Supply Chain Risk Management for sheet metal and fabrication shops
Every part that goes out for finish takes a question with it.
Capital Cyber maps which of a fabrication shop's outside processors receive controlled drawings, reads the clauses in the contracts above you, and drafts supplier questions and flow-down language for your counsel to review. Capital Cyber, based in Leesburg, Virginia, provides Supply Chain Risk Management for sheet metal and fabrication shops and works on-site across Northern Virginia.
For fab shops that send parts out for finishing or heat treat and answer to a prime themselves.
Why is outside processing the flow-down a fab shop forgets?
Because it feels like logistics, not information. A rack of brackets goes to the powder coater with a traveler and a print so the coater knows what to mask. If that print carries controlled technical information, the coater has received covered defense information, and DFARS 252.204-7012 asks you to include the clause in that subcontract.
Can you send the processor less?
Usually the processor needs the finish specification, the masking areas and the quantity, not the full drawing. A process-only sheet or a sanitized drawing, agreed with the prime, can change whether that supplier receives CUI at all.
What do you ask a processor who does receive CUI?
Whether they have a current NIST SP 800-171 assessment in SPRS when the work requires one, where your prints sit while the parts are in their shop, who can see them, how they are returned or destroyed, and how they report an incident to DoD and to you.
What does your prime expect from you?
That you know where its drawings go after they leave your building. A clear list of which processors receive what, and on what terms, is the answer to that question.
Which requirements does this touch?
NIST SP 800-171AC.L2-3.1.3
Control CUI Flow
A print goes out with parts only to a processor approved to receive it. Evidence is the approval and a record of which processors were sent which drawings.
MP.L2-3.8.5
Media Accountability
Prints that travel with parts to a coater, plater or heat treater are accounted for while outside your controlled area. Evidence is the shipping record of what paper went out and whether it came back.
MP.L2-3.8.3
Media Disposal
Prints that come back with finished parts are destroyed under your own procedure rather than filed loose with the packing slip. Evidence is the destruction record.
IR.L2-3.6.2
Incident Reporting
Processors who receive covered defense information report incidents to DoD and give you the incident report number. Evidence is that requirement in the purchase order terms and your own reporting procedure.
What do you receive?
SCOPED PER CLIENTA read of the clauses above you
The DFARS and CMMC clauses in your prime contracts, and what each one requires of your shop.
A processor map
Which finishing, heat treat and other suppliers those obligations flow down to, and at what level.
Self-assessment support for your suppliers
Support for your suppliers through their own NIST SP 800-171 self-assessments, so the answers you receive can be relied on.
Flow-down language and supplier questions
For your own subcontracts and purchase orders, ready for your counsel to review.
A start from your contracts
With the prime contracts you hold today and a list of the suppliers who touch that work.
What does this service not include?
Scoped to CMMC and NIST SP 800-171 flow-down. Broader supply chain risk, such as counterfeit parts or foreign ownership, is outside it. Each subcontractor's self-assessment and affirmation remain its own; we support them, we do not sign them. Contract and requirements work, not legal advice, and not a substitute for your own counsel reviewing language before it goes into a signed agreement.
The full service, for any industry: Supply Chain Risk Management. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Does our powder coater need CMMC?
It depends on what you send them. DFARS 252.204-7021 asks you to flow the CMMC requirement into subcontracts that will involve processing, storing or transmitting FCI or CUI. A coater that receives only parts and a finish callout may be in a different position from one that receives the controlled drawing. Decide it per supplier, with your counsel.
What if a processor cannot answer our questions?
Then you have a decision about what you send them. Sending only the process requirement, if the prime agrees, may mean they do not receive CUI. That decision belongs to you and your counsel, and the supplier map lays out the options.
Will Capital Cyber sign our suppliers' self-assessments?
No. Each supplier's self-assessment and affirmation remain its own. We support suppliers through their assessments; we do not sign them.
Is the flow-down language legal advice?
No. It is contract and requirements work. Any language we draft is for your counsel to review before it goes into a signed purchase order or agreement.
More for sheet metal and fabrication shops
Supply Chain Risk Management in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.