GA Manufacturing Extension Partnership (GaMEP) Georgia Tech

NuGen Systems Wins with Safety and Sustainability

By

NuGen Systems wins a check for $5000 at the Innovation Test Track competition for innovation in automotive technologies.

NuGen Systems, a manufacturer of rechargeable battery-based solutions, was started in 2016 by co-founder and CEO, Venus Desai, with the goal of designing a safer, more powerful lithium-ion battery solution (using lithium iron phosphate chemistry), to replace the lead acid batteries commonly used in  industrial applications. Finding it difficult to break into well-established markets as a component of other products, NuGen began designing its own products made with its batteries, to market independently. The company found a fit for their battery solution in the mobile generator market.

Gas-powered generators are noisy, produce carbon monoxide (which is harmful for both people and the environment), and can be a fire hazard. The Consumer Product Safety Commission recently released a report estimating that about 85 consumers die in the U.S. each year from carbon monoxide poisoning caused by gasoline-powered portable generators and noting that one portable generator can produce the same amount of carbon monoxide as hundreds of cars. However, until recently, they were the only available option for many mobile businesses like food trucks and car maintenance services. NuGen set out to provide a safer, greener option.

To help make the transition, the company drew upon its network of resources at the Georgia Tech Enterprise Innovation Institute. NuGen, a member of the Advanced Technology Development Center (ATDC) since the company was founded, worked with coach and manufacturing catalyst, Shane Matthews, to help  build and test the idea, write a business plan, and access mentors and advisors in strategy, finance, and other areas of expertise.

Through ATDC, the company was invited to a webinar hosted by another Enterprise Innovation Institute program, the Georgia Minority Business Development Agency Business Center (MBDA Business Center). There, NuGen connected with the Georgia Manufacturing Extension Partnership (GaMEP) and with Mike Stonecipher, group manager of strategy and leadership development. Stonecipher immediately saw the potential for the company to participate in the Innovation Test Track Competition®, an automotive-related pitch competition that he helps organize each year.

Stonecipher encouraged the company to participate in the competition, which is designed to bring new technology to the automotive industry while also giving entrepreneurs a chance to showcase their automotive-related products. Participating start-ups are provided with coaching and networking opportunities with representatives from major automotive original equipment manufacturers (OEMs) and other business leaders.

Desai and his team worked with their Innovation Test Track® advisor to refine their pitch, including quantifying how much environmental impact their product could make if the gas generators in the U.S. (approximately 15 million) were replaced by battery-powered generators. They also participated in pitch practice sessions hosted by the Georgia MBDA Business Center program to help them prepare.

On Oct. 6, 2022, NuGen Systems competed in and won the competition, hosted at the Southern Automotive Conference in Duluth, Georgia. The prize awarded was $5,000 cash provided by SAE Atlanta, plus $5,000 in consulting services provided by Clarity Capital Advisors.

NuGen’s next step is to launch a subscription model to provide easier access to the product for small businesses. The model will allow businesses to essentially rent the equipment for a low monthly fee, approximately what it would cost to purchase the gas needed to run a traditional machine and complete regular maintenance.

NuGen plans to use the strategy services provided as part of the competition prize to develop this business model and then pursue the food truck market across the U.S., a booming industry that is estimated to include more than 35,000 operations currently and continues to grow.

To learn more about the Innovation Test Track® Competition or GaMEP’s automotive industry services, contact Mike Stonecipher at ude.hcetag.etavonninull@rehpicenots.ekim

CMMC Q&A: Cybersecurity Requirements for DoD Contractors

By

CMMC Q&A: Cybersecurity Requirements for DoD Contractors

Cybersecurity Maturity Model Certification (CMMC) is a framework of various cybersecurity standards and best practices to safeguard sensitive national security information from increasingly frequent and complex attacks. CMMC 2.0 compliance is a requirement for all government contractors working with the Department of Defense (DoD).

