By ProTelesis Corporation | ProTelesis Blog
Weber County builds the parts that keep the Hill Air Force Base supply chain moving — and that puts its manufacturers under a different set of IT rules than the rest of the economy. The composites shops, machine houses, propulsion suppliers, and component assemblers concentrated around Ogden and the Business Depot Ogden don’t just need fast networks and reliable email. They need CMMC-aligned cybersecurity, CUI-grade handling, plant-floor OT security, audit-ready managed IT, and a local partner that understands the gap between a commercial environment and a federally-flowed-down one.
ProTelesis serves Weber County manufacturers across Ogden, Roy, West Haven, North Ogden, South Ogden, Riverdale, and Pleasant View with a portfolio purpose-built for organizations whose buyers, auditors, or prime contracts ultimately trace back to the Department of Defense and the aerospace primes. Below is a regional view of how the work breaks down — and how to get plant-floor and back-office IT ready for the compliance deadlines reshaping the defense supply chain through 2028.
Why Weber County’s Manufacturing IT Stakes Are Higher Than Most
Weber County sits directly north of Hill Air Force Base, and its industrial base has grown up around the base’s sustainment mission. The Business Depot Ogden (BDO) — a roughly 1,118-acre industrial park built on the footprint of the former Defense Depot Ogden — anchors that base. BDO today carries more than 12.5 million square feet of warehousing, manufacturing, and office space and is home to over 130 businesses and several thousand employees. Among its tenants are aerospace and precision-manufacturing operations such as Barnes Aerospace, JD Machine (a contract manufacturer of complex components and assemblies for medical, aerospace, and defense), and Setpoint.
Beyond BDO, the broader Ogden–Clearfield area hosts a deep aerospace and defense cluster. Williams International operates a modern gas-turbine design-to-production facility in Ogden producing jet engines for business aircraft and military systems. Northrop Grumman is expanding its footprint near Hill in the Roy area in support of the Sentinel intercontinental ballistic missile program. Regional advanced-manufacturing employers also include names like Boeing, Parker Hannifin, and Borsight. Workforce flows from Weber State University‘s ABET-accredited Manufacturing Engineering Technology program — including its Plastics & Composites emphasis and the Miller Advanced Research and Solutions (MARS) Center — and from Ogden-Weber Technical College‘s composites program.
For a non-defense business, “good IT” means uptime, decent backups, and a help desk. For a Weber County manufacturer feeding the aerospace and defense supply chain, “good IT” includes:
• Demonstrable compliance with CMMC 2.0, NIST SP 800-171, and DFARS 252.204-7012 — usually flowed down from a prime, not received directly from the DoD
• Controlled Unclassified Information (CUI) handling across endpoints, file shares, email, ERP, and the engineering data that drives the shop floor
• ITAR export-control discipline over technical data, and AS9100 quality-system alignment for aerospace work
• IT/OT convergence security — segmenting MES, SCADA, CNC controllers, and ERP so a phishing email on the front office can’t reach the plant floor
• A managed-services partner that won’t disappear when a 72-hour cyber-incident reporting window starts ticking
The Compliance and Technical Spine Driving Local IT Investment
If you manufacture — directly or as a sub-tier supplier — for the DoD or an aerospace prime, a handful of frameworks now drive the majority of IT budget conversations in Weber County.
CMMC 2.0 (Cybersecurity Maturity Model Certification)
CMMC 2.0 was codified in the DoD’s final rule at 32 CFR Part 170, which took effect on December 16, 2024. It establishes three certification levels:
• Level 1 (Foundational) — 17 basic safeguarding practices, annual self-assessment. Applies to contractors who only handle Federal Contract Information (FCI).
• Level 2 (Advanced) — Implementation of all 110 NIST SP 800-171 Rev 2 practices. Most CUI-handling manufacturers land here. Triennial third-party assessment by a C3PAO for prioritized programs; annual self-assessment for select others.
