Heat Treat Today publishes twelve print magazines annually and included in each is a letter from the publisher, Doug Glenn. This letter from the March 2026 Annual Aerospace Heat Treating print edition highlights the growing presence of heat treat-focused podcasts in North American market, spotlighting both The Heat Treat Podcast with Carlos Torres and Heat Treat Radio, including the transition to a new host, Heather Falcone and the continued evolution of digital content in the industry.
It’s amazing to me that there are at least two professionally done heat treat podcasts in the North American heat treat marketplace. There are actually more than two podcasts, but the two I’m speaking of are ongoing and very targeted toward the North American heat treat industry. Check the end of this column for a link to some of the other podcasts I won’t be discussing at length here.
The Heat Treat Podcast with Carlos Torres
Let’s start with the podcast that it not part of Heat TreatToday — The Heat Treat Podcast with our friend Carlos Torres. Carlos is the CEO of TORSA Group Mattsa and a director at Mattsa Furnace Co. in San Luis Potosi, Mexico. Carlos’ video podcast is housed on YouTube (www.youtube.com/@theheattreatpodcast) and has roughly 70 episodes. Carlos cooperates with Super Systems Inc. (SSI) in Mexico, so it is no surprise that Episode #1 from 2021 featured SSI president and all-around great guy, Jim Oakes. Carlos is a very engaging podcast host and has interviewed the likes of Tracy Dougherty, AFC-Holcroft; John Hubbard, former CEO, Bodycote; Chip Keough of the Atmosphere Group; Chad Wright from Wirco; and many other industry notables including Joe Powell, Ben Rassieur, Karen Stanton, Jason Orosz, Jim and Andy Orr, Andrew Bassett, and Trevor Jones.
When Carlos first started his podcast, I joked with him that there was no way he could keep up the pace of turning out good quality heat treat interviews. That was at least four years ago — I was wrong. Carlos continues to do a great job interviewing and posting helpful, timely heat treat content.
Heat Treat Today
The podcast that is a part of Heat Treat Today is Heat TreatRadio. By the time this column is published in March of 2026, Heat Treat Radio will have deployed over 131 episodes since 2016. Initially, the podcasts were strictly audio, but since January 2023, episodes have been video, audio, and transcribed. The list of industry notables is too long, but suffice it to say, it is impressive.
Heat Treat Radio’s new host, Heather Falcone
The BIG news regarding this podcast is that starting last month (February 2026), Heat Treat Radio has a new host, Heather Falcone, former CEO of Thermal-Vac Technology and currently the CEO of Falcone Consulting. Since 2016, I’ve had the pleasure (and responsibility) of hosting the Heat Treat Radio. Heat Treat Today‘s managing editor, Bethany Leone, has been hugely instrumental in the scheduling and production of episodes for the past four years. Both Bethany and I have handed over the reins to Heather, and we are very excited about how the podcast will morph and grow under Heather’s leadership.
By the way, Heather, in her previous life, was interviewed by both The Heat Treat Podcast (Carlos Torres) and Heat Treat Radio. She is, by every measure, an industry legend in her own right.
The nice thing about having Heather take the lead is her ability to “talk turkey” with other industry experts…something I was not able to do being a lowly “publishing guy,” and her creativity and technical savvy when it comes to digital products like audio and video productions. We’re very excited to have Heather on the Heat Treat Today team.
If you have a topic you’d like to see covered on a future episode, or if you know of someone that you think Heather should interview, please reach out directly to Heather at heather@heattreattoday.com.
Whether it’s The Heat Treat Podcast or Heat Treat Radio, I hope you find some of the heat treat audio (and video) helpful.
What does it really take to achieve accurate temperature measurement in the real heat treat production? In this episode ofHeat TreatRadio, host Heather Falcone sits down with Dr. Steve Offley, product marketing manager at PhoenixTM, to explore the science behind thru-process monitoring, thermal barriers, and data logger performance. From cold junction compensation to real-world shop floor challenges, they unpack why lab accuracy doesn’t always translate to production — and what heat treaters can do about it. Tune in to learn how to ensure your temperature data is as reliable as the parts you produce.
Below, you can watch the video, listen to the podcast by clicking on the audio play button, or read an edited transcript.
The following transcript has been edited for your reading enjoyment.