In 2015, the DoD released the Defense Federal Acquisition Regulation Supplement (DFARS), a series of cybersecurity requirements contractors and subcontractors in the Defense Industrial Base (DIB) had to follow to protect Controlled Unclassified Information (CUI). As part of the certification process, it includes complying with the National Institute of Standard and Technology (NIST) Special Publication (SP) 800-171 Revision 2 (NIST SP 800-171 R2).

Contractors will lose existing DoD contracts and won’t be able to bid for new ones until they can demonstrate compliance with the required level in the contract. The Department of Justice (DOJ) has also launched the Civil Cyber-Fraud Initiative, which will utilize the False Claims Act to pursue cybersecurity-related fraud by government contractors and grant recipients who falsely claim compliance.

What are the CMMC Requirements?

In 2020, the Department of Defense (DoD) began to demand a self-assessment using a points-based system to prove compliance from defense contractors – an honor system, if you will. After completing the self-assessment, contractors are required to submit their scores to the DoD’s Supplier Performance Risk System (SPRS). A System Security Plan (SSP) is also required, containing comprehensive details of the organization’s networks, systems, processes, policies and security controls including how those controls are being implemented and improved over time. Contractors must currently have a SPRS score listed in the SPRS database in order to bid and receive DoD contracts.

In a significant move, the DoD introduced the Plan of Actions and Milestones (POAM) where organizations who have not yet fully implemented 800-171 can submit a solid plan for achieving full compliance, with specific dates and a timeline. This POAM is submitted with the SPRS and enables organizations to begin working for federal agencies whilst they simultaneously work towards full implementation of 800-171. Once CMMC is fully implemented, the timeline for completing a POAM is six-months from submission of a SPRS score and POAM.

Companies that handle CUI must also submit to and pass an independent audit proving that they meet the 110 controls outlined in NIST 800-171 R2. This audit is at the company’s expense.

When will CMMC Certification be required?

Mandatory SPRS score reporting has already begun in order to bid for contracts (to include creation of an SSP and POAM). Voluntary audits of those who claim to be CMMC compliant began in August 2022. It is expected that all the requirements of CMMC will be finalized by end of first quarter 2023.

Who needs CMMC Certification?

CMMC is required of any individual in the DOD supply chain, including contractors who interact exclusively with the Department of Defense and any and all subcontractors. According to the DOD, the CMMC requirements will affect over 300,000 organizations.

How will CMMC 2.0 be enforced?

Today, companies without a SPRS score cannot bid for new contracts. Those that can show compliance to CMMC Level 2 or 3 must submit to an audit by a third party. Failing the audit could result in loss of contracts or the ability to bid for future contracts. Any company that falsifies their compliance could face a False Claims Act lawsuit from the Department of Justice. The DOJ has already begun pursuing and collecting millions in fine from cases of cybersecurity-related fraud by government contractors and grant recipients.

What will be the consequences of not completing CMMC Certification?

Non-compliant companies will lose the ability to bid for new DoD contracts.

What are the different CMMC Levels?

You may be asking yourself, “What CMMC level do I need?” Determining the CMMC level you need depends on the type of services and information that your company accesses and stores in your information systems.

CMMC requirements are based on the type of information a company handles. Companies that provide COTS (Commercial off-the-shelf) service to the DoD and only handles Federal Contract Information (FCI) must comply with CMMC Level 1. All companies that handle CUI (Controlled Unclassified Information) must comply with Level 2 or 3 and have implemented 110(+) controls as well as prove successful implementation through an audit by an independent agency. For more details:

  • Level 1 (Foundational) only applies to companies that focus on the protection of FCI. Level 1 is based on the 17 controls found in FAR 52.204-21, Basic Safeguarding of Covered Contractor Information and focus on the protection of FCI. These controls look to protect covered contractor information systems and limit access to authorized users.
  • Level 2 (Advanced) is for companies working with CUI. CMMC 2.0 Level 2 requirements mirror NIST SP 800-171 and aligns with the document’s 14 levels and 110 security controls developed by the National Institute of Technology and Standards (NIST) to protect CUI.
  • Level 3 (Expert) is focused on reducing the risk from Advanced Persistent Threats (APTs). It is designed for companies working with CUI on DoD’s highest priority programs. The DoD has indicated that its requirements will be based on NIST SP 800-171’s 110 controls plus a subset of NIST SP 800-172 controls.

