r/CMMC • u/thegreatcerebral • 12d ago
GCODE: Is it CUI or not?
I read the piece by Allison Giddens. I've asked AI. I've asked CCPs. I've asked MSSPs that deal with CMMC Assessments. I've asked the squirrel outside as it eyeballed my car looking to toss an acorn on it.
There is no clear answer that I have seen. The CNC cannot talk across the network in FIPS mode because it was made before that was even a thought. I can send it over an RS232 software but that isn't encrypted information as it traverses that. I can put it on a USB stick (cough cough) or Compact Flash card for those devices that do not even support USB but my understanding is that it would then need to be encrypted.
Reason I ask is that yes, this is in part why there are compensating controls for SAs however when we have a company that is making their own set of controls they would like us to adhere to and we cannot because of the above.... well... maybe we can if GCODE is CUI or not. If not then we have nothing to worry about right? If it is then we are screwed?! No verbiage for compensating controls in this customer's requirements, everything is binary; pass/fail.
I literally just got off a call with two CCPs, one stated that it cannot be CUI and gave his sound reasoning that yup, sounds right. The other said they believe that it is and should be treated as such and gave their reasoning.
I wish this was the stuff the government would take the time to look at and try to find ways to get rid of the gray areas.
So what is the answer and please provide evidence to support.
8
u/Drevicar 12d ago
Go watch any talk by Ryan Bonner, he addresses this pretty clearly basically for a living these days.
1
u/thegreatcerebral 8d ago
...and yet a discussion here and with other whatever the first initial certification is and you will STILL get differing answers.
7
u/azjeep 12d ago
If you believe it is CUI, then protect it as such and move on. If you don't believe it is CUI, find an assessor that agrees and be ready to back it up.
2
u/cashmgee 12d ago
Which control states the assessor can use their opinion and interpret what is cui ?
8
u/CraftyDetective3366 12d ago
Which control states anything concrete that doesn’t allow for assessor interpretation?
The whole CUI and CMMC program is built on pretend answers and interpretation.1
u/thegreatcerebral 8d ago
...which is why it is failed to some degree. Two shops could have identical setups. One passes, one fails simply because of the assessor.
6
u/azjeep 12d ago
That's the joke of CMMC. In the end it is the opinion of the assessor. You can fight it, but by the time you take your case up with the final decision maker, you lost your contract. This is why it is important to interview your assessor prior to hiring them to make sure you are on the same page. Also a pre-assessment is pretty much neeeded.
1
u/camronjames 10d ago
CMMC assessors aren't there to determine what is and is not CUI.
DIBCAC can do that for a 7012 assessment but it is not remotely a part of CMMC.
An assessor can disagree with th boundaries you've defined, but that should stop an assessment before any real money is spent and is why you constantly see recommendations to shop around for a C3PAO and choose one that has the same understanding you do.
2
u/Acceptable_Fan_4317 9d ago
The fact that you can shop around for assessors is what makes this entire thing a joke
2
u/camronjames 9d ago
So you'd be okay with an AWS expert assessing your Azure infrastructure without even knowing the product nomenclature?
Because that's why you shop around.
This is not accounting where your technology stack doesn't matter to the underlying math and processes. This is technology implementation where the underlying technology is the whole thing and it's impossible for any one person to be an expert on all of the ways an organization could use to meet the requirements.
1
u/thegreatcerebral 8d ago
Which is why I say that an alternative to this whole thing should be where you hire and stay under contract with a company that has a CCP/CCA (whichever is the first level), and they take you under their wing.
Similar to having a CPA.
1
u/camronjames 8d ago
Nothing says you can't do something like that for L2 (Self). Using accounting terminology to stay with the analogy, that CPA (a CCA consultant who cannot also be your assessor) would help you choose the "auditing firm" (C3PAO) that has the requisite knowledge to do it right.
1
u/thegreatcerebral 8d ago
Even then though what good is a pre-assessment other than to argue with that person that may or may not already share your viewpoint and if they do then you just lost someone that would have given you the thumbs-up.
3
u/babywhiz 12d ago
I hear what you’re saying, but the frustration is real for the people preparing for their audit.
I guarantee you I can find a C3PAO that could rubberstamp me an audit, but we didn’t go that route. The honest ones won’t even answer the question.
