Fractional CISO for sheet metal and fabrication shops
Someone who owns the rules for prints, visitors and machines.
Capital Cyber provides a part-time CISO for sheet metal and fabrication shops: owning the security and CMMC plan from inside the business, chairing the reviews, and speaking to the program when a prime asks. Capital Cyber, based in Leesburg, Virginia, provides fractional CISO services for sheet metal and fabrication shops and works on-site across Northern Virginia.
For fab shops with a CMMC requirement and nobody whose job it is to own the security program.
What keeps changing in a fab shop after the assessment?
Work centers move when a new laser or brake goes in. A new paint vendor is added. A customer's source inspector starts visiting the floor. A temporary welder starts on second shift. Each change can move where prints sit, who walks the floor and what the SSP says, and the affirmation is signed again every year.
What does the role decide?
Whether a new work center becomes a controlled area, whether a new processor may receive drawings, how a temporary worker is given access and has it removed, and when an open gap goes on the POA&M. Each decision is recorded in a review: what was decided, by whom, and what changed.
Who answers the prime's questions?
When the prime's supplier quality team or a source inspector asks how drawings are protected on your floor, the fractional CISO can speak to the program: the controlled areas, the paper rules, the processors who receive CUI and the open items.
How does it work in a shop with no IT department?
Many fab shops run on an office manager and an outside IT provider. The role owns the plan they work to and keeps the SSP and POA&M current between assessments, so security is somebody's job rather than everybody's side task.
Which requirements does this touch?
NIST SP 800-171PE.L2-3.10.2
Monitor Facility
The building and the controlled areas are protected and monitored, with cameras aimed at entrances rather than at screens or prints. Evidence is the coverage plan and the review record.
PS.L2-3.9.1
Screen Individuals
New hires and temporary welders are screened before they are given access to CUI. Evidence is the screening record for each person on the authorized list.
PS.L2-3.9.2
Personnel Actions
When someone leaves or a temporary assignment ends, badges and keys are recovered and accounts disabled. Evidence is the departure checklist with dates.
CA.L2-3.12.3
Security Control Monitoring
Ongoing checks that the floor rules hold: prints back in storage at shift end, visitors logged, controlled area doors closed. Evidence is the monitoring record and what was done about each miss.
What do you receive?
SCOPED PER CLIENTA security and compliance lead
Working from inside your shop, part-time.
Recorded reviews
What was decided, by whom, and what changed, from new work centers to new processors.
A current plan and POA&M
The plan and the POA&M kept current between assessments.
Someone to speak to the program
When a prime or an assessor asks about it.
A scoped start
A scoping call to agree the shape of the role. If there is no recent gap assessment, the role starts with one.
What does this service not include?
We are not an Authorized C3PAO and we do not certify anyone. A fractional CISO is a part-time role we provide, not a full-time hire, and what we can commit to is our own accountability rather than what a third party will do.
The full service, for any industry: Fractional CISO. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Is a fractional CISO a full-time employee?
No. It is a part-time role Capital Cyber provides, working from inside the business rather than advising from outside it. Engagement shape and cadence are scoped per client.
Does the fractional CISO run our locks and badges?
No. Your shop and its providers run the physical and technical systems. The fractional CISO owns the security plan they work to, chairs the reviews, and keeps the System Security Plan and POA&M current.
Who signs the annual affirmation?
An affirming official of your own company, not Capital Cyber. The fractional CISO keeps the program current so the person affirming knows what they are signing.
What if our shop has never had a gap assessment?
Then the role starts with one, so the plan is built on a scored picture of your shop rather than a guess.
More for sheet metal and fabrication shops
Fractional CISO in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.