow
Drawings go to a supplier only when someone has approved that supplier to receive them. Evidence is a record of which suppliers were sent which documents, and who approved it.
MP.L2-3.8.5
Media Accountability
Printed drawings that travel with parts to a heat treater or plater are accounted for while outside your controlled area. Evidence is the shipping record of what paper went with the job and whether it came back or was destroyed.
IR.L2-3.6.2
Incident Reporting
Suppliers who receive covered defense information report incidents to DoD and give you the incident report number, as DFARS 252.204-7012 asks of subcontractors. Evidence is that language in the supplier agreement and your own reporting procedure.
What do you receive?
SCOPED PER CLIENTA read of the clauses above you
The DFARS and CMMC clauses in your prime contracts, and what each one requires of your shop.
A supplier map
Which outside machinists, processors and suppliers those obligations flow down to, and at what level.
Self-assessment support for your suppliers
Support for your suppliers through their own NIST SP 800-171 self-assessments, so the answers you receive can be relied on.
Purchase order language and supplier questions
Flow-down language and supplier questions for your own subcontracts and purchase orders, ready for your counsel to review.
A start from your contracts
With the prime contracts you hold today and a list of the suppliers who touch that work.
What does this service not include?
Scoped to CMMC and NIST SP 800-171 flow-down. Broader supply chain risk, such as counterfeit parts or foreign ownership, is outside it. Each subcontractor's self-assessment and affirmation remain its own; we support them, we do not sign them. Contract and requirements work, not legal advice, and not a substitute for your own counsel reviewing language before it goes into a signed agreement.
The full service, for any industry: Supply Chain Risk Management. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Does our heat treater need CMMC?
It depends on what you send them. DFARS 252.204-7021 asks you to flow the CMMC requirement into subcontracts that will involve processing, storing or transmitting FCI or CUI. A processor that receives only the part and a process callout may be in a different position from one that receives the full controlled drawing. Decide it per supplier, with your counsel.
Do our suppliers have to match our level?
Not automatically. A supplier's required level depends on the FCI or CUI it actually handles on that work, not on copying the level in your own contract.
Will Capital Cyber sign our suppliers' self-assessments?
No. Each supplier's self-assessment and affirmation remain its own. We support suppliers through their assessments; we do not sign them.
Is this legal advice?
No. It is contract and requirements work. Any flow-down language we draft is for your counsel to review before it goes into a signed purchase order or agreement.
More for precision machine shops
Supply Chain Risk Management in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.