Introduction (00:04)
Heather Falcone: Today we are talking about a feature article coming up in this month’s magazine, Achieving Accurate Measurements in Real Heat Treat Production. Joining me today is author of this piece, Dr. Steve Offley from PhoenixTM, who is also our sponsor for today’s episode.
Steve is a product marketing manager at PhoenixTM with responsibility for both strategic product management and global marketing of the company’s thru-process temperature, optical profiling, and TUS system product range. Steve joined PhoenixTM in April of 2018 after 22 years of experience in the industrial temperature profiling market with another well-known company.
The Role of PhoenixTM (2:35)
Heather Falcone: Tell us about your role at PhoenixTM and the role of PhoenixTM, specifically how they provide solutions for the thermal processors out there.
Steve Offley: I am the product marketing manager or product manager for the range of temperature monitoring systems that we offer to the wider industrial space. We provide support for clients in a range of industries who are faced with the daily challenges of using thermal processing as part of their key manufacturing step. We offer unique solutions for those specific applications, because not every application is the same. Our goal is to allow the customer to monitor the temperature of their specific product in some form of heat treatment process.
For instance, we could be offering a solution for the coating market, where a client wants to monitor the thermal cure of a car body. They want to ensure that that car body, as it travels through the curing oven, is achieving the correct temperature, not just in the oven itself, but at the product level. So is each part of that car body achieving the right temperature for the right duration to cure the paint?
Another day we might be dealing with a food processor who, as you can imagine, when they’re dealing with food safety and HACCP requirements, they want to prove that the core of their product, which may be a chicken fillet in a deep fat fryer, is achieving the right temperature, to make sure that it’s safe and it’s an attractive product to eat. And of course, they want to be confident that the consumer is going to be healthy after consuming the product too.
In the buildings and ceramics industry, for instance, we can offer the same sort of solution for the manufacturers of bricks, building materials, tiles, etc., where the process may actually be up to three or four days long where they’re drying the products. But it’s still critical to know what the temperature is at the product level.
Much of our focus is on heat treatment of metals. We are trying to provide different solutions across the whole gamut of the heat treating industry — from primary production, such as slab heat treatment for steel and for aluminum, proving that the raw material has been processed correctly in the furnace, to the finished product.
We are talking about the formed metal product, making sure that that is achieving the right primary metallurgical properties. It needs to do the function it’s going to be used for, from a temperature profiling perspective and also possibly even a temperature uniformity survey (TUS), which is obviously critical in many of the automotive and aerospace sectors of the market where they’re trying to prove or validate the furnace performance.
What is Thru-Process Monitoring? (6:08)
Heather Falcone: Can you explain what thru-process is and how it influences the monitoring technology that you’re talking about?
Click the image above for an introduction to the thru-process concept and data logger basics.
Steve Offley: “Thru-processes” is the term that is key to the type of solution we are trying to provide. When we’re talking about heat treatment, there are still many applications where the product may be heat treated in a static box furnace, in which case the traditional technology of using trained thermocouples is probably as easy as any other, whereby you have your field test instrument external to the furnace chamber. The thermocouples are then moved into — or traced into — the furnace, attached either to the product or, if you’re doing a thermal uniformity survey, to a test frame to locate the thermocouples at the desired coordinates within the working zone of the furnace. Then you are collecting the data externally.
I believe it was two episodes ago that you had Dennis from ECM talking about modular heat treatment. He was talking about the challenges of or the increased level of technology associated with moving batches of products around the heat treating cycle in a modular approach.
When you have that type of setup, and even in situations where you may be heat treating in a continuous furnace, the use of a trailing thermocouple becomes difficult at best, impractical and problematic in terms of safety at worst. For the modular approach, you have thermocouples going into different chambers and moving around. There are seals and automated doors in which the thermocouples will be trapped. As such, it’s very difficult to actually monitor the whole sequence of events that may be occurring in the heat treatment sequence.
Traditional vs. Thru-Process Monitoring
This brings us back to the thru-process methodology. At Phoenix, we offer a system that is designed to travel as if it was part of the product basket through the process. The field test instrument, the data logger, has to travel with the product through the furnace.