• Level 3 (Expert) — All Level 2 practices plus a subset of NIST SP 800-172 enhanced controls. Triennial government-led assessment. Reserved for the highest-priority programs.
The companion DFARS rule (48 CFR) phases CMMC requirements into new and existing contracts across roughly three years, with Level 2 self-assessment requirements appearing first and third-party certifications ramping through 2028. Translation: if your shop touches any CUI today — a controlled drawing, a spec, a technical data package — the clock is already running.
NIST SP 800-171 and DFARS 252.204-7012
NIST SP 800-171 is the underlying control framework defining how non-federal organizations must protect CUI. Revision 2 (110 controls across 14 families) is the version mapped into CMMC Level 2; Revision 3, published May 14, 2024, restructured the catalog and added explicit organization-defined parameters. The contract clause that has carried these obligations since 2017 is DFARS 252.204-7012, which also imposes a 72-hour cyber-incident reporting duty to the DoD Cyber Crime Center (DC3). Companion clauses 7019 and 7020 added Supplier Performance Risk System (SPRS) self-assessment scoring; 7021 implements the CMMC certification requirement. Most Weber County sub-tier suppliers first see this language flow down from a prime — not from the DoD directly.
ITAR, AS9100, and the OT Frameworks That Make Manufacturing Different
Manufacturers carry obligations that pure office contractors don’t. ITAR (the International Traffic in Arms Regulations) governs export-controlled technical data — a CAD file or process sheet for a defense article can be an “export” the moment a foreign-person employee or an offshore cloud region can see it. AS9100 layers aerospace quality-management requirements on top of ISO 9001, with configuration and document control that your network has to support. And because the shop floor runs on operational technology — CNC machine tools, MES, SCADA, programmable controllers — IEC 62443 and the NIST guidance on OT/ICS security drive how that environment must be segmented from IT. The presence of CUI, export-controlled data, and connected OT all in one building is exactly what makes a defense-supply-chain plant harder to secure than a commercial one.
How ProTelesis Maps Services to the Plant Floor and Back Office
ProTelesis is a managed services provider, systems integrator, and carrier-class voice + network specialist. For aerospace and defense manufacturers in Weber County, our portfolio aligns to the threats, controls, and audit obligations that come with both the front office and the production floor.
Managed Cybersecurity (24×7 SOC, MDR, SIEM)
The mandate: NIST 800-171 families AC, AU, IR, SI — Access Control, Audit & Accountability, Incident Response, System & Information Integrity. CMMC Level 2 explicitly requires continuous monitoring and documented incident-response, and ransomware is the dominant threat to mid-market manufacturers.
What we deliver:
• 24×7 Managed Detection & Response (MDR) with EDR coverage across endpoints, servers, and identity
• SIEM ingestion + log retention to satisfy AU control-family evidence — extended to OT assets, not just IT
• Incident-response playbooks aligned to the 72-hour DoD Cyber Crime Center (DC3) reporting window
• Ransomware defense: immutable/air-gapped backups, tested restore runbooks, and rapid containment for production-critical systems
• Vulnerability management and user awareness training (RA, CA, and AT families) — practical and audit-documented
CMMC / NIST 800-171 Compliance-Ready Managed IT
The mandate: A System Security Plan (SSP) and Plan of Action & Milestones (POA&M) an assessor can trace to your environment — not a binder of policies that don’t match reality — plus a defensible SPRS score.
What we deliver:
• Managed Microsoft 365 GCC / GCC High deployments with conditional access, MFA enforcement, and DLP for CUI — GCC High where ITAR data is in scope
• Hardened endpoint baselines (CIS Benchmarks, Microsoft Security Baselines) with documented configuration management
• Patch management, asset inventory, and configuration drift detection across IT and (where feasible) OT (CM and SI families)
• SSP authoring and ongoing POA&M maintenance — the documents your prime, your auditor, and your contracting officer will all ask for
• SPRS score advisory and assessment readiness coaching ahead of C3PAO engagements
IT/OT Network Engineering & Plant-Floor Segmentation
The mandate: Logical and physical separation between CUI, commercial, and OT environments; hardened boundary protection (SC family); and an architecture aligned to IEC 62443 zones and conduits so the production network can’t be reached from the front office.
