A supplier to the defence industrial base answers for what it hosts and for who can reach it. That obligation passes down to the lower tiers of the chain.
Until the perimeter where controlled data travels is drawn, the whole information system sits inside the audit. Reducing that perimeter is the first piece of architecture work.
Obligations pass to lower-tier suppliers through the contract. One link hosting with an unqualified provider affects the prime contractor’s file.
Productivity suite, directory and mail with the same provider create a dependency that some contracts no longer accept. Reversibility is built before it is demanded.
Dedicated subscription, separated identities and logging exported outside the application perimeter, all under version control. NIST SP 800-171 controls are attached to the resources that carry them, which makes the evidence reproducible.
Replacing Windows Server with Linux and Active Directory with FreeIPA, in layers, treating servers without application dependencies first. Workstations tied to proprietary engineering software are handled last or kept, with the reason written down.
Production within eight weeks on documents whose sensitivity has been established before ingestion. Controlled corpora stay out of scope until the hosting has been qualified to hold them.
On some perimeters the answer is not to deploy Copilot. We produce the analysis that supports that and the list of spaces where the tool remains usable without contractual exposure.
The publication sets out requirements for protecting CUI in non-federal systems. Each requirement has to map to a real configuration, not to an internal policy statement.
The programme structures the assessment of suppliers to the US defence industrial base on their handling of CUI. The expected level depends on what the contract puts into circulation.
A company subject to US law can be compelled to produce data it holds, regardless of where the server physically sits. For a European supplier, that exposure is addressed when choosing the host, alongside operators such as OVHcloud, Scaleway, Infomaniak or Delos.
We can read a contractual requirement and say what it implies on the infrastructure side, with nothing expected in return.
See your external surface →