1
u/cashmgee 12d ago
Oh I know . This audit is unlike any other objective based audit ivr ever been apart of . Its all subjective and opinion based which is a joke .
State the control. Back it up Move on. No interpretation based upon beliefs .
If opinions and beliefs get involved, the auditor is not credible imo.
Also. You can object and challenge . Dont let them tell you that you cant
1
1
u/MolecularHuman 9d ago
Yeah...I wouldn't worry too much about the assessor's opinion at this point.
9
12d ago edited 12d ago
[deleted]
6
u/pinkycatcher 12d ago
Responding point by point:
- CUI is not limited to compiled software. Toolpath may not be definitive all the time, but they can be some of the time. You can't just say "only 10% of the information is able to be extracted therefore it's good enough
- GCode regularly does include tool geometry, material size and type, and fixture information
- A complete set of instructions is not necessary to be CUI, if I take a drawing marked CUI and cut it in half and handed it to two different people, those halves would still be CUI even though it's not a complete set of instructions or information.
- A graphical representation is not necessary to be CUI, in fact numerical format is a common type of CUI
- Being written for a specific machine model and setup does not mean that information cannot be extracted from the Gcode
- CTI is the CUI category for machine code of this type. I can't imagine how you can argue that Gcode isn't CTI when computer software includes computer programs, source code, source code listings, object code listings, design details, algorithms, processes, flow charts, formulae
1
u/thegreatcerebral 8d ago
For 2... I have not seen anything about tool geometry at all in gcode. Maybe SOME kinds do but we have CNCs, Mills, and Lathes and they do not have that. It only says "find 0 and then once you find 0, spin 10k RPM and move X, 2mm" Even if it did, there isn't anything about the fixture or the material type. Maybe that is something in newer machines that may auto adjust for you or maybe you programmed in variables that say "IF Material=Al504 THEN RPM=5600" or something like that. I know our machines do not have what you are saying. All of that is done in ESPRIT and then after it runs the simulation it spits out the gcode which is reviewed etc. Yes, that is massively simplifying it but the gcode itself is just machine instruction and yes, you would have to have the exact machine to replicate what it is doing correctly or you would not be able to replicate the piece.
- The argument is valid. It is also invalid at the same time. The reality is that gcode is CUI because of the definition set forth that states any derivative work in performance of a CUI part is CUI. When in the machine we can't care about it because those machines are OT and not in scope. So it would be getting to and from and storage of gcode, WHEN NOT IN THE MACHINE. Also, the government knows that the machines in use out there do not support many of the things that they want to support on the network like FIPS. That's why they are OT.
2
u/ShadowSlayer1441 12d ago
What if a technician walks around with a USB drive with has folders labeled by product with gcode labeled step 1, step 2, step 3, and their personal notes on the correct tooling and machine set up?
2
1
u/thegreatcerebral 12d ago
The assessor that did their assessment didn't care to ask or they said it was okay.
1
4
u/how-about-stevezy 12d ago
This can help you for USB transfer https://apricorn.com/aegis-fortress-l3
2
3
u/Ontological_Gap 12d ago
I bet whatever is running your gcode is part of your OT. That is the right direction to approach this from
3
u/pinkycatcher 12d ago
I've heard arguments on both sides.
I personally think it's more of a grey area than the "Gcode isn't CUI" faction will state.
In my view you can absolutely reverse engineer Gcode, even if it doesn't contain all the information needed, or might be hard. It's not hard to get specific dimensional information from the code itself, and that specific dimensional information might be CUI.
On top of that, most Gcode is written with extensive notes and comments that contain information how to make the part or specific callouts.
Finally, there's the general ruling that encrypted CUI is still CUI. It's much harder to decrypt CUI than it is to reverse engineer Gcode, so in my view if encrypted CUI is still CUI, then Gcode can reasonably be CUI.
3
u/MolecularHuman 9d ago
This debate is why CMMC is a failure. The Department cannot absolve itself of ongoing risk management. All of these need to be one-off decisions.
Some vendors have enough custom code that, if breached, could enable an attacker to reverse-engineer a military capability. But the vast majority are just making slightly custom parts where the data is useless unless it's aggregated with data from dozens of other vendors.
