NuGen Systems Wins with Safety and Sustainability

December 14, 2022 By

NuGen Systems, a manufacturer of rechargeable battery-based solutions, was started in 2016 by co-founder and CEO, Venus Desai, with the goal of designing a safer, more powerful lithium-ion battery solution (using lithium iron phosphate chemistry), to replace the lead acid batteries commonly used in industrial applications. Finding it difficult to break into well-established markets as a component of other products, NuGen began designing its own products made with its batteries, to market independently. The company found a fit for their battery solution in the mobile generator market.

Gas-powered generators are noisy, produce carbon monoxide (which is harmful for both people and the environment), and can be a fire hazard. The Consumer Product Safety Commission recently released a report estimating that about 85 consumers die in the U.S. each year from carbon monoxide poisoning caused by gasoline-powered portable generators and noting that one portable generator can produce the same amount of carbon monoxide as hundreds of cars. However, until recently, they were the only available option for many mobile businesses like food trucks and car maintenance services. NuGen set out to provide a safer, greener option.

To help make the transition, the company drew upon its network of resources at the Georgia Tech Enterprise Innovation Institute. NuGen, a member of the Advanced Technology Development Center (ATDC) since the company was founded, worked with coach and manufacturing catalyst, Shane Matthews, to help build and test the idea, write a business plan, and access mentors and advisors in strategy, finance, and other areas of expertise.

Through ATDC, the company was invited to a webinar hosted by another Enterprise Innovation Institute program, the Georgia Minority Business Development Agency Business Center (MBDA Business Center). There, NuGen connected with the Georgia Manufacturing Extension Partnership (GaMEP) and with Mike Stonecipher, group manager of strategy and leadership development. Stonecipher immediately saw the potential for the company to participate in the Innovation Test Track Competition®, an automotive-related pitch competition that he helps organize each year.

Stonecipher encouraged the company to participate in the competition, which is designed to bring new technology to the automotive industry while also giving entrepreneurs a chance to showcase their automotive-related products. Participating start-ups are provided with coaching and networking opportunities with representatives from major automotive original equipment manufacturers (OEMs) and other business leaders.

Desai and his team worked with their Innovation Test Track® advisor to refine their pitch, including quantifying how much environmental impact their product could make if the gas generators in the U.S. (approximately 15 million) were replaced by battery-powered generators. They also participated in pitch practice sessions hosted by the Georgia MBDA Business Center program to help them prepare.

On Oct. 6, 2022, NuGen Systems competed in and won the competition, hosted at the Southern Automotive Conference in Duluth, Georgia. The prize awarded was $5,000 cash provided by SAE Atlanta, plus $5,000 in consulting services provided by Clarity Capital Advisors.

NuGen’s next step is to launch a subscription model to provide easier access to the product for small businesses. The model will allow businesses to essentially rent the equipment for a low monthly fee, approximately what it would cost to purchase the gas needed to run a traditional machine and complete regular maintenance.

NuGen plans to use the strategy services provided as part of the competition prize to develop this business model and then pursue the food truck market across the U.S., a booming industry that is estimated to include more than 35,000 operations currently and continues to grow.

To learn more about the Innovation Test Track® Competition or GaMEP’s automotive industry services, contact Mike Stonecipher at ude.hcetag.etavonninull@rehpicenots.ekim

CMMC Q&A: Cybersecurity Requirements for DoD Contractors

October 25, 2022 By

Cybersecurity Maturity Model Certification (CMMC) is a framework of various cybersecurity standards and best practices to safeguard sensitive national security information from increasingly frequent and complex attacks. CMMC 2.0 compliance is a requirement for all government contractors working with the Department of Defense (DoD).

In 2015, the DoD released the Defense Federal Acquisition Regulation Supplement (DFARS), a series of cybersecurity requirements contractors and subcontractors in the Defense Industrial Base (DIB) had to follow to protect Controlled Unclassified Information (CUI). As part of the certification process, it includes complying with the National Institute of Standard and Technology (NIST) Special Publication (SP) 800-171 Revision 2 (NIST SP 800-171 R2).

