CMMC Level 2 program leadership for sheet metal and fabrication shops
One plan for the office, the floor and the paper in between.
Capital Cyber runs the CMMC Level 2 program for sheet metal and fabrication shops, from mapping where prints travel to the evidence package for your assessment. We prepare you for whichever assessment your contract requires; we do not perform it. Capital Cyber, based in Leesburg, Virginia, provides CMMC Level 2 program leadership for sheet metal and fabrication shops and works on-site across Northern Virginia.
For fab shop owners who want one party running the whole program instead of several vendors each holding a piece.
Why does a fab shop's program start with paper?
Because paper decides how big the scope is. If full prints travel to every work center, the whole floor holds CUI and physical protection covers all of it. If the route sheet carries no controlled detail and prints stay in defined areas, the physically controlled area can shrink to the programming office and a few stations.
What order does the work go in?
Boundary first: where drawings may live, on screen and on paper. Then the items that need a history before they count as evidence, such as access logs for the controlled areas and records of print destruction. Then the accounts and settings on the nesting and programming systems.
How do floor rules actually change?
A rule about where prints may go only works if the lead at the brake follows it. The rule belongs in how a job is released and closed, so returning or destroying the print is a step on the route sheet, not a memo on the break room wall.
What goes in the evidence package?
Control by control: the physical access log for the programming office, the visitor log from the dock door, a sample of route sheets, the destruction record for scrapped prints, the account list for the nesting PC, and the network diagram showing the lasers and brakes on their own segment.
What happens at the assessment?
Your contract decides which assessment applies: a self-assessment posted to SPRS, or a certification assessment by a C3PAO. We support you through it. We are not an Authorized C3PAO and we do not perform the assessment.
Which requirements does this touch?
NIST SP 800-171PE.L2-3.10.1
Limit Physical Access
Physical access to the programming office, the print storage and any work center where prints are used is limited to authorized people. Evidence is the authorized list and the lock or badge configuration for those areas.
PE.L2-3.10.4
Physical Access Logs
Entry to those controlled areas is logged. Evidence is a badge system report, or a maintained log, covering a sample period.
MP.L2-3.8.3
Media Disposal
Prints and scrapped travelers are destroyed before disposal, not dropped in the recycling bin by the brake. Evidence is the destruction procedure and its records.
CA.L2-3.12.2
Operational Plan of Action
Open items such as full prints still riding to the weld bay, each with an owner and a closing step. Evidence is the current POA&M and its history.
What do you receive?
SCOPED PER CLIENTA scoped CUI boundary
Written down for your shop: which systems, work centers and storage areas hold CUI, on screen and on paper.
A remediation sequence
In the order that protects your calendar, with evidence collection such as access logs started early.
An evidence package
Organized control by control for your assessment.
Support through the assessment
Through whichever assessment your contract requires. We prepare you; we do not perform it.
A start from a gap assessment
The program starts with a gap assessment, or from the findings of a recent one if you already have it.
What does this service not include?
We prepare you for the assessment; we do not perform it, and a self-assessment does not produce a certification. Whether we attend a C3PAO assessment is between you and the C3PAO, and we are not an Authorized C3PAO ourselves.
The full service, for any industry: CMMC Level 2 program leadership. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Does program leadership cover physical security?
It covers scoping and sequencing it: which areas of the shop are controlled, which physical requirements apply to them, and what evidence they need. Your shop installs and runs the locks, badges and storage; the program sequences that work and organizes the evidence it produces.
Do we need a gap assessment first?
The program starts with one. If your shop already has a recent gap assessment, the program starts from its findings instead of repeating it.
Does Capital Cyber perform the assessment?
No. We prepare a fabrication shop for whichever assessment its contract requires and support it through that assessment. A self-assessment does not produce a certification, and we are not an Authorized C3PAO.
Why have one party run the program?
Because in a fab shop the decisions connect. Where prints may go changes the floor rules, the physical controls, the SSP and the evidence at once, and one party sequencing the work keeps those in step instead of several vendors each holding a piece.
More for sheet metal and fabrication shops
CMMC Level 2 program leadership in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.