A data logger in its own right is not capable of going through a furnace if you are measuring at 800°F to 1000°F. One of the key aspects of our system solution is what we refer to as the thermal barrier. It is an enclosure that is used to protect the data logger to allow it to travel through the process. Essentially you encase the data logger inside the barrier and then place it on the conveyor or in the product basket with short thermocouples that are then rooted to the product or to the test frame that’s being moved with the whole monitoring system through the process.
The Importance of Thermal Barrier Design (9:38)
Heather Falcone: The thermal barrier design is really important then, because you’re going to see a variety of environments. How do you protect the data logger?
Steve Offley: That’s the crux of the technology that we’re trying to provide, in so much that there are many different forms of heat treatment or many different forms of thermal processing where we’re trying to provide the protection we need.
You may have, for instance, a low pressure carburizing process where you’re putting the system into a vacuum furnace, and then you may have a high pressure quench at the end. You have to protect the logger and not just from the temperature criteria inside the furnace, but certain things like pressure changes, which can distort the equipment. That is one design barrier, which would give additional protection to prevent any distortion or compressional damage to the barrier.
Click on the image above to find a real-world companion to Dr. Offley’s barrier design examples, covering oil and water quench protection in practice.
There may be some circumstances, like with a T6 aluminum process, where you have sent the system through the furnace, you then got a water quench, and now in the thru-process principle, the equipment has to go through all aspects of the process. You therefore have to have a design in which the system can tolerate both the heating process, but also the rapid cooling going into the water.
You may also have a situation where you have an Endothermic carburizing furnace with an integrated oil quench. The same approach applies. You are going from a hot environment and then rapid cooling. You are not only protecting the logger from the damage of the heat, but also the materials, like the oil or water in the water sequential and oil quench scenario, so as to not damage the fairly sophisticated electronics of the data log.
There is a lot of science and technology involved in designing unique solutions to meet the specific requirements of the applications. In most cases, we are working with the client from their working spec to develop unique solutions that will meet their unique requirements.
Protection and Accuracy (13:36)
Heather Falcone: When we’re talking about actually monitoring the surveys, what special measures are you required to design the data loggers with that provide accuracy?
Steve Offley: By the very nature that we are sending the data logger through the furnace, we have to be careful that we are not only protecting the data logger from physical damage, which is possible if we do not get the thermal barrier design correct. But we also want, at the end of the day, to guarantee that we are achieving the accurate data that we need to make sense of the profile information that we are getting. Because at the end of the process, you either have the thermal fingerprint of your process or if you’re doing temperature uniformity survey, you have the readability of the data at the respective test levels. According to the standard CQI-9 and AMS2750, the accuracy of the reading or the field test instrument has to be within ±1°F.
The purpose of the barrier is to not only protect the data logger from damage, but keep the data logger at a working temperature that allows the accuracy of the reading that conforms to the standards that you are working to.
There are different designs of thermal barriers that we can offer. The basic design is what we refer to as the microporous insulation technology. This is basically a dry barrier whereby the insulation slows down the penetration of the heat to the core of the barrier where the data logger is. But at the center of that barrier, there will be a device that we refer to as a heat sink. There’s a eutectic salt inside the heat sink, which will transfer its physical state from a solid to a liquid at a nominal temperature. It’s 58°C where the transfer occurs and that will maintain the temperature at that working temperature.
For longer processes, you may want to use a thermal barrier that uses what we call a phased evaporation protection methodology. In simple terms, it involves the use of water, which is able to absorb very large amounts of energy and heat, and obviously will boil at 212°F (100°C). While it’s maintaining that boiling state, it will maintain the temperature of the thermal barrier and the data logger inside it. So we can actually offer a high temperature data logger that is capable of operating safely at 212°F for long periods time and still be protected.
Thermocouple Use (17:00)
Steve Offley: As long as the barrier provides us with that thermal protection and the logger is working within its operating range, we are fairly safe. That being said, we have to be a little bit careful when we consider the technology of the thermocouple, because there’s some fairly serious restrictions on thermocouple use, which many people may or may not be aware of.
Many people know that the thermocouple technology was developed by Dr. Seebeck back in about 1821. He was a German physicist who discovered the fact that if you had two dissimilar metals connected at a junction or a point, at a particular temperature, those two dissimilar metals would create a millivolt reading, and that millivolt reading would be proportional to the actual temperature that those two dissimilar metals were experiencing. Hence the theory of the thermocouple.