Contractors will lose existing DoD contracts and won’t be able to bid for new ones until they can demonstrate compliance with the required level in the contract. The Department of Justice (DOJ) has also launched the Civil Cyber-Fraud Initiative, which will utilize the False Claims Act to pursue cybersecurity-related fraud by government contractors and grant recipients who falsely claim compliance.

What are the CMMC Requirements?

In 2020, the Department of Defense (DoD) began to demand a self-assessment using a points-based system to prove compliance from defense contractors – an honor system, if you will. After completing the self-assessment, contractors are required to submit their scores to the DoD’s Supplier Performance Risk System (SPRS). A System Security Plan (SSP) is also required, containing comprehensive details of the organization’s networks, systems, processes, policies and security controls including how those controls are being implemented and improved over time. Contractors must currently have a SPRS score listed in the SPRS database in order to bid and receive DoD contracts.

In a significant move, the DoD introduced the Plan of Actions and Milestones (POAM) where organizations who have not yet fully implemented 800-171 can submit a solid plan for achieving full compliance, with specific dates and a timeline. This POAM is submitted with the SPRS and enables organizations to begin working for federal agencies whilst they simultaneously work towards full implementation of 800-171. Once CMMC is fully implemented, the timeline for completing a POAM is six-months from submission of a SPRS score and POAM.

Companies that handle CUI must also submit to and pass an independent audit proving that they meet the 110 controls outlined in NIST 800-171 R2. This audit is at the company’s expense.

When will CMMC Certification be required?

Mandatory SPRS score reporting has already begun in order to bid for contracts (to include creation of an SSP and POAM). Voluntary audits of those who claim to be CMMC compliant began in August 2022. It is expected that all the requirements of CMMC will be finalized by end of first quarter 2023.

Who needs CMMC Certification?

CMMC is required of any individual in the DOD supply chain, including contractors who interact exclusively with the Department of Defense and any and all subcontractors. According to the DOD, the CMMC requirements will affect over 300,000 organizations.

How will CMMC 2.0 be enforced?

Today, companies without a SPRS score cannot bid for new contracts. Those that can show compliance to CMMC Level 2 or 3 must submit to an audit by a third party. Failing the audit could result in loss of contracts or the ability to bid for future contracts. Any company that falsifies their compliance could face a False Claims Act lawsuit from the Department of Justice. The DOJ has already begun pursuing and collecting millions in fine from cases of cybersecurity-related fraud by government contractors and grant recipients.

What will be the consequences of not completing CMMC Certification?

Non-compliant companies will lose the ability to bid for new DoD contracts.

What are the different CMMC Levels?

You may be asking yourself, “What CMMC level do I need?” Determining the CMMC level you need depends on the type of services and information that your company accesses and stores in your information systems.

CMMC requirements are based on the type of information a company handles. Companies that provide COTS (Commercial off-the-shelf) service to the DoD and only handles Federal Contract Information (FCI) must comply with CMMC Level 1. All companies that handle CUI (Controlled Unclassified Information) must comply with Level 2 or 3 and have implemented 110(+) controls as well as prove successful implementation through an audit by an independent agency. For more details:

Level 1 (Foundational) only applies to companies that focus on the protection of FCI. Level 1 is based on the 17 controls found in FAR 52.204-21, Basic Safeguarding of Covered Contractor Information and focus on the protection of FCI. These controls look to protect covered contractor information systems and limit access to authorized users.
Level 2 (Advanced) is for companies working with CUI. CMMC 2.0 Level 2 requirements mirror NIST SP 800-171 and aligns with the document’s 14 levels and 110 security controls developed by the National Institute of Technology and Standards (NIST) to protect CUI.
Level 3 (Expert) is focused on reducing the risk from Advanced Persistent Threats (APTs). It is designed for companies working with CUI on DoD’s highest priority programs. The DoD has indicated that its requirements will be based on NIST SP 800-171’s 110 controls plus a subset of NIST SP 800-172 controls.

