Arcane Digital Shield | Cybersecurity for Arizona Small Business

Intel and TSMC suppliers in the Phoenix metro get a spreadsheet and a clock, not a security department. Name the packet, map it to what you already run, and sign it yourself.

If you run a ~10–40 person shop in the East Valley — say a 15-person fixture shop — the “cybersecurity” problem that actually shows up is not a hoodie in a movie.

It is an email from a buyer or a supplier portal: complete this packet, often about 30 days from the portal email, or the purchase order stalls.

Intel’s Ocotillo campus and TSMC Arizona Fab 21 did not invent paperwork. They did make it local. The same week a quality manager is releasing a job, they are asked questions written for a company that has a CISO. Most shops here do not.

This is the lane Arcane Digital Shield is taking: prepare the questionnaire. You sign it. We do not.

Name the packet before you write a word

People say “the Intel packet” or “the TSMC cert.” Those names are usually incomplete. Different files mean different work.

TSMC supplier information-security assessment. TSMC’s own ESG pages describe supplier standards covering 12 categories and 135 inspection items, training on Supply Online 360, and (since 2022) a mix of self-assessment plus third-party evaluation. You do not get a plaque. You get a portal and a spreadsheet. Source: TSMC ESG article on fab-equipment cybersecurity and 135 items.

SEMI E187 / E188. These are fab-equipment specs, not a general machine-shop diploma. E187 is a baseline for equipment computers (OS, network, endpoint, monitoring). E188 is malware-free delivery, install, service, restore. If you do not ship tools that sit on a fab network, you usually do not need to volunteer “we’re E187.” If the purchase order names the spec, that is a different project. SEMI E187 store listing. SEMI E188 store listing.

Intel Information Security Addendum (ISA). That is a contract addendum for suppliers who touch Intel systems, facilities, or data. Intel may send a due-diligence questionnaire and expect an officer to attest. Intel supply-chain security.

RBA SAQ. The Responsible Business Alliance questionnaire is mostly labor, safety, environment, ethics. Intel still expects in-scope suppliers to complete it in RBA-Online. It is not your firewall diagram. Keep it separate from the ISA answers.

SIG-Lite vs full SIG. Shared Assessments’ Lite form is the short screening version. Full SIG / Core is the long one. Shorter still needs an officer’s attestation. SIG FAQ.

NIST SP 800-171 vs CMMC Level 1. If you also touch defense work: Level 1 is 15 basic safeguarding requirements in FAR 52.204-21 (Federal Contract Information). 800-171 is 110 requirements for CUI — the CMMC Level 2 neighborhood. DoW paused CMMC Phase II in July 2026; Phase I self-assessments remain. We are not a C3PAO and will not sell a certification. DoW CMMC About.

If you cannot name which of those you were sent, pause. Forward the first page — we can map it from there.

How a 40-person shop is supposed to relate

You already have an MSP, or a “computer guy,” or a plant manager with a Microsoft 365 login.

The prime is not asking you to staff a SOC. They are asking whether the packet matches what you already run:

→MFA is enforced (usually already in the Microsoft or Google license you pay for — that is a setting, not a new SKU; Conditional Access is a different, paid feature — keep those two straight).
→Laptops have real endpoint protection, not only what came with Windows.
→Shop-floor machines are not sitting on the same flat network as office email — or you have a dated plan if they still are.
→Backups exist and someone has restored a file this year.
→You can name who you call at 2 a.m.

That is a small manufacturer describing the shop as it runs. It is not ISO 27001. Claim ISO 27001 only when you have it.

Arizona MEP (NIST MEP via the Arizona Commerce Authority) can subsidize operations and sometimes a cyber overview. Use that money. They are not usually sitting in your conference room mapping 135 TSMC rows on a portal clock. That is the gap we are offering to fill. Arizona MEP.

What “good” looks like (matching the packet to the shop)

Good is:

→Answers that match the shop. If a row and the shop do not line up yet, we map it, date a plan, keep moving. A dated “no” plus an owner and a date (a POA&M) is something a prime can work with.
→Evidence that matches the sentence. Screenshot of MFA enforced. Last backup restore date. Vendor list for EDR.
→You sign. We prepare. If a firm offers to attest in your place, that is outside how this work is supposed to work.
→Right scope. SEMI E187 for a fixture shop is usually the wrong badge. CMMC Level 2 for a shop that only has FCI is the wrong mountain.

The Health Check is what the internet already shows. We make that story and the questionnaire packet agree.

Credentials on this practice, said once: eJPT, ICCA, Google Cybersecurity Professional Certificate. Not CISSP. Not CISA. Not a CMMC assessor.

What we sell (and what we will not call it)

→Free External Security Health Check — what a scanner already sees from the internet. Not a certification. Not an audit.
→$250 Gap Assessment — we map your questionnaire to your reality and name the gaps.
→Implementation retainer from $2,800 — starts after the Gap Assessment and covers the first few days of work: drafted answers, missing short policies, an SSP, POA&M. Each next block is quoted before it starts, and you can stop any time.

We do not sell an “audit.” Live operational technology (the line itself) is out of scope. You keep your MSP.

If the portal email is already in the inbox, start on the supplier questionnaire page or with the free External Security Health Check. Phone (602) 345-1485.