What we deliver:
• Segmented LAN/VLAN architectures isolating MES, SCADA, CNC controllers, and ERP from commercial and guest traffic
• Next-generation firewalls with deep packet inspection, IDS/IPS, and OT-aware protocol visibility at the IT/OT boundary
• Zero Trust Network Access (ZTNA) for engineers, vendors, and remote machine-tool support connecting from outside the enclave
• Secure file transfer for technical data packages, with FIPS 140-3 validated cryptography wherever CUI or export-controlled data moves
• Network monitoring tuned for the long lifecycles and patch sensitivity of industrial control systems
Structured Cabling & Industrial Wireless for High-Bay Plants
The mandate: The physical layer is still the most common single point of failure on a manufacturing site — and high-bay, RF-hostile production space defeats consumer-grade wireless.
What we deliver:
• BICSI-aligned Cat 6A / fiber backbone design, install, and certification across office, lab, and production zones
• Industrial wireless and Wi-Fi 6/6E coverage engineered for high-bay ceilings, racking, and metal-dense environments
• Cabling and pathway design that keeps CUI, OT, and guest networks physically and logically distinct from the start
• Pre-construction consulting and IT scoping for build-outs and expansions across the Business Depot Ogden and the West Haven / Roy industrial corridors
Secure Communications & Unified Communications
The mandate: Voice, video, and messaging that can carry sensitive program discussion without leaking it through consumer apps or unsecured carriers — and that reaches every corner of a loud, sprawling plant.
What we deliver:
• Hosted UC and SIP trunking with carrier diversity and survivability for mission-critical voice
• Microsoft Teams / Cisco Webex deployments aligned to GCC High where CUI or ITAR data is in scope
• Overhead paging, plant-floor handsets, and ruggedized endpoints integrated with the corporate phone system
• E911 + emergency notification compliant with Kari’s Law and RAY BAUM’s Act, with location accuracy across multi-building campuses
Physical Security & Access Control
The mandate: NIST 800-171’s Physical Protection (PE) family and ITAR access controls both require limiting who can reach controlled areas, equipment, and data — and proving it.
What we deliver:
• IP video surveillance and access control designed to protect CUI work areas, server rooms, and export-controlled zones
• Badge and credential systems with audit logging that supports both PE-family evidence and ITAR access records
• Physical security networks engineered so cameras and door controllers don’t compromise the production or CUI networks they share a building with
• Integration of access events into the same monitoring and reporting workflow as cyber events
Built Around Weber County’s Manufacturing Cities
The aerospace and defense base in Weber County isn’t monolithic. Each city carries a different concentration of work, and our delivery teams plan engagements accordingly.
Ogden — The Industrial Core
Ogden is the manufacturing heart of the county, home to the Business Depot Ogden, the Ogden airport aerospace cluster, and the densest concentration of composites, machining, and component suppliers. Most of our Ogden engagements involve IT/OT segmentation on the plant floor, CUI-segmented Microsoft 365 GCC High migrations, and SSP/POA&M development for shops fielding their first CMMC flow-down.
Roy — Sentinel-Adjacent Expansion
Roy sits immediately west of Hill AFB and is seeing significant growth tied to the Northrop Grumman Sentinel expansion and its supplier base. Engagements here lean toward defense-grade network architecture, secure file transfer for technical data, and the kind of audit-ready managed IT a prime’s vendor review will scrutinize closely.
West Haven — New Industrial Build-Out
West Haven is one of the fastest-growing parts of the county, with new manufacturing and logistics builds along the western corridor. ProTelesis is regularly engaged at the pre-construction phase for these sites — scoping cabling, industrial wireless, and segmented network infrastructure before slabs are poured — so CMMC-ready and IEC 62443-aligned architectures are baked in rather than retrofitted.