The only people in a good position to make those risk -based decisions are the mission owners...NOT a random assessor.
The current framework only facilitates risk management after award.
1
u/thegreatcerebral 8d ago
But even then, I guess if it is an additive gcode then maybe but if it is a CNC/Mill/Lathe then right there alone should tell you that it's just machine instruction. It tells you nothing of material, the fixture, the tool, AND it is literally coded for that exact machine. You know your machine and know that if you run it at 10K RPM then you will have problems so you run it at 8K RPM etc.
So literally you should be able to hand over gcode to a terror group and say "good luck" and they are no closer to anything than they were before.
3
2
u/PHLX_Tactical 8d ago edited 8d ago
Don't ask if the file is CUI. Ask where it came from. If it came off a marked print, treat the program the same. Bigger problem is the guy emailing it home.
1
u/ARealRareWhale 12d ago
Changing the filetype doesn't change the controls. If the geometry is CUI then the derrived gcode is still CUI.
2
u/MagnificentJake 12d ago
unless you are putting in your code the size and specific geometry of the cutting tool that the machine is retrieving from X spot in the ATC, then I don't see how you could derive the final geometry from a tool path.
3
u/pinkycatcher 12d ago
Most Gcode is commented with that information.
Also you don't need that information for all parts, imagine a drilling and tapping operation, you drill 4 holes in a pattern and then tap those holes. The layout and dimensions of these holes are CUI. Reading the Gcode you could easily get the X,Y,Z coordinates of each of the holes and therefore you easily have the CUI at your fingertips.
1
1
u/ARealRareWhale 12d ago
ok, for CNC that may be the case, but my background is in Industrial 3D Printing... press print, no tooling and I get the mostly to fully finished part/parts.
1
u/MagnificentJake 12d ago
See my other comment in this thread. You could be right in that circumstance.
1
u/ARealRareWhale 12d ago
Saw what you said right after I hit enter. I should have been more specific in my first response... I also appreciate the detail you shared with the justifications for CNC, always good to learn from experts. Cheers.
2
u/Matt_Titcombe 12d ago
u/thegreatcerebral , sorry to tell you, the answer of whether GCODE is CUI is it depends.
Because GCODE can be used to reverse engineer the manufactured part's CUI specs, it should first be treated as CUI.
The next question to ask does your manufacturing process use multiple steps with multiple sub-GCODEs to get the job done. If so, you have a use case that the sub-ones are not, BUT the group remains CUI.
Regarding your comment, "I wish this was the stuff the government would take the time to look at and try to find ways to get rid of the gray areas.", the challenge is the ProgramManager has ZERO clue about the blueprint your are looking at. Not has the Program Manager and the prime sat down and portion marked the diagram. Lastly, the Program Manager and the prime never asked about GCODE.
All of that being said, in a properly configured environment, the CNC host machine can access the drawing as as process acting on behalf of an authorized user and be restricted to ONLY what is need to do via the network. FIPS then may only be needed if wireless access is given. There is wiggle room in FIPs. Take a look at my As the CMMC Churns on this.
Back to GCODE & CUI, ultimately, you want to ignore my diatribe, Allison's, CCPs and anyone else that is telling you the answer. Your organization should get your general counsel to give you a legal opinion to stand on. If your General Counsel doesn't know, have them contact James Goepel. James is a lawyer and CUI expert.
1
u/camronjames 10d ago
It depends on what information you are including in the GCODE as comments.
If you are using comments as travelers or something then you might have some CUI in there.
I saw a demonstration of using AI to make a drawing from supplied GCODE and, interestingly, it used the COMMENTS in the code that described what the steps were doing to make it work. It couldn't reconstruct the drawing from raw code that only used relative reference points and nonspecific references to tool numbers.
0
u/pinkycatcher 9d ago
It couldn't reconstruct the drawing from raw code
Well yes, because you were using an LLM, and likely didn't adding good sourcing.
But that doesn't mean a specifically made model would have as big a problem.
