We only make one part. How exposed can we be?

Exposure is not proportional to catalog size. One email thread with controlled drawings is enough to put a shop in scope.

Do we have to replace our ERP to comply?

Usually not. Segregation, access, and evidence can most often be built around what exists. Replacement is a last resort, not a starting assumption.

Aviation, aerospace & defense

MRO shops, parts manufacturers and distributors, machine shops, and defense subcontractors around Florida's airports and space coast.

How this business actually runs

The product is a part plus its paperwork. A component without traceability is scrap, whatever it cost to make. Work orders, certifications, and technical data cross the shop floor, the front office, and a chain of primes and suppliers. The contract flows requirements down that chain whether the business reads them or not.

The systems and the data

ERP/MRP, CAD/CAM, quality management and its evidence, customer and supplier portals, and the places controlled technical data actually hides: email threads, quote folders, shop-floor machines, personal drives. The gap between where that data is supposed to live and where it does live is the industry's most common finding.

What most shops think they need, and what comes first

Most think they need a compliance tool, bought before anyone has assessed anything. What comes first is knowing where controlled data actually lives and who can reach it, including the machine in the corner running an operating system nobody will name out loud. Assessment before tooling; the tool decision falls out of the map.

Obligations and local texture

CMMC requirements are entering defense contracts through the acquisition rule published in September 2025 and effective since November 10, 2025, and they flow down to subcontractors: size does not exempt the shop that touches controlled information.
Export-controlled technical data carries access obligations regardless of company size or contract value.
Florida's data protection statute requires notifying affected residents within 30 days of determining a breach.

What excellent looks like here

Controlled technical data is mapped and segregated: everyone can say where it lives and where it must never appear.
Access follows role and contract, not seniority or habit. Offboarding is same-day.
Traceability runs from part to paperwork in minutes, not in an afternoon of searching.
Flow-down requirements can be demonstrated in writing when a prime asks, because they will ask.
Quality evidence and security evidence come from the same discipline: records kept as the work happens.

How you’d start

Whatever the industry, the entry point is the technology diagnostic: this page's systems and obligations, assessed on your operation.

Questions owners ask

If controlled information touches your systems, the requirement flows down to you through the contract. The honest first step is finding out whether it does. Many shops discover it lives in places they never intended.

Customer Success Team

Itaca Technologies

Your question isn't here?

Ask it as you'd ask it across the table. The team that does the work reads it and answers with a concrete next step.