In addition, Levels 2 and 3 will required a third-party assessment. See the chart below for an overview.

Are the CMMC requirements for small businesses the same as those for larger businesses?

CMMC requirements are not based on the size of the business but the type of information to which the company has access in order to do business with the DoD. Companies that only handle FCI (Federal Contract Information) do not have as stringent requirements as those who handle CUI (Controlled Unclassified Information).

How do I complete a CMMC Audit?

CMMC requires all DoD contractors that meet the requirements for Level 2 or 3 to get audited and obtain certification from a trusted and approved third-party assessment organization (C3PAO). For Level 2 compliance the CMMC Accreditation Body (CMMC-AB) is responsible for reviewing audits and issuing certificates, however C3PAO must perform an audit. For a small subset of contractors who must comply with Level 3, the federal government will conduct the audit.

The CMMC audit cost depends on the size of an organization. Notably, Companies should expect to incur the following types of costs in a CMMC audit process:

Audit preparation costs: Also referred to as soft costs, audit preparation costs are the expenses for preparation and external consultancy.
Hard costs: Hard costs are also incurred in audit preparation and the audit process and may involve investments made in processes needed to meet audit. This also includes costs for implementing authentication mechanisms, endpoint security, and log monitoring.

What is the total cost to get CMMC Certified?

There is no set cost to CMMC compliance. In addition, CMMC is not a “one and done” milestone. It will require time, personnel and expense to both achieve initial compliance and the work necessary to maintain compliance. CMMC Certification costs will vary by company depending on:

what level of compliance needs to be achieved,
where a company is in their current journey to CMMC compliance,
the types of controls that need to be purchased, installed, configured and in place to achieve compliance,
the cost of managed service providers (MSPs) and other vendors to perform installation and configuration of said controls,
the cost of maintaining systems and controls and
the cost of additional employees to maintain, update and manage the Risk Management, Policy and Procedure, Monitoring and Audit aspects of NIST 800-171 required to keep the company in compliance.

A good rule is that it will take most companies six to 12 months of time, talent and information system upgrades to gain compliance.

How long does it take to become CMMC Certified?

General estimates are six to twelve months to achieve compliance and certification.

How does CMMC compare to NIST 800-171?

NIST SP 800-171 lays out the requirements for any non-federal agency that handles controlled unclassified information (CUI), or other sensitive federal information. It details how organizations should protect this information. First published in 2015, the goal is to strengthen the federal supply chain and ultimately protect national security as a whole.

The “800-171”, as it’s known, is made up of 110 controls divided into 14 control families, and takes around half a year to implement. It’s important to note that there is no certification to prove compliance with this framework. It was originally developed to provide guidance to the DFARS clause (the Defense Federal Acquisition Regulation Supplement)- the original cybersecurity requirements from the DoD.

Since DFARS is still a listed requirement in most government contracts, if you are bidding on a contract or have been awarded the work, you’ll need to be compliant with all 110 NIST 800-171 controls in order to fulfill the DFARS clause.

Unfortunately, due to the lack of certification, the DoD found that contractors were claiming to uphold all of the NIST 800-171 standards, but in reality, they were not. DoD decided that it was necessary to develop a certification process to ensure that contractors were compliant with a basic set of cybersecurity controls: thus the CMMC and NIST 800-171.

How can GaMEP help my company become CMMC Compliant?

GaMEP can perform a CMMC Gap Analysis and Readiness Assessment. The gap analysis and readiness assessment are foundational steps for companies to gain a detailed understanding of how close they are to meeting the requirements of their targeted CMMC level.

The Readiness Assessment will help uncover systems and processes that may not meet the standards outlined in NIST 800-171, such as:

How is data stored and access to information controlled?
Are incident response plans in place, current, and effective?
Are IT staff and other personnel adequately trained?
How are security protocols implemented and maintained?