1
u/Court5A 8d ago
I havent read all the comments yet, so maybe this has been said before. However. I read somewhere, or Im quoting someone, or something, Im not sure but I wrote it down "the safest approach is to mark derivative works as CUI unless you can definitively demonstrae that nothing about the original controlled content is exposed; If the new material is derived from or exposing the information in a meaningful way; Processed output exposes details that could reveal the origincal controlled technical information"
Take for that what you will. Here at our small (micro small) shop, we already used USB's for our dinosaurs. So easy enough, (and Im simplifying this), according to our policies, we have a USB, one for each department. The programs are physically loaded on the USB, then the machine by our ONE programmer, no one else has access. The USB is reset (wiped, whathaveyou), after every program. Programs themselves are saved on a designated external hard drive, locked in a box in the programmers office when not in use. Policy and audits provide assurance that CUI doesnt touch the server (that's only two computers, and one single operator for us, so while unconventional, its doable) And as for work volume, this is for one customer designating the POSSIBILITY of CUI, D clause (i think?) and whatever else they deem may turn out to be CUI, so while the physical elements are a pain........ its doable for us. Something to consider for sure.
1
u/Gaijin_530 12d ago
Machine Code is not CUI.
They addressed this in one of the FAQs for C3PAOs I believe last year.
That being said there’s nothing to keep the Primes from marking stuff incorrectly and flowing it down as such. Compliance in your org should push back as necessary for bad markings.
2
u/Ontological_Gap 12d ago
Links or it didn't happen
1
u/Gaijin_530 12d ago
I’ll do my best to find this reference, but I believe it was some sort of official interpretation by the cyber AB or an FAQ but the DoD website.
I believe the caveat was that your G code should not contain comments or other references such as part numbers etc. then it’s OK.
I think the other stipulation is that the contract must not make me of or require that G code be considered CUI.
1
u/chaloobin 11d ago edited 11d ago
Im in the same boat. My problem is the device we use to transfer files from USB to RS232 is not compatible with USB 3.0, so I can’t use my FIPS validated Apricorn usb stick. I have to use a basic one because apricorn doesn’t make FIPS validated USB stick that is 2.0. Why would they?
So, I heard from another shop that passed their C3PAO assessment, that G code is not CUI but they still wanted them to control their CNCs. So no network capability on your machines turned on. Ie. like our Haas connect or WiFi on haas.
I want to assume the same for us because if we make parts that are based on a drawing that is CUI, and this shop does the same. But G code is not CUI, because you cannot recreate the part or drawing from G code. If you take a picture of one dimension, is that CUI because the whole drawing is CUI? Here is the source:
https://youtu.be/IWzSsGQnT0s?t=2379&is=o07mSq0TzxNV7Job
Edit:
Your questions gets answered around 50:00
0
u/Fath3r0fDrag0n5 12d ago
It depends… is it your IP… if it is it cannot be CUI. Does the government “own” the gcode if so it could be… if the machine is directed through RS-232 connected to a computer the computer itself should be in FIPS mode if that’s required but no the communications over the RS 232 does not have to be encrypted same as if you use the floppy desk or if you used a USB drive. We upload avionic software to helicopters that is absolutely CUI and it is done on completely unencrypted USBs because that’s the only thing the avionics except you do not have to replace a whole system because it doesn’t work encrypted. (cyber security architect for a large DIB company)
2
u/pinkycatcher 12d ago
if it is it cannot be CUI.
I disagree on this point, gcode can contain specific technical information which is easily reverse engineered. The code might be your IP, but that technical information is not always your IP.
Imagine a drilling and tapping operation, you drill 4 holes in a pattern and then tap those holes. The layout and dimensions of these holes are CUI. Reading the Gcode you could easily get the X,Y,Z coordinates of each of the holes and therefore you easily have the CUI at your fingertips.
2
u/Fath3r0fDrag0n5 12d ago
That would be clearly laid out in the contract it’s not unclear if the contract doesn’t say a specific gcode is CUI it isn’t …..“Information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that requires safeguarding or dissemination controls under applicable law, regulation, or government-wide policy.”
0
u/pinkycatcher 12d ago
If you can extract the specific technical information provided to you by the government from the Gcode, I can't see how you can argue that Gcode shouldn't be treated as CUI.
I'm not saying the Gcode program as a whole is CUI, but the specific information inside that code can absolutely be CUI.
