A controller that cannot run an agent. A build log that copied the test data. A supplier whose assessed scope stops at the wrong plant. Each note is a composite: real tools and real rules, applied to a made-up company.
From the operating environment
Working designs for the shop floor, development teams, shared IT, and supplier risk. Choices, tradeoffs, and the checks that make them credible.
Note 01 · Shop floor
Office PCs get no route to controllers, programs move through one transfer station, and vendors get a timed MFA session. Five firewall rules and how to test them.
Andrew ErneNote 02 · Lean setups
Three managed CAM workstations, no cloud CAD on CUI jobs, and the overflow programmer held until they're covered. Follow one job to find every copy.
Kyle FaheyNote 03 · Hard controls
Check the repo host's FedRAMP tier, lock one ephemeral runner group to the defense repo, then run a canary string through the pipeline to find the leaks.
Andrew ErneNote 04 · Lean setups
Five managed computers, one GCC or GCC High project site, one delivery route. The tenant rule, the brief for your MSP, and the pilot that failed twice.
Kyle FaheyNote 05 · Product pairings
Intune + Defender if your MSP runs Microsoft, Jamf if you already do. Put it in the tenant where your CUI lives, then reconcile all 12 Macs by serial number.
Andrew ErneNote 06 · Shop floor
Legacy test equipment is a Specialized Asset: listed in your inventory, SSP and diagram, not assessed against the 110. The SSP entry to copy and the restore drill.
Kyle FaheyNote 07 · Primes & risk
A sub's CMMC status only counts if its CMMC UID covers the site doing your job. What 7021 (and 7020 on older contracts) make you check, and the email to send.
Andrew ErneNote 08 · Medium-sized teams
Shared identity, admins and backup make two plants one environment. Scope it once, give each shared job one owner, and retire the acquisition's leftovers.
Kyle Fahey
