Keeping production and warehouses running
In manufacturing and logistics every hour of downtime has a dollar value. At the same time customers and prime contractors ask more and more questions about your security. We make sure office and production networks are cleanly separated, your ERP stays available and you can answer the questions your customers ask.
In the office an outage is annoying. On the shop floor or in the warehouse it can be measured in lost orders and idle shifts. That changes how maintenance windows are planned, how the ERP is backed up and how much redundancy makes sense.
Attackers usually get in through email or a remote access account in the office. If office computers and machine controls share one network, an infection can reach production. Machine controls often run on operating systems that no longer get updates, so they have to be separated and protected on their own.
Companies that handle Federal Contract Information or Controlled Unclassified Information on Department of Defense contracts need a CMMC self-assessment for new contracts since November 10, 2025. Level 2 covers the 110 requirements of NIST SP 800-171. DoD suspended the next phase, which would have required third-party assessments, on July 13, 2026 for a review. The self-assessments and the NIST SP 800-171 obligations under existing contract clauses still apply.
Scanners, warehouse management and shipping systems run in shifts, often with changing staff and temporary workers. IT support that is only available from 8 to 5 does not fit an operation that starts its lines at 4 am.
What we do not do: programming and maintaining machine controls, and export control advice. Machine controls stay with the equipment manufacturer, and we make sure network and access are secure. If you hold ITAR-controlled technical data, tell us before we start: access by non-U.S. persons can count as an export, so your export counsel decides who on our side may administer which systems.
Introduction of an identity and access management solution, clean-up of file shares and self-service password reset for employees, at a company in Germany.
Result: Password tickets dropped from almost 300 to 10 per week.
Replacement of the existing identity and access management structure with a new solution, together with an external service provider, at a company in Germany.
Result: The help desk resolves requests faster because it has extended permissions. Identity processes run automatically, based on cleaned-up HR master data.
FAQ
The CMMC program rule took effect on December 16, 2024, and the contract rule on November 10, 2025. Since then new Department of Defense contracts can require a CMMC Level 1 or Level 2 self-assessment. On July 13, 2026, DoD suspended Phase 2, which would have required third-party Level 2 assessments from November 10, 2026, and started a review of the program. Self-assessments, affirmations in SPRS and the NIST SP 800-171 requirements under DFARS 252.204-7012 remain in force. Check the current status with your contracting officer or counsel before you plan.
First find out which information you actually receive. Federal Contract Information leads to Level 1 with 15 basic requirements, and Controlled Unclassified Information usually to Level 2 with the 110 requirements of NIST SP 800-171. We compare your IT with those requirements, close the gaps and prepare the evidence for your self-assessment. Signing the affirmation stays with your company.
Only after your export counsel has reviewed the setup. Under ITAR, giving a non-U.S. person access to controlled technical data can count as an export, even inside the United States. FNLY IT is part of an international group, so we agree in writing which systems we may administer and who may access them before any work begins.
It stops an infection in the office from reaching your machines and the other way around. Remote access for machine vendors runs through a controlled gateway with its own accounts, multi-factor authentication and logging instead of an open connection. That is the single most effective measure we know against a plant-wide outage.
No, programming and maintaining controls stays with the equipment manufacturer. We secure the network around the machines, set up controlled remote access for the manufacturer and protect systems that can no longer be updated.
With several layers: multi-factor authentication for every account, separate admin accounts, network separation, current patches and backups that attackers cannot delete. We test the restore regularly and agree with you how long the business can run without the ERP and what happens in the meantime.
Yes. The Complete plan covers outages 24/7 at no surcharge. Planned work such as updates and migrations runs at night or on weekends, aligned with your shift plan. Outside the Complete plan, evening, night and weekend work is billed with the surcharges listed on our pricing page.
Manufacturing and logistics
Tell us where things get stuck, on the shop floor, in the warehouse or in the next customer questionnaire. We will tell you openly whether and how we can help.
