The Requirement Your Customer Flowed Down Is Now Yours

Nobody owns the boundary. Plant engineers own operational technology. IT owns the corporate network. The seam between them - where a compromised business workstation reaches a controller - is where incidents happen and where accountability is vacant.

Patching can void certification. CNC machines, PLCs, and embedded HMIs have fifteen to twenty-five year lives, and the controller vendor certifies specific configurations. "Just patch it" is not a plan; segmentation and compensating controls are.

Active scanning is dangerous here. Standard IT vulnerability scanning against industrial devices can disrupt them. Operational environments need passive monitoring and carefully scoped assessment.

Downtime is the loss, not the fine. Ransomware on ERP or MES stops the line, and the cost is measured in hours of production and missed delivery dates. That is the number that motivates the plant manager, and it is a real one - you can calculate yours.

Your compliance contact is your operations director. Named on the contract, with no bandwidth and no security background. The artifacts that gate contracts - the System Security Plan, the plan of action, the score in the supplier performance system - are documents, and someone has to write them.

Defense adjacency drives most of this. A commercial-only manufacturer has a very different list from a shop with a single Navy sub-tier part number.

• An IT vulnerability scan is run against the plant network and a controller faults. This is not hypothetical and it is why OT assessment is a different discipline.
• CMMC is assumed to be a prime contractor problem. The flow-down clause in your purchase order says otherwise.
• CUI is never identified. Without knowing which drawings, specifications, and process documents are covered, scope is guesswork and the assessment cannot be passed.
• A security stack gets bought and the contract artifacts never get written - no System Security Plan, no plan of action and milestones, no current score submitted.
• The corporate network reaches the plant network flat. One phished office account and the line is exposed.
• A remote support tunnel from an equipment vendor stays open long after the commissioning visit.
• Backups cover the file server and not the historian, the HMI images, or the controller programs. Recovery time is what matters, and those are what you need.
• Segmentation is drawn on a diagram that no longer matches the plant.

• Cyber Risk Management

  Assessment that respects the operational environment, segmentation between business and control networks, monitoring, and a remediation sequence built around production windows.

• Governance, Risk & Compliance (GRC)

  The documents that gate contracts: scoping CUI, the System Security Plan, the plan of action and milestones, and the evidence a prime or an assessor asks to see.

• Third-Party Assessments

  Your suppliers and integrators carry your requirements too, and the remote access they hold is part of your attack surface.

• Fractional CIO, CTO & CISO

  A security owner so the operations director is not the named contact for a control framework they were never trained on.

• Digital Forensics & Incident Response

  Response planned around production impact and, where DFARS applies, the incident reporting obligation in the clause.

• Helpdesk Support

  Support across shifts, because a second-shift outage is production lost, not an inconvenience.

Am I required to have CMMC certification?

It depends on whether your contracts include the requirement and what information you handle. CMMC applies through the Defense Federal Acquisition Regulation Supplement to contractors and subcontractors handling covered information, phased into solicitations over time. The program rule is at 32 CFR Part 170 and the official source is dodcio.defense.gov/cmmc - check the current phase-in language rather than a secondary summary.

Does CMMC apply if I am only a sub-tier supplier?

Requirements flow down through the supply chain. If your purchase order or your customer's prime contract passes the clause to you and you handle covered information, the obligation is yours. Many small shops discover this when a customer sends a flow-down notice rather than when they read a regulation.

What is the difference between CMMC Level 1 and Level 2?

Broadly, Level 1 addresses basic safeguarding of federal contract information with self-assessment, while Level 2 addresses protection of controlled unclassified information against the NIST SP 800-171 control set, with third-party assessment required for certain contracts. The authoritative breakdown is in 32 CFR Part 170.

Is our SCADA or historian data considered CUI?

Not by default. CUI is defined by category and by how the information was generated or provided under a federal contract - not by which system it sits in. The CUI Registry maintained by the National Archives is the reference, and this determination should be documented rather than assumed.

Do I need to segment my OT network from IT?

Segmentation is the single highest-value control in an industrial environment, because it is what stops an ordinary office compromise from reaching production. ISA/IEC 62443 provides the zone and conduit model, and NIST SP 800-82 provides guidance for operational technology security - both are public.

Can our PLCs be attacked over the internet?

Directly exposed industrial devices are routinely discoverable, and vendor remote access tunnels left open after commissioning are a common path. The question worth answering is not whether it is possible but whether anything in your plant currently has a route to the internet that nobody inventoried.

Are Windows XP machines on the plant floor a security risk?

Yes, and often they cannot be replaced without re-certifying the machine tool. The answer is not to pretend otherwise - it is isolation, strict access control, and monitoring around them, documented as a compensating control rather than an accepted unknown.

What is a DFARS clause and why is my customer asking about it?

DFARS 252.204-7012 requires safeguarding of covered defense information and rapid reporting of cyber incidents to the Department of Defense. Your customer is asking because their contract obligates them to flow it down to you. The clause text is public at acquisition.gov.

Do I need ITAR registration if I make parts for defense primes?

ITAR registration turns on whether you manufacture defense articles or furnish defense services as defined in the International Traffic in Arms Regulations, not on contract size. Since it also restricts who may access technical data, it has direct consequences for your file permissions and your hiring. Get a determination from export counsel.

Can I get cyber insurance if our SCADA is not patched?

Underwriters increasingly ask about segmentation, remote access controls, backup and recovery testing, and multi-factor authentication rather than universal patching. Unpatchable equipment is answerable if you can describe the compensating controls. It is unanswerable if you cannot.

Florida requires notice to affected residents within 30 days under Fla. Stat. §501.171, which reaches employee data even for a manufacturer with no consumer business. Florida employers should also confirm their obligations under the state E-Verify requirement at Fla. Stat. §448.095, which touches how employment eligibility records are collected and retained.

The local market matters here. Northern Palm Beach County and the Jupiter corridor carry a real aerospace and precision manufacturing presence, and Martin and St. Lucie counties hold machine shops and fabricators that supply into it. Defense adjacency in this region often arrives indirectly - through a purchase order from a tier-one supplier rather than through a contract with the government - which is precisely the path that catches shops unprepared.

[NEEDS: client proof for this vertical]