The resulting Gap Analysis will pinpoint risk areas for contractors and facilitate the creation and execution of the Remediation Plan, either by the MSP or utilizing in-house resources. From the Gap Analysis, GaMEP can assist a company with creating the SPRS, SSP and POAM necessary to begin the CMMC process and bid for DoD contracts.

Without an exhaustive Gap Analysis in hand, DoD contractors may find it impossible to identify risks, prioritize activities, and determine costs for any remedial steps required for CMMC certification.

What if I am not located in Georgia?

Check with your local state MEP to see if they can provide CMMC services.

Where can I complete CMMC training or learn more about CMMC requirements?

You can learn more about CMMC by contacting your GaMEP regional manager or by filling out the Contact Us form.

By: Michael Barker, GaMEP Cybersecurity Project Manager

Three Lean Office Exercises for Improving Front-office Processes

August 26, 2022 By

Recently, the GaMEP marketing and operations team participated in a lean office exercise to map out our data entry, event registration, and email marketing processes to find ways to reduce inefficiencies, integrate software systems, and improve our client experience. Are you interested in how lean tools could help your company’s front office systems? Below are a few examples of lean office exercises that could help your company eliminate redundant steps and non-value-added activity and empower employees to identify opportunities for continual improvement:

Swim Lane Diagram: When an administrative process takes too long, generates errors, or otherwise frustrates the users, the first step is often to get a cross-functional group of people in a room to map out the current state. This builds a common understanding of the full process and how different stakeholders contribute to it. A Swim Lane Diagram can clearly show the sequence of steps, the role of each person or function in the process, and where handoffs occur. This view of the current state is critical in designing countermeasures to improve quality, speed, and employee satisfaction.

Process Mapping Before Software Implementation: There is no shortage of excellent software products available for office applications, but knowing what you need from that software is critical for success. Mapping out the current process to show who uses what systems, how data is generated, shared, and modified, and what workarounds are in use can make choosing and adopting new software much more productive. If you don’t understand the current process and what improvements you need to make, your team is likely to be frustrated with the result.

Customer Discovery: Because they are often far removed from the end customer, administrative functions at a manufacturer can easily become inwardly focused. To combat this internal optimization, consider the mission of the organization and how the office staff helps contribute to that mission. Ask questions like, “Who is our customer? What value are we providing? How do we measure success? What do we need to improve?” Involving internal and external customers in the conversation about improvements your office needs to make can yield tough feedback, but it will focus your team’s efforts on the right targets.

Think one or more of these exercises could fit your team’s needs, but don’t know how or where to start? Register to attend the Lean Office & Administration course on October 20th, or contact your region manager for more information.

Reshoring Your Supply Chain: Starting Points for Small to Mid-Size Manufacturers

July 18, 2022 By

“Reshoring”, also known as onshoring, has never been a hotter buzzword, leaving many to ask what is reshoring and what could it mean for your business?

The definition of reshoring is “the practice of bringing manufacturing and services back to the U.S. from overseas”¹Reshoring as a supply chain initiative has been around for over a decade, but as ports are bottlenecked and transportation costs continue to climb, companies and customers are frustrated and beginning to see it as a more attractive option than ever before. Add in extended lead times and shortages in consumer products and you have what seems to be the foundation of a reshoring strategy.

Yet the thought of reshoring some or all of the supply chain for a small or mid-sized manufacturer who may already be struggling with limited resources can seem to be an overwhelming task. Conceptually, it makes sense. Reshoring can solve problems, mitigate risk, lower costs, provide a ‘greener’ solution, and even create jobs. Catching this vision, especially now, is easy, but putting a plan in place to achieve this goal may seem impossible.

One approach is to focus on a few key starting points to research and analyze the advantages and disadvantages of reshoring, while conserving your valuable resources and giving your team the information they need to make strategic decisions.