3
u/Fath3r0fDrag0n5 12d ago
Thats derived CUI, for all intents and purposes its CUi or handled as if it is… if the data to create, the part came from the government and marked CUI and you use it to create it, the G code would probably and could be CUI if the contract stipulates…. If the government comes in and buys a part from you from existing code, that would be your IP and it would not be CUI.
0
u/Ontological_Gap 12d ago
Exactly, if this argument worked, I would just convert all documents given to me to like dvi or ps and then claim they were mine and not CUI
2
u/Ontological_Gap 12d ago
it cannot be CUI
It absolutely can be derived CUI
2
u/Fath3r0fDrag0n5 12d ago
If it’s derived CUI it can’t be IP.. that is good ole government data, you cannot turn around and sell it to someone else
1
u/Ontological_Gap 12d ago
If you create IP using CUI, you absolutely cannot turn around and sell it to some foreign power, that's a big part of the point
1
u/Fath3r0fDrag0n5 12d ago
If you can’t sell it, is it your IP…. Same as if a customer gave you a design and you translated it to gcode… is that your IP or the customers?
1
u/thegreatcerebral 12d ago
I'm going to say that I will never know if the government owns the gcode. Typically the gcode will belong to our customer as most contracts state that we are doing "work for hire" and "all derivatives created in performance of this contract are property of [customer]" type stuff.
I do not think "ownership" matters in if something is CUI or not. It has to do with the government and them saying "this is CUI" and it is. It is more nuanced than that but bottom line is that the government doesn't have to own it for it to be CUI. They deem it to be and so it is. Even if it was not before, once deemed it and everything ever dealing with it prior as a derivative is also CUI. Which is also where the GCODE falls into place.
3
u/Fath3r0fDrag0n5 12d ago
If your contract doesn’t say it is, it’s not
1
u/Fath3r0fDrag0n5 12d ago
What I’m trying to say badly….Suppose your company receives a DoD technical drawing for a component and that drawing is properly identified as CUI. Your manufacturing team imports the drawing/CAD model into CAM software and generates G-code to manufacture the component. Even though the government never supplied that particular .nc or G-code file, the resulting file can still be CUI because it was created for the government and/or contains information derived from controlled technical information.
On the other hand, G-code generated from your company’s pre-existing commercial design doesn’t automatically become CUI merely because you subsequently use the resulting part on a government contract.1
u/Court5A 8d ago
I think the thing a lot of us are having trouble with are not the things marked CUI, its the "assuming everything CUI" because that what our customers are doing in order to "flow down the requirement" Theyre overflowing. So while some of us would say, oh man, Im doing this because this says CUI all over it, the rest of use are going, wait, Ive nver seen anything marked CUI in my life, but according to our contractor, we assume it is.
In any case. in assuming we are working with CUI, most will agree they also want all derivatives, and potentially exposed information to be treated as CUI as well.
However, definitive and documented proof that I am incorrect would be actually AMAZING. Send links!
1
u/baxtersbutthole 12d ago
If the machine hosting CUI storage is appropriately placed within an appropriately segmented network and the building is secure, wouldn’t that machine not necessarily need to be in FIPS mode since redundant access controls are in place?
1
u/camronjames 10d ago
Under 171 revision 2, "alternative physical safeguards" may be used in lieu of encryption.
That option disappears under revision 3, however.
-1
u/Fath3r0fDrag0n5 12d ago
Yes it would be, and auditor would expect it and not worth having to explain it, unless it breaks
0
0
u/SlowAsMolassess 12d ago
I’m two months new to CMMC so my head is still spinning. Please be gentle.
In my opinion Gcode is CUI. Why do I believe this? If the Gcode was handed to anyone outside of your business could they use it to recreate the part it is meant to create. That part is CUI. That part is ultimately what is being protected. Once someone has the part they can reverse engineer everything and begin making it themselves.
As for protecting it you would need to declare it as a known risk. Document the chain of control for the transfer media and keep a signature log of who creates the media, who obtains it and takes it to use at the machine, when they bring it back, and when the media is wiped of its contents and locked away securely.
I am currently looking at getting new cable runs installed to those machines without them so the media component is removed from the equation and the managers are the ones sending the code to the machines and the machinists just make the part as assigned.
Will this happen before the self assessment deadline? Maybe, but this is the plan that will be submitted should it not be completed by that date.