In addition, Levels 2 and 3 will required a third-party assessment. See the chart below for an overview.

Chart Explaining Levels 1-3 of the CMMC 2.0 Model

Are the CMMC requirements for small businesses the same as those for larger businesses?

CMMC requirements are not based on the size of the business but the type of information to which the company has access in order to do business with the DoD. Companies that only handle FCI (Federal Contract Information) do not have as stringent requirements as those who handle CUI (Controlled Unclassified Information).

How do I complete a CMMC Audit?

CMMC requires all DoD contractors that meet the requirements for Level 2 or 3 to get audited and obtain certification from a trusted and approved third-party assessment organization (C3PAO). For Level 2 compliance the CMMC Accreditation Body (CMMC-AB) is responsible for reviewing audits and issuing certificates, however C3PAO must perform an audit. For a small subset of contractors who must comply with Level 3, the federal government will conduct the audit.

The CMMC audit cost depends on the size of an organization. Notably, Companies should expect to incur the following types of costs in a CMMC audit process:

  • Audit preparation costs: Also referred to as soft costs, audit preparation costs are the expenses for preparation and external consultancy.
  • Hard costs: Hard costs are also incurred in audit preparation and the audit process and may involve investments made in processes needed to meet audit. This also includes costs for implementing authentication mechanisms, endpoint security, and log monitoring.

What is the total cost to get CMMC Certified?

There is no set cost to CMMC compliance. In addition, CMMC is not a “one and done” milestone. It will require time, personnel and expense to both achieve initial compliance and the work necessary to maintain compliance. CMMC Certification costs will vary by company depending on:

  • what level of compliance needs to be achieved,
  • where a company is in their current journey to CMMC compliance,
  • the types of controls that need to be purchased, installed, configured and in place to achieve compliance,
  • the cost of managed service providers (MSPs) and other vendors to perform installation and configuration of said controls,
  • the cost of maintaining systems and controls and
  • the cost of additional employees to maintain, update and manage the Risk Management, Policy and Procedure, Monitoring and Audit aspects of NIST 800-171 required to keep the company in compliance.

A good rule is that it will take most companies six to 12 months of time, talent and information system upgrades to gain compliance.

How long does it take to become CMMC Certified? 

General estimates are six to twelve months to achieve compliance and certification.

How does CMMC compare to NIST 800-171?

NIST SP 800-171 lays out the requirements for any non-federal agency that handles controlled unclassified information (CUI), or other sensitive federal information. It details how organizations should protect this information. First published in 2015, the goal is to strengthen the federal supply chain and ultimately protect national security as a whole.

The “800-171”, as it’s known, is made up of 110 controls divided into 14 control families, and takes around half a year to implement. It’s important to note that there is no certification to prove compliance with this framework. It was originally developed to provide guidance to the DFARS clause (the Defense Federal Acquisition Regulation Supplement)- the original cybersecurity requirements from the DoD.

Since DFARS is still a listed requirement in most government contracts, if you are bidding on a contract or have been awarded the work, you’ll need to be compliant with all 110 NIST 800-171 controls in order to fulfill the DFARS clause.

Unfortunately, due to the lack of certification, the DoD found that contractors were claiming to uphold all of the NIST 800-171 standards, but in reality, they were not. DoD decided that it was necessary to develop a certification process to ensure that contractors were compliant with a basic set of cybersecurity controls: thus the CMMC and NIST 800-171.

