NIST 800-171 for Small Manufacturers in Michigan

NIST SP 800-171 applies to any organization that handles Controlled Unclassified Information (CUI) for the Department of Defense. This includes prime contractors, Tier 2 suppliers, and Tier 3 suppliers who receive or generate CUI as part of a defense contract.

Michigan is home to thousands of manufacturers in the defense supply chain — TACOM suppliers, automotive-defense dual-use shops, precision machining firms, and electronics manufacturers. Many are aware of CMMC but have not yet assessed where they stand against the 110 controls in NIST 800-171.

The deadline is real. CMMC Level 1 self-assessment is already required. CMMC Level 2 third-party assessment is being phased into contracts. If you have a DoD prime contract or are a Tier 2 supplier to one, you need a compliance path now.

The 14 control families in NIST 800-171

• Access Control (AC) — who can touch what
• Awareness and Training (AT) — does your team know the rules
• Audit and Accountability (AU) — logging and traceability
• Configuration Management (CM) — what runs on your systems
• Identification and Authentication (IA) — verifying who logs in
• Incident Response (IR) — what you do when something goes wrong
• Maintenance (MA) — how systems are serviced
• Media Protection (MP) — protecting data on drives, USBs, paper
• Personnel Security (PS) — screening and offboarding
• Physical Protection (PE) — controlling physical access
• Risk Assessment (RA) — finding and fixing vulnerabilities
• Security Assessment (CA) — testing your controls actually work
• System and Communications Protection (SC) — network architecture
• System and Information Integrity (SI) — malware, patching, monitoring

Most NIST 800-171 guides focus on software configuration — cloud settings, firewall rules, user permissions. That approach works, but it requires ongoing maintenance and creates risk every time something changes.

The architecture that Kavanagh Industries builds eliminates several of the hardest requirements at the infrastructure level — meaning they are simply not possible to violate because the system is physically designed to prevent them.

Controls that air-gapped Michigan sovereign hardware addresses

• SC-7 (Boundary Protection) — Air-gapped NAS has no external network boundary to protect. Data cannot exfiltrate because it has no path out.
• SC-8 (Transmission Confidentiality) — Data that never leaves the building cannot be intercepted in transit.
• SC-28 (Protection of Information at Rest) — RigidVault uses RAID-redundant, encrypted-at-rest Michigan hardware under your physical control.
• MP-6 (Media Sanitization) — Physical control of hardware means you control the disposal chain.
• PE-3 (Physical Access Control) — Hardware on your premises means you control physical access directly.
• SA-9 (External System Services) — No foreign cloud dependencies means no third-party services processing your CUI.

This does not mean sovereign hardware alone achieves CMMC Level 2. You still need access control, logging, incident response, and training policies. But it gives you a significantly cleaner starting point than a cloud-first architecture.