Every system on the critical manufacturing shop floor faces a security review, and if you can’t verify controls and protections for controlled data, the program stalls. These reviews rarely come early. They tend to surface after a team has chosen a system and started planning the rollout, when a missing answer costs the most. That is why the question of a vendor’s security posture is better settled before it is asked.
iBase-t has earned Cybersecurity Maturity Model Certification (CMMC) Level 2, with independent assessors confirming that we handle Controlled Unclassified Information (CUI) in accordance with NIST SP 800-171. The certification scope includes technical drawings, program data, and manufacturing processes. For aerospace and defense manufacturers, it answers one of the toughest security review questions.
Attaining this milestone took years of assessments, remediation, configuration, and documentation across security, IT, engineering, support, and business teams. We implemented and configured controls, documented them, and trained people to maintain them. We have put the processes, configurations, and training in place to sustain compliance every day the company operates, so the result describes how we run now.
Vendor’s Controls Impact Risk
Work instructions, inspection records, configuration data, and as-built documentation pass through your manufacturing software every day. When a vendor stores or processes that information, its security posture becomes part of your own risk. You can implement every control in your plant and still inherit gaps you can’t control.
In practice, that risk lands on the sponsor. A manufacturing leader who wants a new system rarely signs alone. The CIO, the security team, and quality each want to know how the data is protected and how it impacts the risk envelope. A vendor who can answer with independent evidence gives the sponsor assurance and helps minimize the risk.
What an independent assessment tells you
A self-assessment records what a company believes about its own controls. An independent assessor examines the documentation, interviews the people responsible, and tests whether the controls work. Certification does not replace your own due diligence. It gives that diligence a starting point beyond a vendor’s self-description.
CMMC adoption obligation
In July, the Department of Defense (DoD) suspended Phase 2 of the CMMC program, the step that would have made third-party Level 2 certification a condition of award and opened a review. As of today, DoD has not published the review’s findings or set a new date.
Contractors that handle CUI must still meet NIST SP 800-171, report their self-assessment scores, and follow DFARS 252.204-7012.
No one yet knows what the review will recommend. Whatever it concludes, controlled access, stricter enforcement of controls, trained staff, and CUI protected in storage and in transit will be critical to reducing risk. Choosing a vendor who is already certified helps critical manufacturers when the new recommendations come out.
Four questions for any vendor that touches your CUI
Whether or not a contract asks for it, these are worth putting to every software partner to ensure that your implementation does not get tied up in security review:
- Where is our CUI stored, and who can access it?
- What does your certification cover, and what sits outside its scope?
- How do you enforce your controls between audits?
- Can you show us the evidence of third-party validation?
As iBase-t, a leader in AI-native digital manufacturing and sustainment software solutions for Aerospace & Defense manufacturers, we are glad to answer them.
If you are weighing a system for your plant or your depot, we would welcome the conversation. Contact us to view a demo.