How can GaMEP help my company become CMMC Compliant?

GaMEP can perform a CMMC Gap Analysis and Readiness Assessment. The gap analysis and readiness assessment are foundational steps for companies to gain a detailed understanding of how close they are to meeting the requirements of their targeted CMMC level.

The Readiness Assessment will help uncover systems and processes that may not meet the standards outlined in NIST 800-171, such as:

  • How is data stored and access to information controlled?
  • Are incident response plans in place, current, and effective?
  • Are IT staff and other personnel adequately trained?
  • How are security protocols implemented and maintained?

The resulting Gap Analysis will pinpoint risk areas for contractors and facilitate the creation and execution of the Remediation Plan, either by the MSP or utilizing in-house resources. From the Gap Analysis, GaMEP can assist a company with creating the SPRS, SSP and POAM necessary to begin the CMMC process and bid for DoD contracts.

Without an exhaustive Gap Analysis in hand, DoD contractors may find it impossible to identify risks, prioritize activities, and determine costs for any remedial steps required for CMMC certification.

What if I am not located in Georgia?

Check with your local state MEP to see if they can provide CMMC services.

Where can I complete CMMC training or learn more about CMMC requirements?

You can learn more about CMMC by contacting your GaMEP regional manager or by filling out the Contact Us form.

By: Michael Barker, GaMEP Cybersecurity Project Manager

Reshoring Your Supply Chain: Starting Points for Small to Mid-Size Manufacturers

By

Shipping Containers at a Port.

“Reshoring”, also known as onshoring, has never been a hotter buzzword, leaving many to ask what is reshoring and what could it mean for your business?

The definition of reshoring is “the practice of bringing manufacturing and services back to the U.S. from overseas”1 Reshoring as a supply chain initiative has been around for over a decade, but as ports are bottlenecked and transportation costs continue to climb, companies and customers are frustrated and beginning to see it as a more attractive option than ever before. Add in extended lead times and shortages in consumer products and you have what seems to be the foundation of a reshoring strategy.

Yet the thought of reshoring some or all of the supply chain for a small or mid-sized manufacturer who may already be struggling with limited resources can seem to be an overwhelming task. Conceptually, it makes sense. Reshoring can solve problems, mitigate risk, lower costs, provide a ‘greener’ solution, and even create jobs. Catching this vision, especially now, is easy, but putting a plan in place to achieve this goal may seem impossible.

One approach is to focus on a few key starting points to research and analyze the advantages and disadvantages of reshoring, while conserving your valuable resources and giving your team the information they need to make strategic decisions.

History

Go back to why the decision was made to move the supply chain offshore. Dust off the presentations and pull those old Excel files from the archives. Answer these questions:

  • What was it that drove this decision?
  • What has changed since the decision was made?
  • If you used current data with the same criteria, would the evaluation yield the same recommendation?
  • What have been the positive results of this move?
  • While recent challenges have magnified the disadvantages of offshoring, when was the offshore supply chain working well and why?
  • Are there reshoring disadvantages that should be evaluated?

There is a reason that reshoring wasn’t seriously considered until now, and you have to find that reason to make an informed decision.

Problem Statement and Solution

Once you understand why the supply chain went offshore in the first place, you must quantify the current problem, or problems, you are trying to solve. Reshoring cannot be a solution in search of a problem – that approach won’t be sustainable. This is where narrowing the focus to match your available resources becomes critical. Write a problem statement to help you discover:

  • Are there a handful of components that are driving the majority of your problems?
  • How will reshoring, specifically, address the problems and provide a more workable solution than the current supply chain?
  • Are there solutions other than reshoring that could also address these problems?

Focus on real, tangible issues and start small, otherwise your problem statement will become so large or general that it’s meaningless or unattainable.

Technology

Evaluate your current supply chain technology and determine how it can be leveraged to support reshoring.

