System Security Plan, policy and POA&M for precision machine shops
An SSP that describes your shop floor, not a template's.
Capital Cyber writes the System Security Plan, the policy set and the POA&M for precision machine shops, against the machines, programs and paperwork you actually have. Capital Cyber, based in Leesburg, Virginia, provides System Security Plan, policy and POA&M for precision machine shops and works on-site across Northern Virginia.
For machine shops that know their gaps and need the documents an assessor reads.
Why do template SSPs fall apart in a machine shop?
Templates are written for offices. They describe laptops, a file server and a cloud mailbox, and say nothing about a DNC server, a CMM PC, a control holding programs, or a drawing that rides on a cart through five work centers. The first walk of the floor shows the distance between that plan and the shop.
How does the SSP describe machines that cannot be fully secured?
Each CNC control, CMM or other piece of shop equipment treated as a Specialized Asset gets its own entry: what it is, what it stores, which network it sits on, how programs reach it, who can change them, and which risk-based measures stand in for the requirements it cannot meet. That entry is what the assessor reviews in place of testing the machine.
What policies does a shop actually need?
The same families every contractor has, written in the shop's terms. The media policy covers the USB sticks issued for program transfer and the printed drawings in the traveler pouch. The access policy says who may sign in at a programming station and how. The maintenance policy covers the machine tool technician who plugs a laptop into a control.
Each policy is mapped to the requirements it satisfies, so an assessor can go from a requirement to the rule your shop follows.
What goes on the POA&M?
Every requirement not yet met, with what closing it takes and who owns it. In a shop the items are concrete: split the shared inspection login, move the DNC server behind the machine firewall, add a sign-out log for program sticks. A POA&M that names the lead programmer and the IT contractor as owners is one people can work from.
Why does the plan need a gap assessment first?
A plan written before the gaps are known describes a shop nobody has checked. If you have a recent gap assessment, we write from its findings. If you do not, we start with one.
Which requirements does this touch?
NIST SP 800-171CA.L2-3.12.4
System Security Plan
The SSP draws the boundary around the CAM stations, DNC store, quality server and drawing storage, lists the Specialized Assets on the floor, and says how each requirement is met. Evidence is the plan itself, matching the asset inventory and network diagram.
CA.L2-3.12.2
Operational Plan of Action
Open items with owners and closing steps, like the shared inspection PC login. Evidence is a POA&M that names each one and tracks it to closure.
MP.L2-3.8.4
Media Markings
Printed drawings and program media carry the CUI marking and distribution statement the prime's drawing arrived with. Evidence is a written procedure for checking markings at receipt and marked samples on the floor.
MP.L2-3.8.7
Removable Media
The policy defines which USB devices may carry programs to the controls and who issues them. Evidence is the policy, the device list and the issue log.
MA.L2-3.7.6
Maintenance Personnel
A visiting machine tool service technician without CUI access is supervised while working on equipment that holds programs. Evidence is the procedure and the visit record.
What do you receive?
SCOPED PER CLIENTA System Security Plan for your shop
Written against your environment as it actually is: CAM stations, DNC, quality systems, floor PCs and controls.
The policy set behind it
Each policy mapped to the controls it satisfies, in your shop's terms.
A POA&M
Naming every open control, what closing it requires, and who owns it.
Documents you keep
Written so your own team can maintain them when a machine is added or a process changes.
A start from your current state
From a recent gap assessment's findings, or from a new gap assessment if there is none.
What does this service not include?
Documentation, not remediation: we write the plan and the policies, we do not implement the controls they describe or collect your evidence under this engagement. We are not an Authorized C3PAO.
The full service, for any industry: System Security Plan, policy and POA&M. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Can an SSP describe CNC controls we cannot patch?
Yes. The CMMC scoping rule allows Operational Technology and Test Equipment to be treated as Specialized Assets. The System Security Plan describes each one and the risk-based measures used to manage it, such as a separate machine network and controlled program transfer, and the assessor reviews that description.
Does Capital Cyber implement the controls in the plan?
Not under this engagement. This is documentation: the System Security Plan, the policies and the POA&M. Implementing the controls they describe and collecting your evidence is separate work.
Do we need an SSP before posting a score to SPRS?
Yes. A Basic Assessment under DFARS 252.204-7020 is based on your review of your System Security Plan, the SPRS submission asks for details of that plan, and requirement CA.L2-3.12.4 itself calls for one. The plan comes before the score.
How do the documents stay current when we add a machine?
They are written so your own team can maintain them. Adding a control means adding its asset inventory entry, placing it on the network diagram and describing in the System Security Plan how it is managed.
More for precision machine shops
System Security Plan, policy and POA&M in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.