CMMC Level 2 program leadership
One plan for the office, the floor and the paper in between.
Sheet metal and fabrication shops
CMMC for the shop where the drawing travels on a cart.
In a fab shop the prime's drawing becomes a flat pattern, a nest, a brake program, a weld map and a route sheet that visits every work center. Capital Cyber helps laser, punch, brake and weld shops work out where that CUI goes and how to keep it controlled. Capital Cyber, based in Leesburg, Virginia, leads CMMC Level 2 work for sheet metal and fabrication shops and works on-site across Northern Virginia.
For laser, punch, press brake, welding and assembly shops building to a defense prime's drawings.
Where does CUI show up?
CUI AND FCIDrawings and models from the prime
Assembly and detail drawings, weld callouts and 3D models, often carrying a distribution statement B through F. DFARS 252.204-7012 names engineering drawings, specifications and process sheets as examples of technical information.
DXF flat patterns
The unfolded part your programmer exports from the model holds the same profile and hole pattern, and is usually handled as CUI when the source model is.
Nests and machine programs
Nesting software lays controlled parts onto a sheet and posts programs for the laser or punch. Press brake programs carry the bend sequence and flange geometry.
Weld maps and joint details
Drawings showing joint geometry for a controlled assembly, and any inspection record or work instruction that copies those details from the print.
Route sheets and travelers
Paper route sheets with a print attached move through shear, laser, brake, weld, paint and shipping, and sit at each work center while the job waits.
Marked parts and remnants
Etched part numbers and the skeleton left after cutting can show a controlled profile. Whether a finished part or remnant needs controlled handling is a question to put to the prime.
Where does scoping get hard?
SCOPINGThe nesting and programming station
The nesting PC holds every controlled part waiting for a sheet. It is a CUI Asset, and so is the shared folder the posted programs are dropped into.
Lasers, punches and brakes
Fiber laser, turret punch and press brake controls fit the Operational Technology category of Specialized Assets, documented in the SSP and on the network diagram, provided the SSP explains how they are managed.
Paper at every work center
When the route sheet carries the print, every work center it visits holds CUI on paper. That pulls the whole floor into physical protection unless drawings are kept to defined areas.
Shared shop terminals
A floor kiosk where operators pull up drawings under one login runs into IA.L2-3.5.1 and AU.L2-3.3.2, because nobody can say which person viewed or printed what.
Outside processing
Parts going out for paint, powder coat, plating or heat treat often travel with a print. Each processor who receives covered defense information is a flow-down question.
Visitors on an open floor
Source inspectors, delivery drivers and machine service technicians walk an open floor. Escort and visitor monitoring under PE.L2-3.10.3 applies wherever CUI is in view.
Why does a fab shop have a bigger physical problem than a machine shop?
Because the drawing moves. In a fab shop the print usually rides with the job on a cart or in a route sheet pouch, from the shear to the laser to the brake to the weld bay to paint and shipping, and waits at each stop. Every stop is a place where CUI sits on paper in view of whoever walks past.
That puts physical protection and media protection in front of most of the work. Limiting physical access, escorting visitors, keeping access logs, and storing printed drawings securely when nobody is working from them apply wherever those prints are.
Can you keep paper drawings off most of the floor?
Often, by changing what travels with the job. A route sheet that carries the job number and the operation steps, but no controlled detail, is not CUI. The operator views the drawing on a controlled screen at the work center instead of reading it off a clipboard.
Where an operator does need the print at the brake or the weld table, define those areas, control who enters them, and file or destroy the copies when the job closes.
Where does CUI sit in the programming office?
In the nesting software's part library, the DXF exports, the posted laser and punch programs, the press brake offline programming files, and the shared folder the machines pull from. A nest can combine parts from several jobs on one sheet, so a single file may hold controlled and uncontrolled parts together, and it is simplest to handle it at the stricter standard.
What about parts and paperwork that leave the building?
Finished parts go out for paint, powder coat, plating or heat treat and come back. If a print travels with them, that processor has received covered defense information, and DFARS 252.204-7012 asks you to include the clause in that subcontract.
Skeletons and remnants from controlled parts are worth a written question to the prime about whether they need controlled disposal.
Which clauses will you see?
DFARS AND FARDFARS 252.204-7012
Implement NIST SP 800-171 on the nesting, programming and drawing systems, report a cyber incident to DoD within 72 hours of discovery, and include the clause in subcontracts with outside processors who receive covered defense information.
DFARS 252.204-7019 and 252.204-7020
Have a current NIST SP 800-171 assessment summary score posted in SPRS before award, not more than 3 years old unless the solicitation sets a shorter period, and give DoD access to your facility, systems and people if it runs a Medium or High assessment.
DFARS 252.204-7021
Names the CMMC level the contract requires and asks you to flow the correct level into subcontracts that involve FCI or CUI, including finishing and heat treat suppliers who receive it.
FAR 52.204-21
Basic safeguards for FCI, several of them physical: limit physical access to equipment and operating environments, escort visitors, keep physical access logs, and control keys and badges. Media holding FCI is sanitized or destroyed before disposal.
ITAR, 22 CFR 120.33
Blueprints and drawings for a defense article are technical data under ITAR, so export controls on who may receive them reach an open shop floor as well as the office.
What can we do for sheet metal and fabrication shops?
SCOPED PER CLIENTSystem Security Plan, policy and POA&M
A plan that follows the route sheet through the shop.
CUI enclave design
Put the print on a controlled screen, not a clipboard.
Supply Chain Risk Management
Every part that goes out for finish takes a question with it.
Fractional CISO
Someone who owns the rules for prints, visitors and machines.
CMMC Level 2 gap assessment
Where most of these start: all 110 requirements scored against your environment. $5,000, one time, for most small and mid-sized contractors.
Or let us run it inside an environment we provide: CMMC In A Container™.
Where do we work on-site?
Capital Cyber Compliance is based in Leesburg, Virginia, and works on-site across Northern Virginia, including:
Questions we hear
Are DXF files and nests CUI?
They can be. A flat pattern exported from a controlled model carries the same profile and hole pattern, and a nest holding that part carries it too. Most shops handle DXF exports, nests and posted programs made from CUI drawings as CUI. If you are unsure about a specific file, ask the prime in writing.
Do route sheets and travelers need to be locked up?
If they carry controlled drawings or details, they need to be physically controlled and securely stored, because NIST SP 800-171 treats paper as media. Many shops change what travels with the job so the route sheet carries no controlled detail and the drawing is viewed on a controlled screen.
Is a fiber laser or press brake in scope?
Usually as a Specialized Asset. Machine controls fit the Operational Technology category in the CMMC scoping rule, so they are listed in the asset inventory, drawn on the network diagram and described in the System Security Plan, and the assessor reviews that description rather than testing each requirement against the machine.
Do our paint and plating vendors need to meet CMMC?
It depends on what you send them. If a processor receives covered defense information, the flow-down clauses apply to that subcontract. If they receive only the parts and a process callout, the answer may be different. Decide it per supplier, with your counsel.
Where does a fab shop start?
By following one job from drawing intake to shipping and noting every screen, file and piece of paper that carries the drawing. That map sets the scope. Capital Cyber's gap assessment starts there and scores all 110 NIST SP 800-171 requirements, $5,000 one time for most small and mid-sized contractors.
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Ready to see where you actually stand?
A CMMC Level 2 gap assessment scores all 110 requirements against your real environment. Tell us what you make or deliver and we will tell you where to start.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.