The supply-chain industry has understood that it can no longer treat technology as an isolated service, i.e., as a means to an end. Technology will inevitably become the backbone of the supply-chain industry. 2

While this backbone will be critical to successful reshoring, the key to success is to keep it simple. Utilize what you have, while in parallel beginning to build a longer-term vision and supporting strategy.

Many small to mid-sized manufacturers have much of their supply-chain data in Excel files downloaded from an ERP system of some type. If that’s the case, build a visual of these siloed Excel databases and determine your starting point, then ask these questions:

  • Will the technology and data you are using to support offshore suppliers have to change in some way to provide the supply chain visibility you need for reshoring?
  • Can you leverage the suppliers’ technology and/or integrate it with yours easily?
  • What benefits would there be to implementing new technology?
  • Does your team have the bandwidth to take on a new technology implementation right now?

Analytics

Make sure you are measuring apples to apples as you evaluate costs. If your analytics have not evolved over time to keep up with global supply chain evolution, this needs to be addressed before any final recommendations regarding the solution to your current supply chain problems can be made. In this regard, evaluating these questions can help get you started:

  • How are you measuring your supply chain?
  • Are you considering all parts of the landed cost equation?
  • Are you factoring in cost predictability, possible import tariffs, carbon offset costs, or what you may have to spend to react to a late or cancelled delivery?

Take a big picture approach to evaluating costs for both onshoring and offshoring. While you can’t necessarily predict future unknown costs or disruptions, you can account for possible or likely risks and weigh them as part of the overall equation.

Management and Team

Assess your overall supply chain management and team bandwidth, strengths, and weaknesses. This is in many respects no different than any other organization-wide project that you may pursue: it’s the team on the ground that will have to make it happen and change management will likely be a significant part of the overall project.

As noted in Supply Chain Management Review: Supply chain and business leaders must model High Performing Organization (HPO) culture, not only embracing new behaviors like adaptability, emotional intelligence and diplomacy, but also abandoning leadership behaviors that reduce employee engagement, inclusion and empowerment. Leadership must anticipate the resources employees need and make them feel safe to openly discuss mistakes and lessons learned to encourage smart risk-taking and agility.3

Consequently, you will need to ask questions like:

  • What is your supply chain management organizational structure and how would it need to change with reshoring?
  • Does your team have the resources they need to establish new suppliers and ensure these suppliers’ success?
  • Is your current team environment one in which the challenges of major supply chain changes can be openly discussed, measured, and acted upon?

As you determine the role your team will play in your new supply chain ecosystem, be sure to consider potential partnerships with suppliers. Partnerships can effectively expand your own team in addition to providing a real-time link to your most critical suppliers.

 

Completing your reshoring plan will require far more work than the starting points listed above but the initiative may have substantial benefits that help your company achieve long-term success. If you are struggling with how to make the leap from vision to project, these key points can help kick-off the process and give you the information you need to start a reshoring project.

With project managers located within two hours of any manufacturing plant in Georgia, the Georgia Manufacturing Extension Partnership at Georgia Tech, can help you locate the suppliers you need to reshore, assess the ability of your organization to support a reshoring strategy, and advise you on your analytics and technology. Contact us for more information on supply chain services or help with other aspects of your business.

1www.reshorenow.org

2 “Supply Chain Trends to Watch – 2021”, www.sourcingandsupplychain.com

3 “Developing High Performance Leadership”, Supply Chain Management Review, www.scmr.com

By: Dean Hettenbach, Project Manager, Georgia Manufacturing Extension Partnership

Driving Advanced Manufacturing in Georgia

By

Man operating a large machine at an aluminum manufacturing plant.

Advanced manufacturing in Georgia is a huge deal – the sector is responsible for 10 percent of state gross domestic product (totaling nearly $62 billion in 2019), 92 percent of exports, and employs more than 380,000 people. The sector’s importance is no accident. It’s the result of — according to the Georgia Department of Economic Development’s Center of Innovation for Manufacturing — the pro-business climate in the state; a well-trained workforce; and a location and logistics network that allows companies to reach 80 percent of the United States in hours by truck, train or plane. The Port of Savannah, with its link to the rest of the world, doesn’t hurt either.

