The Plant Floor Is the Next Compliance Frontier: FRCS, OT Resilience, and What Contractors Are Missing

By Josh Hammer

Where is Controlled Unclassified Information stored? Who can access it? Are your policies, technical safeguards, and evidence aligned with NIST SP 800-171 and CMMC?

Those questions still matter. They are not going away.

But they do not tell the whole story.

A contractor can protect its file servers and still fail to understand the systems that operate its building, control its production line, regulate its HVAC, monitor its utilities, or provide remote access to a plant-floor integrator. A company can produce a polished System Security Plan and still have no reliable answer to a basic operational question:

What devices are connected to the building automation or manufacturing control network right now?

That gap is becoming impossible to ignore.

At the Billington CyberSecurity Summit on September 9, 2026, Department of Defense CIO Kirsten Davies said CMMC never addressed “how to build cyber resilience for a manufacturing line.” The framework, she explained, focused on data. Handling federal data, she said, “doesn’t necessarily build cyber resilience for small to medium manufacturing companies.”

Her conclusion was direct: operational technology is critical to defense industrial base resilience, and “this is where we’re headed.”

The compliance conversation has moved to the plant floor. Many contractors have not.

Tier 1: The blind spot. IT protects information, OT runs the mission

The simplest way to understand the difference between IT and OT is this:

• Information technology protects information.
• Operational technology runs the building, the line, and the physical process.

Your IT environment includes laptops, identity systems, email, file servers, cloud applications, databases, and business networks. Its central concerns are confidentiality, integrity, and availability of information.

Your OT environment includes programmable logic controllers, sensors, actuators, industrial switches, supervisory control and data acquisition systems, distributed control systems, human-machine interfaces, engineering workstations, and the networks that connect them. In a facility, it may also include HVAC, lighting, fire and life-safety systems, elevators, physical security systems, utilities, and environmental monitoring.

These systems do not merely store information. They act on the physical world.

An IT compromise may expose technical data or interrupt email. An OT compromise may alter a temperature set point, disable a safety alarm, stop a production line, disrupt power distribution, or make a facility unsafe to occupy.

The priorities also differ. IT programs often begin with confidentiality: prevent unauthorized disclosure. OT programs must place much greater emphasis on availability, integrity, safety, and controlled recovery. A patch that requires a reboot may be routine on an office laptop. On a production controller, the same patch may interrupt a process that cannot be stopped without damaging equipment, delaying a contract, or creating a safety risk.

This is why traditional information-security compliance is necessary but insufficient.

Why a clean SSP can hide an unmanaged plant floor

Most contractors know how to document users, systems, policies, access controls, incident response procedures, and evidence repositories. They may have invested heavily in endpoint protection, identity management, vulnerability scanning, and cloud security.

Yet the same contractor may not have:

• A current inventory of PLCs, sensors, HMIs, control servers, and engineering workstations.
• A validated map of connections between corporate IT and OT networks.
• A record of every vendor remote-access pathway.
• A process for patching systems that cannot safely be taken offline.
• Monitoring that understands industrial protocols and abnormal control behavior.
• A documented recovery plan for restoring production, not simply restoring files.
• Construction and design documents that demonstrate how cybersecurity requirements were incorporated into a control system.

This is the core blind spot in facility related control systems cybersecurity.

The issue is not that CMMC or NIST SP 800-171 has no relevance to OT. Operational technology may be a specialized asset, and systems that process, store, or transmit FCI or CUI may fall within a contractor’s assessment boundary. The issue is that the central compliance lens has historically focused on protecting information systems and federal data, not on proving that a manufacturing line or facility-control environment can withstand and recover from cyber disruption.

Davies’ remarks matter because they acknowledge that distinction at the policy level.

The CMMC pause creates an opening, not an excuse

CMMC Phase 2 third-party assessment requirements are currently paused while the Department reviews the program and considers reform. A September 3 class deviation directed contracting officers to remove third-party assessment requirements from affected solicitations and contracts while preserving baseline cybersecurity obligations.

That pause does not suspend the underlying responsibility to protect federal information. Nor does it eliminate the risk of an attack on your operational environment.

In fact, the reform discussion makes this a particularly useful moment to act. Contractors have an opportunity to address the OT gap before new requirements, prime-contractor expectations, or customer questions make it urgent.

The right question is no longer only:

Can you demonstrate that your information-security controls exist?

It is also:

Can your plant, facility, or control system continue operating safely and recover predictably if those systems are attacked?

Tier 2: The governing requirements for FRCS and OT

The Department has not left facility-related control systems and operational technology in a policy vacuum. Contractors and system owners must understand the requirements that already govern these environments.

1. RMF applies to FRCS and OT

The Risk Management Framework under DoDI 8510.01 governs cybersecurity for Department of Defense systems, including control systems and facility-related control systems.