Riverdale — Retail-Adjacent Light Manufacturing & Suppliers
Riverdale combines a busy commercial and retail base with light manufacturing and sub-tier suppliers feeding the larger contractor ecosystem. Engagements here often start with a SPRS self-assessment readiness review and grow into managed cybersecurity and compliance documentation as flow-down language tightens.
North Ogden & Pleasant View — Mid-Market Suppliers & Professional Services
North Ogden and neighboring Pleasant View host a bench of small-to-mid manufacturers, machine shops, and professional-services firms supporting the broader aerospace cluster. Our work here typically blends compliance-ready managed IT, structured cabling for shop and office space, and ransomware-resilient backup for businesses that can’t afford a production stoppage.
South Ogden — Healthcare, Professional & Mixed Suppliers
South Ogden skews toward healthcare networks, professional services, and mixed light-industrial suppliers — many of which serve the aerospace workforce and their families. Cybersecurity engagements here sometimes blend HIPAA and NIST 800-171 requirements when a clinic or supplier also carries a defense customer, plus standard managed IT and unified communications.
What “Cyber-Ready” Looks Like Six Months In
Use-case spotlight — a representative Weber County engagement.
The challenge: A 60-person precision-machining and composites shop near the Business Depot Ogden receives a flow-down from an aerospace prime requiring CMMC Level 2 self-assessment by end of fiscal year, with a third-party C3PAO assessment expected within 24 months. Current state: a flat network where front-office PCs share the same subnet as CNC controllers and the MES, Microsoft 365 Business Standard, no documented SSP, no SIEM, no 24×7 monitoring, ITAR drawings sitting in a general file share, and a part-time IT person who is great at desktop support but has never touched 800-171 or OT segmentation.
The first 90 days: Asset inventory and CUI / export-controlled data-flow mapping across both IT and the shop floor. Migration to Microsoft 365 GCC High to bring ITAR data into a compliant boundary. Endpoint hardening to a CIS baseline with EDR on every device. Network re-architecture into segmented zones — front office, CUI enclave, and an isolated OT zone for MES and CNC traffic — with a next-generation firewall and OT-aware monitoring at the IT/OT boundary. MFA enforced everywhere, with conditional access blocking legacy authentication.
By month six: 24×7 MDR live with SIEM log retention exceeding the NIST minimum, including OT telemetry. SSP authored against all 110 NIST 800-171 controls, with a POA&M tracking the open items. SPRS score posted. Secure file transfer in place for technical data packages. A ransomware tabletop and a tested backup-restore exercise completed and documented. The shop walks into the prime’s vendor review with artifacts in hand — not promises.
The outcome: The contract isn’t lost to the prime’s “trusted supplier” preference, the plant floor is insulated from a front-office compromise, and the supplier is positioned to bid on additional CUI- and ITAR-handling work without scrambling.
Why Local Matters for Defense-Supply-Chain Manufacturing
Manufacturing runs on uptime, response time, and the ability to be on-site when a line goes down. ProTelesis maintains regional engineering and field-services presence covering Weber, Davis, and Salt Lake counties, with response windows measured in hours — not next-business-day. Our teams understand the realities of high-bay production environments, the difference between patching a workstation and touching a controller mid-run, and the badge and access requirements that come with CUI and export-controlled work.
For the parts of the work that need to be off-site — 24×7 SOC monitoring, after-hours patching, weekend cutover work — we operate the platforms ourselves rather than reselling someone else’s NOC. That matters when a production line is down or a 72-hour incident report is on the line.
Schedule a CMMC & OT Readiness Conversation
If you’re a Weber County manufacturer — in Ogden, Roy, West Haven, North Ogden, South Ogden, Riverdale, or Pleasant View — and the flow-down language in your latest contract has you reaching for a definition of CUI or wondering how to segment the plant floor, this is exactly the conversation we have every week.
