Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
industries · manufacturing

Drawings, plant systems and supplier access controlled to match CMMC and export rules.

Manufacturers share drawings with suppliers, run plants on controllers that predate their IT team and sell to defense primes. We sort out who can see controlled technical data, how plant systems are reached remotely, and how ERP and production data get into analytics without opening new paths.

Talk to an engineerThe rules that apply
industry / manufacturing 5 rules in scope
01 · IDENTITY SOURCES 02 · ACCESS CONTROL 03 · BUSINESS SYSTEMS 04 · PLANT ZONES HR and export compliance: US-person status · site · program HR and exportcompliance US-person status ·site · program Suppliers and integrators: B2B guests · vendor engineers Suppliers andintegrators B2B guests · vendorengineers Export-aware governance: attribute-based groups Export-awaregovernance attribute-based groups Workforce identity: Entra ID · Conditional Access Workforce identity Entra ID · ConditionalAccess OT remote access: jump host in plant DMZ OT remote access jump host in plant DMZ PLM and CUI files: drawings · specs · SharePoint PLM and CUI files drawings · specs ·SharePoint ERP: Dynamics 365 ERP Dynamics 365 Analytics platform: Fabric · Databricks Analytics platform Fabric · Databricks MES and historians: site operations zone MES and historians site operations zone Controllers and HMIs: control zone · cell networks Controllers and HMIs control zone · cellnetworks
SailPointMicrosoft Entra IDCyberArkMicrosoft Dynamics 365
in short·15-second read

A manufacturer has to control access to CUI, export-controlled technical data and plant systems.

Our identity governance carries US-person and site attributes over from HR. OT remote access follows IEC 62443 zones and conduits. ERP and MES data reach Databricks or Microsoft Fabric through governed pipelines. When the CMMC self-assessment comes, you show evidence instead of a narrative.

you probably need this if
  • A prime asked for your SPRS score and nobody knows where the last self-assessment evidence is.
  • Your foreign national engineers sit in the same SharePoint groups as the ITAR program team.
  • Years ago someone installed a remote tool so the machine builder could reach plant equipment. It's still there.
Ask an engineer facts checked 2026-10-20 · 9 sources
how it runs
  1. 01Map each rule to its systems
  2. 02Measure who can reach regulated data
  3. 03Fix and automate the controls
  4. 04Produce evidence auditors can sample
rules
CMMCNIST SP 800-171 Rev. 2 and DFARS 252.204-7012ISA/IEC 62443 seriesITAR release and access informationEAR deemed exports
platforms
proof
6 case studies on this
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
regulations

The rules your access program answers to

Summaries for orientation, not legal advice. Each links to the primary text.

CMMC (32 CFR Part 170 and DFARS 252.204-7021)

Third-party Level 2 assessments are on hold. Phase 2, which would have required them, was suspended on 13 July 2026 pending a task force review. The DFARS rule itself took effect on 10 November 2025, and Level 1 and Level 2 self-assessments, SPRS scores and annual affirmations continue.

source ↗

NIST SP 800-171 Rev. 2 and DFARS 252.204-7012

It's the requirement set behind CMMC Level 2 for systems holding CUI, and the access control and identification and authentication families carry the identity load. Least privilege. Session controls. MFA for privileged accounts and for network access to all accounts.

source ↗

ISA/IEC 62443 series

The consensus standards for industrial automation and control system security. IEC 62443-3-2 partitions a plant into zones and conduits from a risk assessment, and IEC 62443-3-3 sets system requirements, starting with identification and authentication control.

source ↗

ITAR release and access information (22 CFR 120.50 and 120.56)

An export doesn't have to leave the country. Show ITAR technical data to a foreign person in the United States and you've exported it. Give that person credentials or decryption keys that open unencrypted technical data and you need the same authorization as releasing the data.

source ↗

EAR deemed exports (15 CFR 734.13)

Releasing controlled technology or source code to a foreign person in the US is a deemed export to that person's most recent country of citizenship or permanent residency. A BIS license may be required.

source ↗
from rule to evidence

How a regulation turns into proof.

For manufacturing, each rule below lands as a control, the control runs on a platform, and the platform leaves a record an auditor can read.

