Company profile, mission, contracts summary and key facts
Company: Keystone Aerospace LLC (CAGE: 6KZ12). Keystone designs, manufactures, and integrates avionics, flight controls, and sustainment services for fixed-wing military platforms. Founded 1998. Headquarters: Wichita, KS; Secondary sites: Huntsville, AL; San Diego, CA.
Employees: 14,563 | Annual Revenue: $240M | Active Contracts: 23.
Primary Products & Services
Flight-control actuators & servo systems
Avionics integration & mission computing
Airframe structural components & sustainment
Systems engineering and field support
Export Controls & CUI Categories
ITAR: Defense articles related to flight controls and avionics; EAR: dual-use electronics (ECCN 3A991). Licensing required for international transfer; DSP-5/TAA likely for some suppliers.
Mapped categories from active contracts: Technical Data — c_001,c_004,c_007,c_010,c_014,c_019; Export Controlled Tech Data — c_002,c_005,c_008,c_014,c_018; Maintenance Records — c_003,c_009,c_015,c_020; Operational Data & PII — c_012; Proprietary Manufacturing Data — c_013; SBOM & Builds — c_019; Research Data — c_021.
Contracts (sample)
Contract #
Prime
Description
CUI
Export
W56-FA-2001
USAF
Flight Control Computer Integration & Test
CUI: Technical Data
ITAR
N00019-21-C-3001
USN
Avionics Mission Computer Subsystems
CUI: Export Controlled Tech Data
ITAR / ECCN 3A991
FA8650-24-C-0050
AFLCMC
Sustainment & Field Service Support for legacy control surfaces
VPN Networks: 3 — site-to-site IPSec (Wichita & Huntsville & San Diego), secure client VPN for remote engineers (MFA), and a partner/prime VPN with strict ACLs.
Backup Systems: Veeam-based on-prem backups with encrypted tape vault; nightly replication to Azure Gov snapshots; immutable backup retention for CUI snapshots (1 year).
Wireless: Corporate 802.1X SSID for staff (enterprise certs), separate Guest SSID on Guest VLAN with captive portal; enterprise APs (Aruba/Cisco) centrally managed.
Switches & Access: Cisco Catalyst core (9500) and Catalyst 9300 access switches; distribution switches with PoE for APs and edge aggregation; dedicated management VLAN.
Routers: Router at each site (Cisco ISR series) terminating site VPNs, providing routing (OSPF/BGP as needed) and QoS for critical links.
Firewalls: Palo Alto PA-5220 pair (HA) at primary sites; Palo Alto PA-3220 at smaller locations; NGFW rules with IDS/IPS and SSL inspection.
SOC: Internal SOC (Security Ops) monitoring via Elastic Stack, 24x5 alerting with an on-call rotation and playbooks for DFARS/NIST reporting and incident escalation.
Email Systems: Microsoft 365 (Exchange Online) with DLP, conditional access and M365 Defender; on-prem mail gateways used for partner transfer controls and archival.
Position: upper-right
Network Architecture
Keystone operates a segmented network with VLANs for Production, R&D, Finance and an isolated DMZ. Site-to-site IPSec VPNs connect Wichita, Huntsville and San Diego. NGFWs enforce segmentation and a jump host model supports partner access. Backups replicate to encrypted off-site vaults and Azure Gov snapshots.
Design notes
VLANs: 10 Prod, 20 R&D, 30 Finance, 40 Labs
DMZ for partner portal with strict ACLs and transfer jump hosts
Subnets: /22 site clusters, /24 per VLAN
Firewalls: Palo Alto NGFWs with HA
CUI Data Flows
CUI is received via secure prime portals (SFTP), partner web uploads, and controlled email channels with DLP. CUI is staged in the DMZ portal, transferred to on-prem build servers, processed by engineers, and archived to Azure Gov storage. Exports require licensing.
Marking & Resting Points
DMZ partner portal (staging)
ADSP Build Server (processing)
Azure Gov archive (resting)
CUI Data Flow
Security Gaps
Findings (prioritized):
Practice ID
Finding
Severity
Affected System
AC-3 / 3.1.5
Missing RBAC on engineering build server; shared generic accounts
High
ADSP Build Server
AU-2 / 3.3.1
Logging not forwarding critical CUI events to SIEM
Implement RBAC, remove shared accounts, enforce least privilege
Dir. Engineering IT
2026-07-31
Open
AU-2: Logging gaps
Configure audit forwarding for CUI events to SIEM, increase retention
Security Ops
2026-06-15
Open
IA-5: MFA not enforced for privileged remote logins
Extend MFA to privileged accounts and VPN jump hosts
IT Ops
2026-05-30
Open
CM-2: Baseline configs not enforced
Deploy config mgmt tool, enforce golden images for R&D
Config Mgmt Lead
2026-08-15
Open
MA-2: Maintenance tracking & vendor access
Introduce time-bound vendor accounts and session recording
Ops Manager
2026-07-01
Open
MP-4: Removable media controls lacking technical enforcement
Implement USB control software and enforce encryption
Endpoint Security Lead
2026-06-30
Open
SSP Summary
System Boundary: CUI resides on ADSP Build Server, Azure Gov storage, and select engineer workstations. Boundary includes NGFWs, SSO identity provider, SIEM, and transfer jump hosts.
SSP Evidence Checklist
Artifacts: system boundary diagram, network topology, asset inventory, RBAC matrix, SIEM config, backup details, baselines, vulnerability scans, vendor logs, policies, training records, IR plan, POA&M.
Audit Evidence Log
Finding
Evidence
AC-3
Account lists, RBAC policy, AD exports, interview with Dir Eng IT
AU-2
SIEM config, forwarder settings, sample logs showing CUI access