Schedule a Consultation
ProTelesis is a managed services provider, systems integrator, and carrier-class communications partner serving organizations across California, Arizona, Utah, Nevada, and the broader western United States. Our Utah team supports Weber County’s aerospace and defense supply-chain manufacturers — from the Business Depot Ogden to the Roy and West Haven industrial corridors — with managed cybersecurity, IT/OT network engineering, structured cabling, industrial wireless, unified communications, physical security, and compliance-ready managed IT.
Frequently Asked Questions: IT & Cybersecurity for Aerospace & Defense Manufacturers in Weber County
What is CMMC 2.0 and which Weber County manufacturers need it?
CMMC 2.0 (Cybersecurity Maturity Model Certification, version 2.0) is the U.S. Department of Defense’s framework for verifying that contractors and suppliers safeguard Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). It was codified in DoD’s final rule at 32 CFR Part 170, effective December 16, 2024, with companion DFARS contract clauses phasing in over roughly three years. Any Weber County aerospace or defense manufacturer that handles CUI — whether they machine components, lay up composites, or assemble systems for the Hill AFB supply chain or an aerospace prime — will be required to meet at least CMMC Level 2 once it appears in their contract, usually as a flow-down from a prime. ProTelesis helps Weber County manufacturers map their environment to the 110 NIST SP 800-171 controls underpinning Level 2.
What is IT/OT convergence and why does it matter for defense manufacturers?
IT/OT convergence is the integration of traditional information technology (IT) systems — email, ERP, file servers — with operational technology (OT) on the plant floor, such as MES, SCADA, CNC machine controllers, and programmable logic controllers. It matters for defense manufacturers because a flat, converged network lets a phishing email or ransomware infection on the front office spread directly to production systems, halting a line and potentially exposing CUI. Frameworks like IEC 62443 and NIST guidance on OT/ICS security call for segmenting the OT environment into zones and conduits isolated from IT. ProTelesis engineers segmented IT/OT architectures with OT-aware monitoring at the boundary for manufacturers across Weber County, Utah.
What IT and cybersecurity services do aerospace and defense manufacturers typically need?
Aerospace and defense supply-chain manufacturers typically need a layered IT and cybersecurity portfolio that satisfies NIST SP 800-171, CMMC 2.0, ITAR, and AS9100 obligations. This includes 24×7 Managed Detection & Response (MDR) with endpoint detection, SIEM log retention spanning IT and OT for audit evidence, segmented IT/OT network architectures isolating CUI and plant-floor systems, FIPS 140-3 validated encryption and secure file transfer for technical data, multi-factor authentication and conditional access, documented System Security Plans (SSPs) and Plans of Action & Milestones (POA&Ms), structured cabling and industrial wireless for high-bay plants, and ransomware-resilient backups. ProTelesis delivers these as a single managed-services portfolio across Weber County, Utah.
What is NIST SP 800-171 and how does it relate to manufacturing contracts?
NIST SP 800-171 is the U.S. National Institute of Standards and Technology publication that defines the security controls non-federal organizations must implement to protect Controlled Unclassified Information (CUI). Revision 2 contains 110 controls across 14 control families and is the basis for CMMC 2.0 Level 2. Revision 3, published May 14, 2024, restructured the control catalog and added explicit organization-defined parameters. NIST 800-171 has been required of DoD suppliers handling CUI since 2017 via DFARS 252.204-7012, and most Weber County manufacturers encounter it as a flow-down clause from an aerospace or defense prime. ProTelesis architects environments to whichever revision your contract specifies.
What is DFARS 252.204-7012 and what does it require?
DFARS 252.204-7012, the “Safeguarding Covered Defense Information and Cyber Incident Reporting” clause, is the U.S. Defense Federal Acquisition Regulation Supplement clause that has required DoD contractors and suppliers handling Covered Defense Information to implement NIST SP 800-171 since 2017. It also obligates them to report any cyber incident affecting that information to the DoD Cyber Crime Center (DC3) within 72 hours of discovery. Companion clauses DFARS 252.204-7019 and 7020 added Supplier Performance Risk System (SPRS) self-assessment scoring, and 7021 implements the CMMC certification requirement. ProTelesis builds incident-response capabilities specifically tuned to the 72-hour DC3 reporting window.