  1. 01

    Rules you answer to

    CMMCNIST SP 800-171 Rev. 2 and DFARS 252.204-7012ISA/IEC 62443 seriesITAR release and access informationEAR deemed exports
  2. 02

    Controls we build

    Export-aware identity governanceCUI boundary and access designOT remote access through defined conduitsSupplier collaboration without new directoriesERP and plant data into analytics
  3. 03

    Platforms that enforce them

  4. 04

    Evidence your auditors read

    Access review records Joiner, mover and leaver logs Privileged session records Change and approval history Control-to-rule mapping
the story · manufacturing access program

From the first call to a setup your own team can run.

Here's what usually prompts a call about your manufacturing access program, what we do about it and in which order, and where you end up.

  1. chapter 01 · where it hurts

    Why teams reach out

    • A prime asked for your SPRS score and nobody knows where the last self-assessment evidence is.
    • Your foreign national engineers sit in the same SharePoint groups as the ITAR program team.
    • Years ago someone installed a remote tool so the machine builder could reach plant equipment. It's still there.
  2. chapter 02 · what we change

    How we solve it

    • Export-aware identity governance
    • CUI boundary and access design
    • OT remote access through defined conduits
    • Supplier collaboration without new directories
    • ERP and plant data into analytics
  3. chapter 03 · how it runs

    Our approach

    • Map each rule to the systems it touches
    • Measure who can reach regulated data today
    • Fix access and automate the controls
    • Produce evidence auditors can sample
  4. chapter 04 · where you end up

    What changes

    • When the next self-assessment and annual affirmation come round, nobody has to rebuild the evidence.
    • Export compliance decides who can reach export-controlled data, the systems enforce it, and the company can show who could reach tagged data at any point.
challenges and answers

Where it usually goes wrong, and what we do about it

where it goes wrong
  1. 01

    CUI scattered across email, file shares and ERP

    Drawings, specs and contract data sit in mailboxes, SharePoint sites, PLM vaults and ERP attachments. Until you know where CUI lives, you can't define a CMMC assessment boundary.

  2. 02

    Export rules enforced by memory

    Whether an engineer may open an ITAR drawing often depends on a manager remembering their citizenship status. Directories rarely carry a US-person attribute, so the systems can't enforce it.

  3. 03

    Shared plant accounts and old controllers

    Operators share HMI logins per shift and controllers accept whatever the engineering workstation sends. Ripping them out isn't an option, so access has to be controlled around them.

  4. 04

    Supplier and integrator remote access

    Machine builders and system integrators dial in to support their equipment, often with remote tools they brought themselves. Those paths skip right past the conduits the plant thinks it has.

  5. 05

    Acquired plants with their own IT

    Every acquired site shows up with its own directory, its own ERP instance and its own network design. Bringing it inside the CUI boundary and the governance program needs a plan before anyone runs the first access review.

how we help
  1. 01

    Export-aware identity governance

    US-person status, site and program attributes sourced from HR and export compliance, carried through SailPoint or Entra ID into groups that gate PLM, file shares and ERP. Your export compliance team decides who qualifies; the system enforces it.

  2. 02

    CUI boundary and access design

    Mapping where CUI lives, designing the enclave or boundary, and setting access, MFA and logging so the NIST SP 800-171 controls can be shown working during a self-assessment.

  3. 03

    OT remote access through defined conduits

    Engineers and integrators come in through one brokered access point in the plant DMZ. They pass MFA, someone approves the session, and it's recorded. We lay it out against the IEC 62443 zones and conduits.

  4. 04

    Supplier collaboration without new directories

    Suppliers get in through B2B federation or a guest account, scoped to specific projects and files and given an end date. Reviews and expiry run automatically.

  5. 05

    ERP and plant data into analytics

    We stream Dynamics 365 and other ERP changes by CDC, with historian and MES data alongside, into Microsoft Fabric or Databricks. Access policies keep export-controlled data in a governed space of its own.

typical situations

Situations we walk into

We pieced these together from manufacturing situations that come up a lot. They're patterns. You won't find a specific client in them.

case file 01

A prime asks for the SPRS score, and the evidence is in four places

composite · not a client story
  1. Beforethe situation

    A machined-parts supplier to defense primes posted its SPRS score a while back. Since then the evidence has scattered. Some is in a consultant's binder, some in SharePoint, some in the ERP admin's notes and some in email, and CUI flows through every one of them.