Georgia Tech contributes to this all-important economic driver in a number of ways, including through the Georgia Manufacturing Extension Partnership (GaMEP) and other programs of the Enterprise Innovation Institute, that support manufacturers through coaching, training, and on-site project implementation. These programs help to connect companies to other Georgia Tech resources including, the Advanced Manufacturing Pilot Facility (AMPF), an R&D facility that provides space for industrial, academic, and government agencies, while also serving as a teaching lab for graduate students. Funded by a $3 million gift from the Delta Air Lines Foundation, AMPF is part of the Georgia Tech Manufacturing Institute.

Learn more about how Georgia Tech contributes to the manufacturing ecosystem in the state in the recent article, “High-tech Makers,” in Georgia Trend magazine.

Contact us for information on how GaMEP can connect you with resources at Georgia Tech and partner organizations. Thinking about implementing a new technology in your facility? Visit our Technology page, to see how GaMEP can help.

Cybersecurity Horror Stories from the GaMEP

By

Cybersecurity Horror Stories for the Gamep

Since its inception in October of 2004, Cybersecurity Awareness Month serves as a reminder of the importance of cybersecurity, providing individuals and organizations with the information and tools they need to be safer and more secure online. However, even as the cybersecurity industry continues to grow at a rapid rate each year, many organizations – especially small and medium-sized manufacturers – remain vulnerable and should start implementing processes now to protect themselves from the risk of cyberattacks.

According to Cybint, 95% of cybersecurity breaches are caused by human error. If a cybercriminal or hacker infiltrates your company, it’s generally through your weakest link and rarely in the IT department. This staggering statistic could be reduced if employee training at all levels was a critical component of every organization’s cybersecurity plan. With adequate training, employees can better understand what kind of vulnerabilities and threats their business operations are more likely to fall victim to.

Unfortunately, implementing a robust cybersecurity plan can sometimes prove to be intimidating and many organizations may not know where to start or how to engage their employees in the process. To keep things simple in the beginning, encourage your employees to abandon their practice of bad cyber hygiene habits. Not sure what some of these habits may look like? Read below for a list of the top 10 scariest cybersecurity mistakes our team has come across in the field:

1. Office staff with several computers all sharing the same login information on a post-it note in clear view.

2. Opening attachments on emails from unknown senders.

3. Allowing staff to transfer secure files to a USB stick to allow them to work on a home computer and then retransfer the file back to the office network computer the next day.

4. Not backing up critical manufacturing data and files to password-protected cloud storage or a secured server.

5. Failing to realize that the third-party service provider responsible for backing up critical manufacturing data did not complete the backup, or was not completing the backup daily as agreed upon.

6. Having your data unavailable due to a cyberattack and having to pay ransomware because you cannot resurrect your system data.

7. Not running recommended Windows or Mac system updates for known security issues regularly.

8. Assuming that cybersecurity is your MSP’s (managed service provider) problem since you pay them to keep your network safe.

9. Failing to keep your staff educated on and aware of phishing scams – which account for more than 80% of reported security incidents (CSO Online).

10. Believing that your organization is too small to be affected by a cyberattack because you only have a few computers connected to the internet.

Help reduce your organization’s vulnerability and cybersecurity risks by not committing any of these cyber-cardinal sins. For more information on how you can combat cyber threats and implement an effective cybersecurity plan, check out the following resources:

View our flyer on GaMEP’s General Cybersecurity Assistance Service

Visit the GaMEP Technology Services webpage 

Or

View the NIST MEP Manufacturers’ Guide to Cybersecurity.

By: Megan Johnson, Georgia Manufacturing Extension Partnership