How does ITAR affect a Weber County aerospace manufacturer’s IT environment?
ITAR (the International Traffic in Arms Regulations) is the U.S. State Department regulation that controls the export of defense articles and technical data on the U.S. Munitions List. For an aerospace manufacturer, ITAR means that technical data — CAD models, drawings, process specifications — cannot be accessed by foreign persons or stored where a non-U.S. cloud region or administrator could reach it, even unintentionally. In practice this drives manufacturers toward U.S.-sovereign environments such as Microsoft 365 GCC High, access controls that enforce U.S.-person-only handling, and secure file transfer for technical data packages. ProTelesis designs ITAR-aware environments and GCC High deployments for Weber County, Utah manufacturers.
Does ProTelesis serve businesses in Ogden, Roy, West Haven, North Ogden, South Ogden, Riverdale, and Pleasant View?
Yes. ProTelesis is able to serve businesses across Weber County, Utah — including Ogden, Roy, West Haven, North Ogden, South Ogden, Riverdale, and Pleasant View — with managed IT, cybersecurity, IT/OT network engineering, structured cabling, industrial wireless, unified communications, and physical security. Engagements span aerospace and defense supply-chain manufacturers at the Business Depot Ogden and the Roy and West Haven industrial corridors, along with healthcare, professional services, and mixed light-industrial suppliers. Regional engineering and field-services teams maintain response windows measured in hours.
When does CMMC become mandatory in defense contracts?
The CMMC program rule (32 CFR Part 170) took effect December 16, 2024, and the companion DFARS rule phases the contract requirements in over roughly three years. Phase 1 begins when the DFARS rule appears in new contracts and initially requires Level 1 or Level 2 self-assessment in applicable solicitations. Later phases introduce third-party Level 2 certifications, Level 3 government-led assessments, and full coverage of all applicable contracts. Most Weber County manufacturers are seeing CMMC language flow down from their primes well ahead of the contract requirement, which means many companies are effectively on a 12-to-24-month preparation runway today. ProTelesis sequences engagements to align with both your prime’s timeline and the DFARS phase-in.
What is Controlled Unclassified Information (CUI), and why does it matter for manufacturers?
Controlled Unclassified Information (CUI) is information the U.S. Government creates or owns that is not classified but still requires safeguarding under law, regulation, or government-wide policy. For an aerospace or defense manufacturer, CUI commonly includes technical data on weapon-system or aircraft components, engineering drawings, specifications, process sheets, and program-management documents. CUI handling is the trigger for most NIST SP 800-171 and CMMC Level 2 requirements — once CUI lands on a manufacturer’s network or shop floor, those systems are in scope. ProTelesis begins most Weber County manufacturing engagements with a CUI and export-controlled data-flow assessment to determine exactly which systems, users, and locations are in scope.
How does Weber County’s aerospace and defense base shape local IT demand?
Weber County, Utah anchors a dense aerospace and defense manufacturing cluster tied to the Hill Air Force Base supply chain. The Business Depot Ogden — a roughly 1,118-acre industrial park on the former Defense Depot Ogden site with more than 12.5 million square feet and over 130 businesses — hosts aerospace and precision-manufacturing tenants such as Barnes Aerospace and JD Machine, while the broader area includes Williams International jet-engine production, Northrop Grumman’s Sentinel-related expansion near Roy, and workforce pipelines from Weber State University’s Manufacturing Engineering Technology and MARS Center programs. That base pulls flow-down compliance, CUI handling, ITAR control, and IT/OT security requirements into local manufacturers — creating demand for compliance-grade managed IT and cybersecurity that is materially different from a typical commercial market. ProTelesis serves that demand directly.