Wichita builds fuselages and business jets. The access model behind the drawings is the harder part.

Find out where CUI actually lives. In smaller shops it is usually in email, a shared drive and the CAM workstations next to the machines. Shrinking that footprint into a defined enclave makes the assessment smaller and cheaper. Then we close identity gaps such as shared logins, missing MFA and admin rights on everyday accounts.

No foreign person should get access to ITAR technical data without authorization, and that includes ours. We plan the project so that work inside the controlled environment is done only by people cleared for it under your export compliance rules, and anything else is done without access to the data.

In stages. Plant-floor and engineering systems usually move last, after office apps, because a failed login at a work cell costs production time. We run both directories in parallel with a mapping table and a dated cutoff for each system.

Not as of October 2026. Kansas relies on its breach notification statute, enforced by the Attorney General, plus federal and sector rules. If you sell to consumers in states with comprehensive laws, those states' rules still apply to their residents. Your counsel should confirm the current list.

Mostly that a shared system can take everyone down at once. Officials said 104 of 105 county court systems went offline and only Johnson County, on its own system, kept going. We look hard at shared admin paths and single points of failure in identity before anything else.