The Department’s FRCS program resources make clear that FRCS cybersecurity is part of a broader risk-management and authorization process. The RMF is not a paperwork exercise. It is a lifecycle process that connects system categorization, security controls, implementation, assessment, authorization, and continuous monitoring.

For contractors, the practical implication is important: you must coordinate with the appropriate System Owner to understand the system boundary, impact rating, cybersecurity requirements, and required artifacts.

You do not determine these matters in isolation.

2. UFC 4-010-06 puts cybersecurity into the design process

The July 2026 version of UFC 4-010-06, Cybersecurity of Facility-Related Control Systems, establishes requirements for incorporating cybersecurity into the design of networked facility-related control systems.

The UFC is deliberately precise about its role. It defines a design process that supports RMF. It does not itself implement the RMF, and using the UFC does not produce an Authority to Operate.

It does, however, help produce a system that is more technically capable of receiving an ATO than one that was designed without those cybersecurity considerations.

That distinction is essential. A contractor can design, build, document, test, and support a system. The system owner and authorized government officials remain responsible for the applicable RMF decisions and authorization.

3. UFGS 25 05 11 turns requirements into project specifications

The 2026 Engineering and Construction Bulletin directs the use of UFC 4-010-06 and UFGS 25 05 11, Cybersecurity for Facility-Related Control Systems, in applicable control-system design and construction projects.

UFGS 25 05 11 is used as the starting point for project-specific cybersecurity specifications. It must be tailored to the project’s mission, system architecture, and owner requirements.

This has a practical consequence for construction firms, engineering teams, integrators, and facility operators: cybersecurity belongs in the basis of design, drawings, specifications, submittals, testing, and acceptance documentation. It should not be added after the equipment has been selected and installed.

4. The Control Systems/OT Security Requirements Guide applies broadly

The Department of War Control Systems/OT Security Requirements Guide, Version 2, dated February 27, 2026, establishes security objectives for control systems and OT operated by or on behalf of the Department.

Its scope includes systems supporting:

• Facilities.
• Manufacturing.
• Utilities.
• Medical systems.
• Weapon systems.
• Defense critical infrastructure.

The SRG recognizes why OT cannot be handled like ordinary IT. It identifies mission objectives such as maintaining system availability, system integrity, human safety, environmental safety, and physical security.

Those objectives change how a contractor should approach risk.

For example, vulnerability management cannot mean “apply every patch immediately.” It must mean identifying the vulnerability, evaluating the operational effect, testing the update where feasible, applying compensating controls when necessary, documenting accepted risk, and maintaining a safe path to remediation.

What FRCS and OT resilience require in practice

A credible program should address at least six operational areas.

Asset inventory

Begin with a validated, as-operated inventory. Include PLCs, RTUs, HMIs, control servers, sensors, actuators, engineering workstations, switches, gateways, firmware versions, protocols, physical locations, dependencies, and remote-access pathways.

Do not rely solely on a spreadsheet prepared during installation. Validate it through passive monitoring, configuration review, physical walk-downs, and conversations with operators and integrators.

IT/OT segmentation

The OT network should be logically separated from the corporate network and, where appropriate, placed behind controlled gateways, firewalls, or an intermediate demilitarized zone.

Segmentation is both a security control and a scope-management decision. It can limit an attacker’s ability to move from a compromised office endpoint into a control environment. It can also clarify which systems process, store, or transmit CUI and how those systems connect to specialized assets.

A flat network is difficult to defend, difficult to monitor, and difficult to explain to a system owner or assessor.

Controlled remote access

Vendors and system integrators often need remote access. That operational requirement does not justify permanent, uncontrolled connectivity.

Remote access should be approved, time-limited, strongly authenticated where technically feasible, restricted to authorized interfaces, monitored, logged, and terminated when the work is complete. The organization should know who connected, when they connected, what they accessed, and what changed.

Patch and vulnerability management

Many OT systems cannot be taken offline on demand. That does not make vulnerabilities optional.

A mature process classifies the affected asset, evaluates operational and safety impact, tests changes in a separate environment where possible, schedules maintenance, applies compensating controls, and documents the decision. Controls may include network restrictions, application allowlisting, segmentation, removal of unnecessary services, stronger access controls, or enhanced monitoring.

OT-aware monitoring

Traditional security monitoring is valuable, but it may not recognize the difference between normal and abnormal control behavior.

Monitoring should account for OT protocols, engineering workstation activity, configuration changes, new devices, unusual remote sessions, unauthorized commands, and changes to expected network flows. It should also connect cyber events to operational impact.

An alert that says “a privileged account logged in” is useful. An alert that explains “a vendor account changed a controller configuration outside the approved maintenance window” is much more actionable.

Design and construction evidence

In FRCS environments, drawings and project documents are evidence.

