A shop owner told me last spring that CPCSC couldn't apply to him because his DND-connected work was 4 percent of revenue. We found Specified Information in 6 places in an afternoon: the quoting folder, 2 engineers' laptops, the shared drive, his own email, and the cloud backup of everything above.
The program applied to 4 percent of his revenue and roughly 80 percent of his network. That ratio is normal, and it is the whole argument for scoping before anything else.
Scope is the denominator
Every control you implement, document, and prove applies to every system inside your boundary. A supplier that confines contract data to an enclave assesses the enclave. A supplier that lets drawings spread across every laptop and mailbox assesses the whole company. Same controls, same standard, and the second supplier pays several multiples of the first.
What the shop looked like
This is the machine shop the way I keep finding them. CAD workstations, the software driving the CNC machines, the office PCs, and the owner's laptop, all on one small business network behind a modem-router combo. 1 flat subnet, consumer wifi, no segmentation. The customer's drawings were reachable from every device in the building, which put every device in the building in scope.
The build was an architecture job, not a paperwork job. A real firewall at the edge. The shop floor split from the office. Wifi on its own segment. And an enclave for the drawings: 1 file server, 3 workstations, a managed transfer tool for receiving drawings, and a firewall rule set I could read in one sitting.
In-scope devices went from roughly 40 to 9. The build cost a few weeks of an integrator's time and some licensing. The alternative was bringing 40 devices, including the owner's home laptop, to a Level 2 standard by 2027.
The moves, in order of value
Consolidate storage first. 1 project share, or 1 enclave file server, instead of copies on personal drives. That move usually removes more systems from scope than any other.
Contain email second. Every mailbox that ever received a drawing is a system holding Specified Information. Route contract data through a managed transfer folder or a dedicated project mailbox, and make "don't email drawings" a rule with an easy alternative attached, because rules without easy alternatives lose to deadlines.
Separate the enclave third, with its own workstations or virtual desktops, real firewalling at its edge, and its own backup job. For a shop where defense is a minority of revenue, this turns "certify the company" into "certify the room."
Last, purge the echoes: old proposals, dead projects, departed employees' mailboxes. Check the contract's records retention clause first, because some contract data has to be kept for years, and that data gets archived into the enclave rather than deleted.
The owner's laptop
The owner's laptop is where small-shop scoping goes to die. Every shop has the folder. It's named "DND stuff" or "Project X" or just "Drawings," it lives on the machine that also does the banking and the kids' homework, and it's synced to a personal cloud account for convenience.
Nobody wants to tell the owner their laptop is in scope, so the map omits it, and the enclave is fiction from day one. Tell the owner. I've had that conversation a dozen times this year. It takes 5 awkward minutes, the fix is a managed workstation and a habit change, and it beats an assessor finding the folder in minute 20 of the first interview.
One test for "real" separation
Systems that connect to the enclave but are kept from the data by real technical separation can sit outside it. The word doing the work is "real." A VLAN with an any-any rule between segments is a diagram, not a separation.
Top comments (0)