Scope statement
Northfield Precision Works
- Period
- Week 1
- Context
- Stage 01 of four
The decision
Recorded first, because everything below follows from it.
Enclave, not the whole environment
Assessing the full 80-person environment would have brought 62 additional endpoints, the shop-floor network, and every commercial ERP user into scope. Moving CUI into a defined enclave first reduced the assessed estate to 16 machines and 11 people. The enclave took four weeks to build and removed considerably more work than it created.
In the boundary
4 categories- CUI enclave
- One virtual network holding the engineering file share, the ERP CUI module, and four workstations.
- People
- 11 of 80 staff: engineering, quality, the contracts lead, and two IT administrators.
- Endpoints
- 14 workstations and 2 servers, all company-owned and domain-joined.
- External services
- GCC High tenant for mail and file storage. One CAD vendor with supervised remote access.
Outside the boundary
3 exclusionsEach exclusion is stated as a claim an assessor can test, not as an assumption. This is the half of the document that gets challenged.
- Shop floor
- CNC controllers and the MES run on a separated VLAN and never receive CUI. Documented as a boundary, not an assumption.
- Commercial ERP
- The non-CUI side of the ERP, used by 60 staff for scheduling and purchasing.
- Guest network
- Physically and logically separate. No route to the enclave.
How CUI actually moves
Walked with the people who handle it, not inferred from a network diagram.
- 01A prime sends drawings to the contracts lead by email into the GCC High tenant.
- 02Engineering opens them from the enclave file share. Nothing is copied to a workstation desktop.
- 03Quality records inspection results against the drawing in the ERP CUI module.
- 04Finished packages return to the prime through the same tenant. Nothing leaves on removable media.