The process of going through CMMC (the Cybersecurity Maturity Model Certification) compliance is difficult because you are dealing with digital information that needs to be protected in ways that most companies have never experienced. That difficulty starts with understanding the definitions and acronyms associated with this endeavor that can be found here.
Our favorite technique for machine shops to become CMMC compliant (assuming less than 500 employees) is to leverage an Outsourced Enclave model. This is a special file repository in the cloud that is secured and hardened to meet the requirements of CMMC.
FYI – CMMC related Acronyms, starting with “CUI,” “CMMC” and enclave is critical to understand, see here to get up to speed!
A) Scope & assumptions to confirm
- In‑scope CUI: customer drawings/models, CAM, NC/G‑code, setup sheets, AS9102/FAI, inspection reports, photos/screenshots with features/tolerances.
- Enclave (Core Vault): identity + MFA, secure file service (and/or PDM), secure portal for external exchange, jump host/bastion, logging.
- Off‑network assets:
- Engineering PCs for Mastercam / SolidWorks (no persistent network).
- CNC controllers (Fanuc/Haas/etc.), CMM/metrology PCs (e.g., PC‑DMIS/Calypso), hand‑held inspection (Keyence/Faro), no network or isolated OT VLAN with no internet.
- ERP/MES/Email: outside the enclave (business network, non‑CUI).
- Vendors/maintainers: periodic on‑site/remote support required.
- Media reality: Removable media is required to move programs & reports.
If any of the above is off (e.g., you do run a small OT VLAN or have DNC), tell me and I’ll adjust the bridges.
B) High‑level data‑flow (as implemented for off‑network engineering + machines)
Customer Portal (CUI)
↓ (secure download into enclave)
[Core Vault CUI Enclave: PDM/FileShare + MFA + Logging]
↔ (work) CAD/CAM seats inside enclave
↓ (one-way export via Managed Media Station)
[Transfer Media: encrypted, serialized, scanned, hashed]
↓
[Off-Network Engineering PC: Mastercam/SolidWorks]
↓ (program post + traveler/setups)
[Controlled Media] → [CNC Controller]
↓ (as-cut edits → backflow)
[Quarantine Intake Station in Enclave] → Review & check-in to PDM
↓
[Metrology/CMM PCs] → Inspection results (via media) → Intake Station → PDM
↓
[Customer Delivery] via Enclave Secure Portal (watermarked, time‑limited)
Key idea: All authoritative CUI lives in the enclave; everything else is one‑way export with a documented backflow for as‑cut code and inspection results.
C) Enclave & bridges (what to build)
1) Core Vault CUI Enclave
- Identity & Access (MFA): Separate IdP scope for enclave users; RBAC by role (Engineer, Programmer, QA, Upload‑only).
- Storage:
- PDM or controlled file shares for models/CAM/NC (treat NC as records).
- Immutable backups (daily + offline weekly).
- Workstations: CAD/CAM seats in enclave for CUI jobs when possible (non‑CUI work can stay outside).
- Print control: Pull‑print/release; CUI watermark & user/time stamp; issue/return log for travelers.
- Jump Host/Bastion: Single admin path; all vendor remote access must traverse it with time‑boxed approval and screen recording.
- Logging: Windows event forwarding, share access logs, file integrity monitoring on NC program vault, hash‑at‑release.
2) Managed Media Station (bridge out)
- Hardware: Locked kiosk in enclave; USB ports physically present but software‑controlled; label printer + barcode scanner.
- Workflow:
- User authenticates (MFA).
- Selects job; station hashes payload (models/NC/travelers) and encrypts to serialized media (BitLocker or VeraCrypt).
- Prints Media Ticket with Job#, Media ID, SHA‑256, Who/When.
- Station writes an export ledger (evidence).
- Scanning: AV/EDR‑backed staging with current defs; block non‑approved file types.
3) Quarantine Intake Station (bridge back)
- Purpose: Return path for as‑cut code, metrology results, photos, and notes.
- Workflow:
- Operator/QA returns media.
- Station scans media, captures hashes, and ingests into a Quarantine Drop.
- Reviewer (programmer/QA) performs diff/validation; if accepted → check‑in to PDM and link to job record; station writes import ledger.
4) Vendors & maintenance
- On‑site: Untrusted maintenance laptops on isolated guest VLAN (no lateral). If machines are fully off‑network, only escorted, local console access.
- Remote (only if/when needed): Through Core Vault bastion, JIT accounts, MFA, approval workflow, full session capture; no direct inbound to any production asset.
D) Shop‑floor SOPs (5 short, practical procedures)
- Traveler & Print Handling: Issue/return, watermarks, nightly sweep, locked clipboards, shred bins.
- Media Handling: Request → station export → label & log → carry → return → intake → reconcile; forbid personal USB.
- Controller Edits: Who may edit at the control; how to capture changes (save diff on return); DNC not used (off‑network) → NC vault is source of truth.
- Vendor Access: Steps for approval, escorting, and documentation (onsite) or bastion rules (remote).