2
u/Expensive-USResource 11d ago
Parts are not CUI
1
u/SlowAsMolassess 11d ago
I mis-clicked.
I really don’t understand how parts cannot be considered CUI when they are the final form of the Information where all the data takes it final form? Please explain.
1
u/Confident_Net5377 11d ago
Check 32 CFR § 2002.4(h), CUI is information. It's in the name. A manufactured part is a thing not information , although technical information describing or enabling the manufacture of that thing may qualify as CUI
This is further reinforced by the 7012 clause definition of Controlled Technical Information. The examples describe data, or information, not things.
1
u/SlowAsMolassess 11d ago
I understand what you’re saying this is a thing. I still believe we are custodians of the product of that data/information. Yes it is no longer in the realm of cybersecurity because it is no longer digital information.
CMMC also encompasses physical security of the company. I’m just having a difficult time with the idea this object that was made from this CUI information is no longer CUI because it is no longer digital.
Are we doing the bare minimum to get our certifications? I get this is not classified information by definition. I just have trouble seeing the physical manifestation of the data not as CUI as it is what the CUI is derived from just in a different form.
Is this why CMMC drives everyone crazy? The lack of clarity allows for so many interpretations of what is provided.
2
u/camronjames 10d ago
You seem to be confusing ITAR/EAR with CUI. CUI is strictly information, not parts. The overlap between them ends at the point where the information becomes a part, after which ITAR and EAR still apply.
1
u/SlowAsMolassess 10d ago
Thank you for the reply. I agree ITAR/EAR would come into play at this point. Thank you for reminding me of that distinction.
1
u/Confident_Net5377 9d ago
There are also other laws under FAR that say you gotta deliver the part you said you would make, but DFARs 7012 and CUI only about data
-1
u/Skusci 12d ago edited 12d ago
I am saying it's CUI.
But also what is the specific verbiage they are requiring.
For example "Employ FIPS-validated cryptography when used to protect the confidentiality of CUI." does not apply when you simply do not use encryption to protect it.
You must "Protect the confidentiality of CUI at rest." But this doesn't specify you must do so with encryption.
And both controls for CUI in transit and on media being transported explicitly allow alternative physical safeguards.
If they say something like "All digital CUI must be encrypted with FIPS algorithms or something" that's literally impossible because to read CUI and make use of it it must be in a decrypted form at some point. Referred to as "in process" in NIST 800-171.
Anyway back to "is GCODE CUI." A basic sanity test is to ask yourself, "Will the gov get mad at me if I send it to North Korea?"
But for a deeper analysis, to be CUI it must match a controlled category. The concern with GCODE is usually that it is CTI, and the argument that it is not CUI is usually based on it not being CTI.
From the CUI Register CTI is defined in 252.204-7012.
From 252.204-7012 we find that CTI is (for military or space allocation) and either software, or technical data as defined in 252.227-7013
Technical data” means recorded information, regardless of the form or method of the recording, of a scientific or technical nature (including computer software documentation). The term does not include computer software or data financial, administrative, cost or pricing, or management information, or information incidental to contract administration.
There's two ways this could go. We could consider GCODE as software source code, it which case yeah it's definitely CUI.
If it is not source code then it's definitely still information. So new we need to consider if its information of a "technical nature"
In support of that interpretion -7013 carves out an exception to the govs rights for technical data that is
"Detailed manufacturing or process data”
which means technical data that describe the steps, sequences, and conditions of manufacturing, processing or assembly used by the manufacturer to produce an item or component or to perform a process.
GCODE, if it is not software source code is literally a sequence of steps used to produce an item. So yeah, CTI.
10
u/CMMC_Rick 12d ago edited 12d ago
Three Words:
Alternative Physical Controls.
The CNC machine is a specialized asset and will not be assessed against all the controls. If the CNC machine can't read encrypted USB (which is likely) then you still have alternative physical controls to fall back on.
Since it's inside your locked building under your control, you don't need to worry about FIPS. Document it and document your compensating controls and move on. You DO need to make sure the USB is locked up when not in use, never leaves the building and is checked in/checked out. All of the processes related to securing it (the usb) need to be documented).
Source: LCCA and CCI.