History

Go back to why the decision was made to move the supply chain offshore. Dust off the presentations and pull those old Excel files from the archives. Answer these questions:

What was it that drove this decision?
What has changed since the decision was made?
If you used current data with the same criteria, would the evaluation yield the same recommendation?
What have been the positive results of this move?
While recent challenges have magnified the disadvantages of offshoring, when was the offshore supply chain working well and why?
Are there reshoring disadvantages that should be evaluated?

There is a reason that reshoring wasn’t seriously considered until now, and you have to find that reason to make an informed decision.

Problem Statement and Solution

Once you understand why the supply chain went offshore in the first place, you must quantify the current problem, or problems, you are trying to solve. Reshoring cannot be a solution in search of a problem – that approach won’t be sustainable. This is where narrowing the focus to match your available resources becomes critical. Write a problem statement to help you discover:

Are there a handful of components that are driving the majority of your problems?
How will reshoring, specifically, address the problems and provide a more workable solution than the current supply chain?
Are there solutions other than reshoring that could also address these problems?

Focus on real, tangible issues and start small, otherwise your problem statement will become so large or general that it’s meaningless or unattainable.

Technology

Evaluate your current supply chain technology and determine how it can be leveraged to support reshoring.

The supply-chain industry has understood that it can no longer treat technology as an isolated service, i.e., as a means to an end. Technology will inevitably become the backbone of the supply-chain industry. ²

While this backbone will be critical to successful reshoring, the key to success is to keep it simple. Utilize what you have, while in parallel beginning to build a longer-term vision and supporting strategy.

Many small to mid-sized manufacturers have much of their supply-chain data in Excel files downloaded from an ERP system of some type. If that’s the case, build a visual of these siloed Excel databases and determine your starting point, then ask these questions:

Will the technology and data you are using to support offshore suppliers have to change in some way to provide the supply chain visibility you need for reshoring?
Can you leverage the suppliers’ technology and/or integrate it with yours easily?
What benefits would there be to implementing new technology?
Does your team have the bandwidth to take on a new technology implementation right now?

Analytics

Make sure you are measuring apples to apples as you evaluate costs. If your analytics have not evolved over time to keep up with global supply chain evolution, this needs to be addressed before any final recommendations regarding the solution to your current supply chain problems can be made. In this regard, evaluating these questions can help get you started:

How are you measuring your supply chain?
Are you considering all parts of the landed cost equation?
Are you factoring in cost predictability, possible import tariffs, carbon offset costs, or what you may have to spend to react to a late or cancelled delivery?

Take a big picture approach to evaluating costs for both onshoring and offshoring. While you can’t necessarily predict future unknown costs or disruptions, you can account for possible or likely risks and weigh them as part of the overall equation.

Management and Team

Assess your overall supply chain management and team bandwidth, strengths, and weaknesses. This is in many respects no different than any other organization-wide project that you may pursue: it’s the team on the ground that will have to make it happen and change management will likely be a significant part of the overall project.

As noted in Supply Chain Management Review: Supply chain and business leaders must model High Performing Organization (HPO) culture, not only embracing new behaviors like adaptability, emotional intelligence and diplomacy, but also abandoning leadership behaviors that reduce employee engagement, inclusion and empowerment. Leadership must anticipate the resources employees need and make them feel safe to openly discuss mistakes and lessons learned to encourage smart risk-taking and agility.³

Consequently, you will need to ask questions like:

What is your supply chain management organizational structure and how would it need to change with reshoring?
Does your team have the resources they need to establish new suppliers and ensure these suppliers’ success?
Is your current team environment one in which the challenges of major supply chain changes can be openly discussed, measured, and acted upon?

As you determine the role your team will play in your new supply chain ecosystem, be sure to consider potential partnerships with suppliers. Partnerships can effectively expand your own team in addition to providing a real-time link to your most critical suppliers.

