System Security Plan, policy and POA&M for sheet metal and fabrication shops
A plan that follows the route sheet through the shop.
Capital Cyber writes the System Security Plan, the policy set and the POA&M for sheet metal and fabrication shops, against the work centers, programs and paper you actually run. Capital Cyber, based in Leesburg, Virginia, provides System Security Plan, policy and POA&M for sheet metal and fabrication shops and works on-site across Northern Virginia.
For fab shops that know their gaps and need the documents an assessor reads.
What does a fab shop's SSP describe that an office SSP does not?
The path of a job. The plan names the systems that hold CUI, from the nesting and offline programming stations to the shared folder the laser pulls from, and the places where CUI sits on paper, from the print rack to the weld table. An assessor reading it should be able to walk the floor and find what the plan describes.
How are lasers, punches and brakes written up?
As Specialized Assets where they qualify as Operational Technology. Each gets an asset inventory entry, a place on the network diagram, and a description of what programs it stores, how those programs reach it, and the risk-based measures that manage it.
Which policies carry the most weight in a fab shop?
Physical protection and media protection. The physical policy defines the controlled areas, who may enter them, how visitors such as source inspectors and service technicians are escorted, and how keys and badges are issued and recovered.
The media policy says what may travel with a job, where prints are kept overnight, and how they are destroyed.
What does the POA&M look like for a fab shop?
Specific to the floor: stop attaching full prints to route sheets, lock the print rack, start a visitor log at the dock door, move the brake controls onto the machine network. Each item states what closing it takes and who owns it.
Which requirements does this touch?
NIST SP 800-171CA.L2-3.12.4
System Security Plan
The SSP describes the boundary around nesting, programming and drawing systems, the controlled areas on the floor, and the machines treated as Specialized Assets. Evidence is the plan, matching the asset inventory, network diagram and physical site layout.
MP.L2-3.8.1
Media Protection
Prints, route sheets carrying drawings, and backup media are physically controlled and securely stored. Evidence is the storage location, its lock, and the procedure for overnight storage.
PE.L2-3.10.3
Escort Visitors
Source inspectors, drivers and service technicians are escorted and monitored where CUI is in view. Evidence is the visitor log and the escort procedure.
PE.L2-3.10.5
Manage Physical Access
Keys, badges and combinations for the programming office and print storage are issued, recorded and recovered. Evidence is the key or badge register.
What do you receive?
SCOPED PER CLIENTA System Security Plan for your shop
Written against your environment as it actually is: programming systems, machines, work centers and print storage.
The policy set behind it
Each policy mapped to the controls it satisfies, with physical and media protection written for your floor.
A POA&M
Naming every open control, what closing it requires, and who owns it.
Documents you keep
Written so your own team can maintain them when a work center moves or a machine is added.
A start from your current state
From a recent gap assessment's findings, or from a new gap assessment if there is none.
What does this service not include?
Documentation, not remediation: we write the plan and the policies, we do not implement the controls they describe or collect your evidence under this engagement. We are not an Authorized C3PAO.
The full service, for any industry: System Security Plan, policy and POA&M. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Does the SSP need to cover paper drawings?
Yes. NIST SP 800-171 treats paper as media, and the CMMC scoping rule counts CUI held in physical formats such as paper as stored CUI. The System Security Plan says where printed drawings may be, how they are protected and how they are destroyed.
Can the SSP treat our lasers and press brakes as Specialized Assets?
Where they qualify as Operational Technology under the CMMC scoping rule, yes. The System Security Plan describes each machine and the risk-based measures used to manage it, and the assessor reviews that description.
Does Capital Cyber install the locks or badge system?
No. This engagement writes the documents: the System Security Plan, the policies and the POA&M. Implementing the controls they describe and collecting evidence is separate work.
Why not start from a template?
Because a template does not know your work centers. When a policy describes a print room or a badge system the shop does not have, the mismatch is the first thing an assessor finds.
More for sheet metal and fabrication shops
System Security Plan, policy and POA&M in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.