State Line Data Security

For manufacturers & warehousing · Elkhart corridor

What your contracts actually require. What to fix first.

If you supply into defense work — directly or two tiers down from a prime — the CMMC picture changed again this year. Self-assessments are showing up in contracts, the certification phase is paused, and primes are pushing requirements to their suppliers regardless. Most shops we talk to aren't sure what applies to them right now.

If you don't touch defense work, the question is simpler: what does a week of downtime cost, and is the insurance going to pay? We work with machining, fabrication, molding, and RV supply-chain shops across Elkhart and Michiana.

Book a 20-minute call See what's included

What happens next

  1. A 20-minute callWho are your primes and largest customers, what's in your contracts, and what's been asked of you? That determines the scope.
  2. A gap assessmentYour controls against NIST SP 800-171 — policies, network, access, backups, logging — without us taking custody of any controlled technical data.
  3. A plan you can take to your primeWhere you stand, what your contracts require today, and a prioritized fix list before it costs you a bid.

Three to four weeks. Fixed fee from $8,000 for defense work; smaller shops without CUI start lower.

Two different problems, depending on the shop

Defense suppliers have a compliance problem. Everyone else has a downtime problem. Both are fixable.

“We're a sub to a sub. Does CMMC apply to us?”

If your contract or purchase order references DFARS 252.204-7012 or NIST 800-171, yes — and the flow-down is the prime's problem to push and yours to meet. We read the contract with you and tell you what actually applies.

The self-assessment score you've already submitted

Many shops submitted a score years ago that doesn't reflect reality. A false score is a bigger problem than a low one. We help you get to a defensible number.

CAD files on a shared drive with no access control

Your IP is the business. Drawings, programs, and quotes on an open share are the most common exposure we find, defense work or not.

Backups that can't survive ransomware

The backup is on the same network as everything else. When the shop floor goes down, so does the recovery.

Insurance renewals asking questions nobody can answer

Same MFA, endpoint, and incident-plan questions law firms get — and a shop with a CNC network has more to explain.

Where to start

Fixed fee, quoted before we begin. No hardware to buy, no software to license.

from$8,000

NIST 800-171 / CMMC Gap Assessment

  • Contract and flow-down review: what's actually required today, in plain English
  • Scoping: where controlled information lives, and how to keep that footprint small
  • Control-by-control assessment against NIST SP 800-171
  • A defensible self-assessment score and System Security Plan foundation
  • Prioritized remediation plan with realistic costs and owners
  • Answers for your prime's supplier security questionnaire
  • We assess the environment without taking custody of controlled technical data — your drawings stay with you

Not in defense work? A general security assessment starts at $3,500 and covers ransomware readiness, backups, access to your IP, and the insurance questions.

Then, if you want it handled

Ongoing plans from $1,500 a month: the annual reassessment, policy upkeep, staff training, vendor agreements, and someone to call when something looks wrong. For offices that would rather not think about this again until we bring it up.

No long contract. Month to month after the first term, and we'll tell you if you've outgrown needing us.

Questions we hear

We're eight people. This sounds like a big-company thing.

The average precision shop in this corridor has 38 employees and no IT person. That's exactly who the flow-downs land on. The assessment is sized for a shop, not a prime.

Do you need access to our drawings or controlled data?

No, and we'd rather not have it. We assess policies, network, and settings. Your CAD files and controlled technical data stay with you, and our agreement says so.

Can you get us certified?

Nobody can certify you except an authorized assessor, and that phase is currently paused. What we can do is get you to a self-assessment score you can defend and a plan that closes the gaps — which is what your primes are actually asking for right now.

We don't do defense work. Is there anything here for us?

Yes: the downtime question. What a week without the shop floor costs, whether the backups would actually bring you back, and whether the insurance would pay. A general assessment starts at $3,500.

When should you call?

Before 8am or after 3pm. We know how shops run.

Start with a conversation

Twenty minutes, no charge. Tell us who your primes are and what's in the contract, and we'll tell you what applies. If the answer is “not much yet,” you'll know instead of guessing.

Or send a note

Please don't include patient or client details here. We'll ask for what we need on a call.