Completing your reshoring plan will require far more work than the starting points listed above but the initiative may have substantial benefits that help your company achieve long-term success. If you are struggling with how to make the leap from vision to project, these key points can help kick-off the process and give you the information you need to start a reshoring project.

With project managers located within two hours of any manufacturing plant in Georgia, the Georgia Manufacturing Extension Partnership at Georgia Tech, can help you locate the suppliers you need to reshore, assess the ability of your organization to support a reshoring strategy, and advise you on your analytics and technology. Contact us for more information on supply chain services or help with other aspects of your business.

¹www.reshorenow.org

² “Supply Chain Trends to Watch – 2021”, www.sourcingandsupplychain.com

³ “Developing High Performance Leadership”, Supply Chain Management Review, www.scmr.com

By: Dean Hettenbach, Project Manager, Georgia Manufacturing Extension Partnership

Food Safety Auditing News

July 1, 2022 By

October 2022

Get Ready for BRCGS Issue 9 Changes

Certification audits against Brand Reputation Compliance Global Standards (BRCGS)’s new standard will start on February 1, 2023.

These changes were derived from the most common non-conformities for Issue 8. In fact, these eight clauses counted for 30% of all non-conformances over the past few years:

11.1 – Premises and equipment hygiene
4.8 – Doors – both internal and external
6.1 – Equipment construction and maintenance
9.1.1 – Chemical control
4.1 – Walls – condition and cleaning
7.1 – Hazard identification
15.1 – Risk assessment for safe storage of ingredients
1.2 – Food Safety culture plan

Here’s a list of the Key Changes from BRCGS Issue 8 to Issue 9:

Product Safety Culture – Consideration of the behavior changes needed to improve culture
- Sites shall plan to maintain and develop product safety and quality culture within the business
HACCP/Food Safety Plan – Latest publication of the Codex Alimentarius HACCP principles influence update to several clauses
- The food safety plan/HACCP requirements updated with the Codex Alimentarius HACCP principles
- Sites are advised to avoid having multiple plans with different terminology
Outsourced Processing – New requirements added to ensure outsourced processes are built into a site’s HACCP plan and requirements agreed in a specification
- Statement of Intent updated to ensure clarity
- New requirements added to ensure outsourced processes are built into a sites HACCP plan and requirements agreed in a specification
Root Cause Analysis
- Clauses reviewed to ensure consistent approach
- Better linkage to other sections for continual improvement
Food Defense
- Section now specific to food defense requirements
- Clauses mirror food fraud section, so the site can choose to consider the two topics (food defense and food fraud) together
Equipment – Several standards and industry guidelines updated that provide detailed recommendations for hygienic equipment. Section updated to align with current industry best practices.
- Consideration when purchasing new equipment or equipment that is new to the site
- New clause on installation and commissioning
- New clauses on mobile & static equipment. Battery charging considerations.
- Requirements for moveable equipment (when moved from one area to another or outside)
Animal Primary Conversion (slaughter) – New section. Specific controls are required to ensure that food remains safe, authentic, and legal during animal slaughter/dressing.
- New section
- The clauses within this section are closely linked to clauses within other sections of the Standard.
Changes to audit format options
- Blended audit (optional) – document review can be remote, followed by a shorter, onsite visit. Only available for announced options. Still required to have one unannounced every three years.
Unannounced audit – one in three audits must be unannounced. (Already introduced in 2020)

Visit BRCGS’s website for more information.

Have a customer that is asking for a third-party audit and don’t know where to start? GaMEP food-industry experts explain the process and help you prepare to satisfy this frequent customer requirement in our recent webinar, “Demystifying GFSI, SQF, and other Third Party Audits.”

If you need additional assistance getting started, GaMEP can help you prepare for third-party food safety audits by conducting a comprehensive onsite gap assessment. Please visit our Food and Beverage Industry Page or reach out to GaMEP’s Food Safety Industry Manager, Wendy White, for more information.