- CUI Scrap/Photos: Red bins for CUI scrap; photo policy; destruction log for prototypes/chips; QA redaction templates.
I can draft these as 1‑page checklists if you want.
E) Control matrix mapped to NIST SP 800‑171 (subset of most relevant families)
Use this as your SSP/POA&M index; add policy/SOP cross‑refs and evidence links.
- AC – Access Control
- Enclave RBAC & MFA; enclave‑only CAD/CAM for CUI; export via authenticated Media Station; no direct share access from floor PCs.
- AU – Audit & Accountability
- Export/import ledgers with media ID + hash + user/time; PDM check‑in history; Windows event forwarding; immutable log storage.
- CM – Configuration Management
- Gold images for CAM/metrology; NC program versioning and hash; “as‑cut” diff procedure; documented offline patch cadence for off‑network PCs.
- IA – Identification & Authentication
- MFA for enclave & jump host; kiosk binds actions to named users; no shared accounts (fast user switching on enclave workstations as needed).
- MA – Maintenance
- Vendor access via bastion/JIT; on‑site maintenance SOP; signed service reports; maintenance tool media kept separate & serialized.
- MP – Media Protection
- Encrypted, serialized USBs; approved file types; scan/quarantine; check‑in/out; destruction/sanitization log for end‑of‑life media.
- PE – Physical Protection
- Badge‑controlled CUI work area; locked cabinets for CUI binders; no‑photo signage; escorted visitors.
- PL – Planning
- Enclave boundary documented; bridges (Media Station/Intake) documented; System Security Plan ties to SOPs.
- RA – Risk Assessment
- Register legacy OS/controllers; compensating controls (isolation, one‑way workflows); vendor remote risk.
- CA – Security Assessment
- Quarterly control tests: media audit, traveler sweep, restore test, vendor session review; POA&M tracked in Core Vault.
- SC – System & Communications Protection
- No direct comms from floor → enclave; secure portal with watermark/expiry for external sharing; optional “data‑diode” appliance if you later stand up an OT VLAN.
- SI – System & Information Integrity
- AV/EDR on enclave & stations; signed update bundles for off‑network PCs; malicious code scan on intake; alerting on unusual file exports.
F) Evidence you can collect quickly (to satisfy assessors)
- Screenshots/Exports: Media Station UI showing hash/ID; sample export and import ledgers; PDM history for an NC file.
- Artifacts: Watermarked traveler example; SOPs (5); vendor access approval & session capture; backup/restore test report.
- Logs: Windows event collector summary; file integrity monitor report; immutable log location and retention settings.
- Photos: Locked clipboard/binder; labeled media; no‑photo signage; shred bin; quarantine station.
- Drills: “Found USB” drill record; tabletop IR notes; restore test with timing.
G) 30 / 60 / 90‑day implementation plan
Next 30 days
- Stand up Media Station & Intake (can be the same physical kiosk with two roles).
- Turn on watermark + pull‑print for enclave printers; issue locked clipboards.
- Define enclave user groups & MFA; create job folders/PDM vault structure.
- Draft the 5 SOP one‑pagers; train shift leads; start media serialization.
Days 31–60
- Migrate current CUI into enclave; baseline PDM versioning of NC programs.
- Build export/import ledgers (CSV or small DB) and link media IDs to jobs.
- Set up logging pipeline (event forwarding, share access logs, integrity monitor).
- Run first restore test and “as‑cut” diff exercise on a completed job.
Days 61–90
- Pilot vendor remote via bastion (if needed) with session capture & approvals.
- Quarterly traveler sweep & media inventory drill; fix gaps and record in POA&M.
- Write IR playbook for floor incidents (USB malware, missing traveler, suspicious photo).
- Conduct mini‑assessment against the control matrix; finalize SSP sections.
H) Open points / options
- DNC later? If you choose to network machines in the future, we’ll shift to a segmented OT VLAN + DNC as the single delivery path (read‑only to controls), keeping the same Media Station concept as a fallback.
- License servers: If SolidWorks/Mastercam licensing requires network, we can place a license server inside the enclave and periodically hand‑carry signed license files to the off‑network PCs, or run a short maintenance window where the engineering PC is temporarily connected to a quarantined licensing SSID with egress only to the license host (tight SOP + escort).
- Data diode appliance: If you want hardware‑enforced one‑way transfer from enclave → OT in the future, I’ll spec a small unidirectional gateway.
What critical info is needed to from you to finalize the plan
- Do you have (or plan) any networked OT (even a tiny VLAN) or is everything truly off‑network today?
- Which metrology platforms are in use (PC‑DMIS, Calypso, Keyence, Faro) and are they off‑network?
- Are you using PDM (SOLIDWORKS PDM/other) or do you prefer hardened file shares to start?
- Any cloud apps touching CUI (e.g., Fusion/3DEXPERIENCE), or will all CUI remain on‑prem?
- Do vendors require remote access right now, or can we keep it on‑site only initially?
