CUI enclave design for sheet metal and fabrication shops
Put the print on a controlled screen, not a clipboard.
Capital Cyber designs a CUI boundary on Microsoft GCC High and Azure Virtual Desktop for sheet metal and fabrication shops, from drawing intake to nesting to the screen at the brake. Design and documentation only; we do not hold your CUI. Capital Cyber, based in Leesburg, Virginia, provides CUI enclave design for sheet metal and fabrication shops and works on-site across Northern Virginia.
For fab shops building their own CUI environment, or reshaping one, before spending on licensing and build.
How can an enclave shrink a fab shop's paper problem?
If an operator at the brake or weld table can view the drawing on a screen that reaches it through the enclave, the full print no longer has to travel with the job. Under the CMMC scoping rule, a floor screen running a virtual desktop client configured so no CUI goes beyond the keyboard, video and mouse session is out of scope. The paper it replaces was in scope everywhere it went.
Where does nesting software fit?
Nesting and offline programming tools need the part library, and posted programs need to reach the lasers, punches and brakes. The design decides whether nesting runs inside the enclave or on a dedicated workstation inside the boundary, and how posted programs travel to the machine network.
Who and what needs to be inside the boundary?
The people who receive drawings, the programmers, quality staff, and the floor screens. The access design names who reaches CUI and from where, including shift leads who pull up a drawing at the start of a job.
What happens to printing?
Some prints will still be needed. The design says which printers may print CUI, where they sit, and how those copies are accounted for, so printing becomes a controlled exception instead of the default.
Which requirements does this touch?
NIST SP 800-171AC.L2-3.1.3
Control CUI Flow
The design states how drawings move from the prime into the enclave, from the enclave to the machine network, and to the few printers allowed to print them. Evidence is the CUI flow diagram matched to the settings that enforce it.
MP.L2-3.8.2
Media Access
Printed copies of controlled drawings come only from approved printers and reach only authorized people. Evidence is the approved printer list and the print records.
AC.L2-3.1.10
Session Lock
Virtual desktop sessions on floor screens lock with a pattern-hiding display after a set period of inactivity, so a drawing is not left open at an empty work center. Evidence is the session policy and a demonstration.
IA.L2-3.5.1
Identification
Each operator opens the floor screen session as themselves, not under a shared shop account. Evidence is the user list and a sign-in at a work center.
SC.L2-3.13.1
Boundary Protection
Boundaries between the enclave, the office network and the machine network, each one drawn and controlled. Evidence is the network boundary diagram and the rules behind it.
What do you receive?
SCOPED PER CLIENTA written boundary
Which systems handle CUI, from intake to nesting to floor screens, which are kept out of scope, and why.
An access design
Who reaches CUI, from where, and how that access is evidenced, including operators at work centers.
Scoping documentation
The CUI flow diagram and network boundary diagram, written against your shop.
A start at intake
With where CUI enters your shop today: which contracts bring it in, which people handle it, and which systems it touches.
What does this service not include?
This is design and documentation only. We do not hold your CUI, we do not operate the environment under this engagement, and we are not an Authorized C3PAO.
The full service, for any industry: CUI enclave design. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Can operators work from a screen instead of a print?
That depends on the job and the work center, and it is part of what the design works out with your shop. Where a print is still needed, the design treats that work center as a controlled area and documents it that way.
Is a floor screen in scope if it shows a controlled drawing?
Not if it is a virtual desktop client configured so that no CUI is processed, stored or transmitted beyond the keyboard, video and mouse session. Under the CMMC scoping rule that endpoint is out of scope. If it can save or print the drawing locally, it is not.
Does every employee need a GCC High license?
Not necessarily. The design puts the people and systems that handle controlled drawings inside a defined boundary. Office staff who never open them can stay outside it if the separation is documented.
Does Capital Cyber operate the enclave?
No. CUI enclave design is design and documentation only. We do not hold your CUI, we do not operate the environment under this engagement, and we are not an Authorized C3PAO.
More for sheet metal and fabrication shops
CUI enclave design in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.