  2. What we dothe work

    We map where CUI actually lives and draw the assessment boundary around an enclave covering PLM, a controlled SharePoint site and the ERP module with contract data. Access, MFA and logging are set inside it, and evidence for each NIST SP 800-171 requirement is collected into one place on a schedule.

  3. Afterwhere you end up

    When the next self-assessment and annual affirmation come round, nobody has to rebuild the evidence. It's current. The boundary is smaller and defined, and a question from a prime is answered from one evidence store.

case file 02

Foreign national engineers in the ITAR program's SharePoint groups

composite · not a client story
  1. Beforethe situation

    Engineering groups are organized by product line, and SharePoint and PLM permissions follow those groups. Foreign national engineers sit in the same groups as the ITAR program team because the directory has no US-person attribute.

  2. What we dothe work

    We get US-person status and program assignments from export compliance and have HR carry them as attributes. The IGA platform turns them into export-tagged groups. PLM folders and SharePoint sites with tagged data switch to those groups, and a report shows who had access before and after.

  3. Afterwhere you end up

    Export compliance decides who can reach export-controlled data, the systems enforce it, and the company can show who could reach tagged data at any point.

architecture

How export controls and plant access fit into a manufacturer's identity design

HR and export compliance supply US-person and site attributes to governance, which grants access to export-tagged files, PLM and ERP. Engineers and integrators reach plant zones only through a brokered conduit, and ERP data flows into a governed analytics platform.

How export controls and plant access fit into a manufacturer's identity design HR and export compliance supply US-person and site attributes to governance, which grants access to export-tagged files, PLM and ERP. Engineers and integrators reach plant zones only through a brokered conduit, and ERP data flows into a governed analytics platform. 01 · IDENTITY SOURCES 02 · ACCESS CONTROL 03 · BUSINESS SYSTEMS 04 · PLANT ZONES US-person attribute B2B federation export-tagged groups provision MFA CDC brokered session conduit session HR and exportcompliance US-person status · site ·program Suppliers andintegrators B2B guests · vendorengineers SP Export-awaregovernance attribute-basedgroups Ex Workforce identity Entra ID ·Conditional Access CA OT remote access jump host in plantDMZ PLM and CUI files drawings · specs ·SharePoint D365 ERP Dynamics 365 Fb Analytics platform Fabric · Databricks MES and historians site operations zone Controllers and HMIs control zone · cellnetworks
Read the diagram as text
  1. HR and export compliance → Export-aware governance: US-person attribute
  2. Suppliers and integrators → Workforce identity: B2B federation
  3. Export-aware governance → PLM and CUI files: export-tagged groups
  4. Export-aware governance → ERP: provision
  5. Workforce identity → OT remote access: MFA
  6. ERP → Analytics platform: CDC
  7. OT remote access → MES and historians: brokered session
  8. OT remote access → Controllers and HMIs: conduit session
case studies

Work on the platforms manufacturing runs on

All case studies
migration Identity and access

On-premises Active Directory to cloud-first Microsoft Entra ID

We shrink on-premises Active Directory one application at a time, moving groups, users and app authentication to Microsoft Entra ID as each app is ready.

read the case study
implementation Security operations

CMMC Level 2 and SOC 2 readiness

Engineering the identity, access, logging and evidence controls behind CMMC Level 2 and SOC 2, so assessments rest on system evidence rather than narrative.

read the case study
migration Privileged access

CyberArk PAM Self-Hosted to Privilege Cloud (Idira PAM SaaS)

We move CyberArk PAM Self-Hosted vaults to Privilege Cloud, now sold as Idira Privileged Access Management. Rotation and sessions keep working.

read the case study
consolidation Identity and access

Identity integration after a merger or carve-out

We give people access on day one after a merger or divestiture. Then directories, identity providers and governance get merged or separated, on a plan.

read the case study
migration Data and analytics

Power BI Premium P SKUs to Microsoft Fabric F SKUs

Moving Power BI Premium per-capacity P SKUs to Microsoft Fabric F SKUs before the agreement ends, sized from real load and reassigned in validated batches.

read the case study
upgrade Identity and access

IdentityIQ 8.x to 9.0 upgrade

Upgrading SailPoint IdentityIQ 8.x to 9.0, with the route through 8.5, the iiq-precheck scan, javax to jakarta fixes and a tested rollback.

read the case study
talent and delivery · manufacturing

Certified engineers, wherever you need them.

Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.

Onsite

Engineers at your sites in the US

Nearshore

Overlapping hours with US teams

Offshore

Overnight progress on your backlog

All time zones

Coverage handed over across time zones

24-hour coverage · US Central time
OnsiteUS business hours
Nearshoreoverlapping US hours
Offshoreovernight progress
Combinedhandover, not hand-off
due diligence · manufacturing

Questions to ask any partner, including us.

Put these to anyone bidding on your manufacturing work. The ones who've done it answer differently from the ones who've read about it.

  1. Q1

    How will you draw our CMMC assessment boundary before building controls?

    If you build controls before you know where CUI lives, they'll cover too much or too little. The boundary decides scope and cost, and it decides what the self-assessment covers.

  2. Q2

    What will you treat as still required while CMMC Phase 2 is suspended?

    The July 2026 suspension paused third-party Level 2 assessments. DFARS 252.204-7012, NIST SP 800-171, self-assessments, SPRS scores and annual affirmations still apply, so plans should assume assessment returns.

  3. Q3

    Who decides what's ITAR or EAR controlled, and how does that decision reach the systems?

    Classification is export compliance's call, and counsel's. A partner turns those decisions into attributes and groups. If one offers to make the decisions for you, that's a warning sign.

  4. Q4

    How will remote access to plant equipment follow IEC 62443 zones and conduits?

    IEC 62443-3-2 has you partition a plant based on a risk assessment. An integrator's tool that goes around the defined conduits undoes that design. Each remote path has to be found and moved onto a conduit.

  5. Q5

    Under ITAR 120.56, a shared credential is access information. How will you handle the ones we already have?

    A credential or key that opens unencrypted technical data is treated like the data. Give it to a foreign person and you need the same authorization. Shared accounts and key distribution get designed around that.

01Do we still need to work on CMMC after the Phase 2 suspension?

Yes. The suspension paused third-party Level 2 assessments, not the underlying obligations. DFARS 252.204-7012, NIST SP 800-171 compliance, self-assessments, SPRS scores and annual affirmations all still apply, and primes continue to ask for them. We'd plan as if third-party assessment will return.

02Can you decide which of our data is ITAR or EAR controlled?

No. Classification and licensing decisions belong to your export compliance team and counsel. We take what they decide and turn it into attributes, groups and policies the systems enforce. Then we produce reports showing who had access to tagged data.

03Do we have to replace plant controllers to align with IEC 62443?

Rarely. Most plants start with the zones and conduits, then push all remote access through one brokered point. Equipment you can't change keeps its shared accounts, and you control access around it. The controllers themselves get replaced on the normal lifecycle schedule.

04Can suppliers reach our files without accounts in our directory?

Yes, through B2B federation. The supplier's people use their own company login, and you set which project sites and files they reach and for how long. For export-controlled content, the US-person checks are the same ones your staff get.

05Can you help us answer a prime's cybersecurity questionnaire?

Yes. We tie each question to the NIST SP 800-171 requirement it tests, pull evidence from the system that holds it, and flag gaps plainly. Answers on data classification or legal obligations stay with your compliance team.

services

Services for manufacturing

The services manufacturing clients ask us for most, alongside the work on this page.

you are hereManufacturing
sources 9 sources linked last checked 2026-10-20 content fingerprint b0251da2
  1. 01eCFR: 32 CFR Part 170, CMMC Programecfr.gov ↗
  2. 02Federal Register: DFARS CMMC final rule, effective 10 Nov 2025federalregister.gov ↗
  3. 03DoD CIO: Memorandum implementing the suspension of CMMC Phase II (Jul 2026)dodcio.defense.gov ↗
  4. 04WilmerHale: Pentagon suspends CMMC Phase 2 requirements (20 Jul 2026, secondary source)wilmerhale.com ↗
  5. 05NIST: SP 800-171 Rev. 2, Protecting CUI in Nonfederal Systemscsrc.nist.gov ↗
  6. 06ISA: ISA/IEC 62443 series of standardsisa.org ↗
  7. 07eCFR: 22 CFR 120.56, Release (ITAR)ecfr.gov ↗
  8. 08eCFR: 15 CFR 734.13, Export and deemed export (EAR)ecfr.gov ↗
  9. 09BIS: Deemed exportsbis.gov ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it