--- title: When a Firewall Is Not Enough! description: A Cleveland manufacturing company learned that CMMC is a requirement of doing business with the Department of Defense and took action. image: https://www.mfgworkscle.org/hubfs/images/events/computer-1591018_1920.jpg --- [216.588.1440](tel:+12165881440)  [Events](https://portal.mfgworkscle.org/events/)  [Resources](https://www.mfgworkscle.org/resources)  [Blog](https://www.mfgworkscle.org/blog)  [Contact Us](https://www.mfgworkscle.org/contact-us)  [BECOME A MEMBER](https://www.mfgworkscle.org/membership-overview) [![Header-Logo-white](https://www.mfgworkscle.org/hubfs/MFG-Works-Images/Header-Logo-white.svg "Header-Logo-white")](https://www.mfgworkscle.org/) [![Header-Logo-black](https://www.mfgworkscle.org/hubfs/MFG-Works-Images/Header-Logo-black.svg "Header-Logo-black")](https://www.mfgworkscle.org/) [![Header-Logo-white](https://www.mfgworkscle.org/hubfs/MFG-Works-Images/Header-Logo-white.svg "Header-Logo-white")](https://www.mfgworkscle.org/) [![Header-Logo-black](https://www.mfgworkscle.org/hubfs/MFG-Works-Images/Header-Logo-black.svg "Header-Logo-black")](https://www.mfgworkscle.org/) ## Manufacturing Works Blog # When a Firewall Is Not Enough! ![](https://cdn2.hubspot.net/hubfs/2040891/Marketplace/WASABI/icons/icon-calendar.svg) *By Manufacturing Works - October 20, 2022* ### Certification Under CMMC 2.0 Requirements In late 2019, a Manufacturing Works Member that manufactures iron and steel forgings began receiving notifications from their customers that they were required to perform a NIST 800-171 self-assessment. NIST 800-171 requirements include "The protection of Controlled Unclassified Information (CUI) while residing in nonfederal information systems." "We thought that by putting in a new firewall, we would be done. However, after attending a Manufacturing Works webinar on CMMC, we learned that it is not that simple." CMMC, they learned, stands for Cybersecurity Maturity Model Certification and is a requirement for companies doing business with the Department of Defense (DOD). As a company for which about 30% of their business is for the DOD, they quickly took action. After the webinar, they engaged the services of fellow Manufacturing Works Member, [On Technology Partners](https://ontechnologypartners.com/), to complete a cybersecurity assessment. This assessment was subsidized through the CARES act, which meant that there was no cost directly to the manufacturer. > --- > > "We thought that by putting in a new firewall, we would be done." > > --- ### What They Learned Five issues were uncovered that needed to be resolved to continue supplying the DOD with materials: 1. The company needed to verify it actually had CUI (Controlled Unclassified Information) 2. The company did not have a supported ERP system (their system provider was no longer in business) 3. Due to the expired ERP, there was no viable backup process in the event of a systems interruption 4. The company needed documented and auditable policies with assigned owners 5. These issues needed to be addressed both for basic cybersecurity hygiene, as well as CMMC requirements ### Taking Action Working with a service provider, the company is in the process of developing ongoing solutions, which include: - Contacting their prime contractors to identify specific CUI documents and requirements - Within a reasonable budget, beginning to deploy basic security practices (e.g. having all users on Windows 10 Pro, migrating all email accounts to Microsoft Outlook, installing basic layered ransomware protection, etc.) - Creating backup and recovery protocols - Identifying a future ERP solution to include inventory control, invoicing, and disaster recovery - Performing the NIST 800-171 assessment While the work is still in process, the company has improved basic cybersecurity, is confident in keeping their DOD business by preparing for Level 1 CMMC compliance, and is looking forward to a new ERP system that will serve their company, and customers, into the future. ### What You Should Know About CMMC Compliance CMMC is presently being revised from CMMC 1.0 to CMMC 2.0 and is currently in the public discussion phase. While this will delay the requirement, it will not be abandoned. This gives companies more time to plan and implement basic cybersecurity practices. - Understanding if, and what kind of, CUI and FCI (Federal Contract Information) is critical to what you need to do in the future. If you are not sure, start by asking your prime contractors. - Some issues constitute basic cybersecurity hygiene and are risks to your business whether or not you do work for the defense industry. - Service providers may have grants available. In this case, CARES funding for support was available through 2021. If you have questions about CMMC or other cybersecurity issues, contact [Ron Clough](mailto:rclough@mfgworkscle.org), Vice President of Manufacturing Services, at 216.920.1968. Comments ### Sign Up for our Blog We promise that we won't SPAM you. #### Contact us Manufacturing Works PO Box 31025 Independence, OH 44131 [216.588.1440](tel:+12165881440) [info@mfgworkscle.org](mailto:info@mfgworkscle.org) #### Connect With Us #### Services [People](https://mfgworkscle-6852400.hs-sites.com/people) [Production](https://mfgworkscle-6852400.hs-sites.com/production) [Prosperity](https://mfgworkscle-6852400.hs-sites.com/prosperity) #### Other Links [Our Community](https://www.mfgworkscle.org/our-community) [Resources](https://www.mfgworkscle.org/resources) [Events](https://portal.mfgworkscle.org/events/) [About Us](https://www.mfgworkscle.org/about-us) [Contact Us](https://www.mfgworkscle.org/contact-us) Copyright © 2021 Manufacturing Works. All rights reserved. [Terms of Use and Privacy Policy](https://www.mfgworkscle.org/privacy-policy). [Accountability and Transparency](https://www.mfgworkscle.org/accountability-and-transparency).  Thanks to the generosity of [QuestionPro](http://www.questionpro.com/) and its[ online survey](https://www.questionpro.com/) platform, we are able to collect responses and distribute vital information to participants. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Manufacturing Works", "url" : "https://www.mfgworkscle.org/blog/author/manufacturing-works" }, "dateModified" : "2022-11-18T13:39:55.935Z", "datePublished" : "2022-10-20T16:49:47.000Z", "headline" : "When a Firewall Is Not Enough!", "image" : [ "https://www.mfgworkscle.org/hubfs/images/events/computer-1591018_1920.jpg" ], "mainEntityOfPage" : { "@id" : "https://www.mfgworkscle.org/blog/when-a-firewall-is-not-enough", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.mfgworkscle.org/hubfs/Header-Logo-black.svg" }, "name" : "Manufacturing Works" } } ``` ```json { "@context" : "https://schema.org", "@type" : "WebSite", "potentialAction" : { "@type" : "SearchAction", "query-input" : "required name=search_term_string", "target" : "https://www.mfgworkscle.org/hs-search-results?term={search_term_string}" }, "url" : "https://www.mfgworkscle.org/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.mfgworkscle.org/", "@type" : "LocalBusiness", "address" : { "@type" : "PostalAddress", "addressCountry" : "US", "addressLocality" : "Cleveland", "addressRegion" : "OH", "postalCode" : "44135", "streetAddress" : "4855 W. 130th Street" }, "geo" : { "@type" : "GeoCoordinates", "latitude" : 41.42231485801535, "longitude" : -81.77883030214144 }, "image" : [ "https://f.hubspotusercontent00.net/hubfs/6852400/images/Manufacturing-Worker-1x1.jpg", "https://f.hubspotusercontent00.net/hubfs/6852400/images/Manufacturing-Worker-4x3.jpg", "https://f.hubspotusercontent00.net/hubfs/6852400/images/Manufacturing-Worker-16x9.jpg" ], "name" : "Manufacturing Works", "telephone" : "+12165881440", "url" : "https://www.mfgworkscle.org/" } ```