Basis-of-design documents, network diagrams, cybersecurity design checklists, equipment schedules, interface descriptions, configuration records, test results, commissioning records, and change-control documentation can show whether cybersecurity requirements were considered throughout the system lifecycle.

This is one reason design is the least expensive point at which to address FRCS cybersecurity. It is far cheaper to specify segmentation, secure remote access, logging, and maintainable architectures before construction than to retrofit them after installation.

The convergence: two compliance worlds, one operational environment

Federal contractors are being asked to satisfy two different worlds at once.

The first is information security:

• CUI protection.
• NIST SP 800-171.
• DFARS 252.204-7012.
• CMMC scoping and assessment expectations.
• Security plans, evidence, access controls, incident reporting, and configuration management.

The second is operational resilience:

• FRCS and OT asset visibility.
• RMF categorization and documentation.
• UFC 4-010-06 design requirements.
• UFGS 25 05 11 project specifications.
• Availability, integrity, safety, physical security, and recovery.
• Vendor access and control-system monitoring.

Most providers are strong in one of these domains. Many are strong in neither.

An information-security firm may understand CUI, cloud infrastructure, identity, and policy evidence but have no meaningful experience with HVAC controllers, BACnet, Modbus, PLCs, engineering workstations, or construction submittals.

An engineering or facilities firm may understand how a building operates but lack the compliance methodology, control mapping, evidence management, and continuous monitoring necessary for federal contracting.

Facility operators and construction firms sit directly at this intersection. That is why they often receive incomplete advice from vendors who understand only one side of the problem.

Recent incidents reinforce the point. Security Affairs reported that the Rhysida ransomware group claimed to have leaked approximately 5.79 terabytes from the Berlin state government, including government records, infrastructure files, defense-related material, and vulnerability analyses concerning Berlin’s water supply. The claims have not all been independently verified, and the incident is not proof of a plant-floor compromise. But it demonstrates how attacks against state-level administrative environments can expose information connected to critical infrastructure, national defense, and operational continuity.

The boundary between “IT breach” and “operational consequence” is not as clean as many compliance programs assume.

Tier 3: Build the plan before selecting the platform

This is where I recommend discipline over urgency.

A compliance tool is not the compliance process. A dashboard cannot decide the correct FRCS boundary, determine the appropriate impact rating, interview a plant operator, validate a network diagram, or accept operational risk on behalf of a system owner.

Before selecting any compliance automation platform, follow three steps:

1. Audit first. Determine what systems, facilities, control networks, data flows, vendors, and obligations actually exist.
2. Build the plan second. Define the boundary, priorities, remediation sequence, owners, evidence requirements, and operating procedures.
3. Select tools third. Choose technology that supports the process you have designed.

This order matters especially in OT. Scope decisions about which control systems sit inside a boundary require human judgment. Automating an incorrect scope only produces incorrect evidence faster.

At H&V Complynt Cybersecurity Solutions, we combine technology with that human judgment.

Complynt is an enterprise compliance automation platform for control mapping, evidence collection, policy-as-code, pre-built content packs, and continuous compliance monitoring. It supports mapping across more than 150 frameworks, including CMMC, NIST SP 800-171, NIST SP 800-53, RMF, SOC 2, HIPAA, and ISO 27001.

The platform runs on FedRAMP High and DoD IL5 authorized infrastructure on Palantir’s federal cloud, supporting organizations that need a high-security foundation for compliance operations. For contractors searching for a DoD IL5 compliance platform or RMF compliance solutions, the infrastructure matters, but it is only one part of the answer.

The differentiator is the hybrid model: automation supported by advisors who understand complex facility and control-system environments.

That means using technology to reduce repetitive work while applying expert judgment to:

• Define and document IT, OT, and FRCS boundaries.
• Map controls across overlapping federal requirements.
• Organize design, construction, operational, and security evidence.
• Establish practical monitoring and remediation workflows.
• Track vendor access, system changes, vulnerabilities, and exceptions.
• Prepare documentation that supports coordination with System Owners.
• Maintain visibility as the environment changes.

H&V is also an EDWOSB-certified organization supporting federal contractors, construction firms, facility operators, and other regulated organizations.

We do not issue certifications, guarantee a pass, or issue an ATO. Those decisions belong to the authorized assessors, government officials, System Owners, and Authorizing Officials responsible for the applicable process.

What we can do is help you build a program that is accurate, defensible, continuously maintained, and technically capable of supporting those decisions.

The plant floor is now part of the compliance conversation. The contractors who address that reality early will be better positioned to protect their operations, satisfy customer expectations, and respond to whatever CMMC reform ultimately produces.

Start with an audit. Build the plan. Then select the tools that help you execute it.

For a practical first step, request a free compliance readiness check or visit hvfsusa.com.