CMMC has to work on the shop floor, not just on the assessor’s checklist.
In a manufacturer, Controlled Unclassified Information (CUI) does not stay in the office. It becomes a toolpath on a machine controller, an inspection record at a quality station and a file on a shop-floor computer that operations would prefer nobody touched. The program has to account for that or it will be worked around within a week.
CMMC has to work on the shop floor, not just on the assessor's checklist.
What CUI may look like here.
Examples of information that may constitute CUI when appropriately designated or contractually identified include:
- Computer-aided design (CAD) drawings
- Computer-aided manufacturing (CAM) and computer numerical control (CNC) files
- Technical specifications
- Bills of materials
- Manufacturing instructions
- Inspection documentation
- Test results
- Quality documentation
- Engineering changes
The path a file takes.
- Prime Contractor
- Engineer
- SharePoint
- CAD Workstation
- Shop Floor/CNC
- Quality Control
- Prime
Where it goes wrong.
Shared production accounts
A single login for the whole shift, or one account per machine that everyone knows, is the norm on many floors because it keeps the line moving. It also means no one can say who opened a controlled file, and a control that requires individual accountability cannot be evidenced. Fixing it is less about the software and more about designing a login pattern operators will actually use.
Legacy systems and specialized equipment
Machine controllers and their attached PCs are often on an operating system the vendor no longer supports, and operations believes they cannot be patched or modified without voiding a warranty or stopping production. Sometimes that is true. The program then has to treat those systems as specialized assets with documented, compensating protection rather than pretending they are ordinary workstations.
Unmanaged shop-floor computers and removable media
The computer beside the machine was set up by whoever installed the equipment and has never joined the domain, never received an agent and never had its USB ports thought about. Files reach it on a thumb drive because that is the only path that works. Each of those facts is a finding, and together they are the usual reason a manufacturer’s first gap assessment is longer than expected.
Vendor remote access
Equipment vendors need to service their machines and often hold a standing remote connection to do it. That connection is a path into the production network that the manufacturer did not build, does not monitor and frequently cannot describe. It has to be brokered, logged and switched on for the session rather than left open.
Engineers moving files between corporate and production
The gap between the office network and the floor is bridged every day by an engineer with a laptop and a cable, or a personal cloud folder, or the same thumb drive as above. The transfer itself is legitimate work. What is missing is a managed way to do it, so the legitimate path and the uncontrolled path are the same path.
"We can't implement security controls that interfere with production."
That statement is correct, and it is where the design should start rather than where it stops. CMMC has to work on the shop floor and not just on the assessor’s checklist. A program that treats every manufacturing system like a standard office workstation will be rejected by operations, worked around by the people who have parts to ship, and end up as paperwork that describes a floor that does not exist.
The workable approach accounts for operational requirements up front. Production systems are inventoried and classified for what they are; the ones that cannot take an agent or a patch are documented as specialized assets with compensating protection around them, such as network segmentation, restricted physical access and controlled transfer paths. Individual accounts are introduced in a form operators can live with. Removable media becomes a controlled exception with a log, not a ban that is ignored. None of that stops the line. All of it produces evidence.
An environment that holds.
- 01
- A segmented production network — The shop floor sits on its own network segment, separated from corporate systems by a firewall with rules someone can explain. Machine controllers and their PCs talk to what they need and nothing else. The segment boundary is also the assessment boundary for those systems, which keeps the scope honest.
- 02
- Shop-floor systems as specialized assets, with documented compensating controls — Each controller, legacy PC and instrument is listed in the asset inventory with its category, and the System Security Plan (SSP) says what protects it when a standard control cannot apply: isolation, physical access limits, monitoring at the segment edge, a documented patch exception. The assessor sees a decision, not an omission.
- 03
- No shared production accounts — Every person who touches a system that holds CUI has their own credential, including on the floor. Where a machine interface genuinely cannot support that, the workstation in front of it does, and the record of who was logged in there is the accountability trail.
- 04
- A managed transfer path between corporate and production — One sanctioned way for programs and drawings to cross from engineering to the machine, with the transfer logged and the files scanned. It is faster than the thumb drive because it is on the network, and once it exists the informal routes can be closed without a fight.
- 05
- Controlled removable media — USB is disabled by default on in-scope systems and enabled by exception on devices the company owns, issues and tracks. The list of exceptions is short, current and reviewed.
- 06
- Brokered vendor remote access — Vendors reach their equipment through a gateway the manufacturer controls, using their own named accounts, for a session that is requested, approved, recorded and closed. The standing tunnel goes away and the maintenance still happens.
The order we do it in.
- 01
Discover CUI
- 02
Define Scope
- 03
Identify Gaps
- 04
Design Controls
- 05
Implement
- 06
Collect Evidence
- 07
Prepare for Assessment
- 08
Maintain Compliance
This is the CMMCg Method applied to your environment. Read the Method →
Open these first.
The working documents from the CMMCg Resource Library that fit this kind of organization, in the order to use them.
CUI Identification Worksheet
Worksheet to list the information your organization receives, creates, processes or transmits that may constitute CUI, with origin, access, storage and marking.
Open →CUI Flow Mapping Template
Template to trace each CUI type from receipt through processing, storage, transmission, sharing and disposition, and mark where it leaves your boundary.
Open →CMMC Scoping Worksheet
Worksheet to sort people, systems, endpoints, networks, cloud services, facilities and providers into CMMC asset categories, and defend every exclusion.
Open →CMMC Level 2 Readiness Checklist
High-level readiness review across all 14 NIST SP 800-171 Rev 2 requirement families that CMMC Level 2 assesses, 3 to 5 review prompts per family.
Open →
Further along than that? The path continues with the Evidence Collection Tracker, the Gap & POA&M Tracker (a POA&M is a Plan of Action and Milestones) and the Assessment Preparation Checklist.
Does this look like your environment?
The readiness call starts from where your information actually goes, not from a template. An engineer runs it.
- Your CUI boundary sketched on the call
- The requirements costing you the most points, named
- A written summary afterward, yours to keep
NDA signed before anything technical. No cost, no obligation.