Dr. Steve Offley showing the aluminal and the chromal leg of a type K thermocouple.
The way the thermocouple works then is that that millivolt can be cross-referenced to a calibration table or a voltage table to determine the temperature reading that the sensor. This is what we refer to as the hot junction, the very tip of the thermocouple. It’s critical that that point is where you want the measurement to be made.
What is often missed is the fact that with a thermocouple, although the hot junction is critical, there is another junction that is even possibly more critical and sometimes overlooked — the cold junction. The thermocouple does not actually record an absolute reading, it’s a ratio between the hot junction and the cold junction. The cold junction of a thermocouple is where the actual thermocouple materials, the two dissimilar metals, join what we refer to as the copper connection. This tends to be where, in the data logger or the field test instrument, the electronics make the physical measurement or process the actual reading from the thermocouple.
If you have a fixed data logger like we have at Phoenix, whereby you would designate the type of thermocouple you were plugging into the data logger — this is a data logger with 20 channels and it’s a type K — I would plug my thermocouple simply into that connector. The cold junction is not in this case at the point where I’m making the connection on the data logger. It is actually inside the logger because there is another wire that goes from the socket to the PCB board where the measurement is actually taken.
Inside the data logger, there is a connector block where the thermocouple wires from the thermocouple sockets will all join the PCB board where the measurement is taken. That’s the location where the cold junction measurement is taken. So, we have our hot junction at the end of the thermocouple, and we have our cold junction inside the data logger.
A side-by-side comparison of the two critical measurement points in any thermocouple circuit: hot junction vs. cold junction.
For some data loggers, that connector or that coal junction may actually be on the outside of the data logger, if it’s a universal connector. So it’s important that you understand where that cold junction is in-situ within your technology. The importance of the reading is the fact that you have a ratio between the hot junction where you are measuring the product and the cold junction where that physical measurement is being referenced inside the data logger.
You can imagine, therefore, if the data logger temperature changes, that change in data logger temperature can actually affect the reading you are taking inside your process. That is why it is important to either understand that and make changes so it’s prevented or do what we refer to as cold junction compensation.
Cold Junction Compensation (22:35)
Steve Offley: Inside the data logger, if you are going to compensate for that temperature difference, the data logger is protected up to a physical temperature. But the temperature is going to change. So that cold junction is going to change as it travels through the processing in the way that we do our measurements for thru-process monitoring. The logger will rise in temperature. Therefore, we have to compensate for that.
In the center of the data logger where the connection is made with the copper from the thermocouple cable to the copper-copper connection, we have a temperature sensor, a thermistor, which is accurate to 0.18°F. It measures the actual cold junction temperature of the logger, and it will then compensate automatically for that. Therefore, you can guarantee that even when your data logger temperature changes temperature, it’s compensating for that. There will be no drift in the measurement temperature that you are measuring at the hot junction at the product level.
Data logger temperature change over process time, with and without cold junction compensation, measuring a stable process temperature of 1470°F | Image Credit: PhoenixTM, taken from Achieving Accurate Measurements in Real Heat Treat Production in the March print edition of Heat TreatToday.
Heather Falcone: That was the first time that I had read about the cold junction compensation and why it’s so critical, especially when we’re doing TUS activities.
Steve Offley: With TUS, the accuracy of both the data or the field testing instrument, or the data logger and the thermocouple, are critical to the quality of the test data that you are collecting and obviously trying to comply with the very stringent requirements of the AMS and the CQI-9 standards.
In our case, where we are going through the furnace, we have a worst-case scenario because the data logger is naturally going to change in temperature. But even if we take the scenario to the shop floor, and we are doing an external temperature uniformity survey, the data logger that is sitting outside the furnace, cold junction compensation is still critical for that because within a working day, the floor temperature is generally going to be changing.
Events on the shop floor, like opening the furnace activity on the shop floor, are going to change that temperature. I’ve been in many plants where seasonal changes can make a significant difference to the temperature into which you are taking the temperature. It won’t be the first time I’m sure that people have taken equipment out a car after having traveled for many miles in the early hours of the morning only to realize that the data logger temperature may not be at room temperature. You have to be very careful that you have a stable piece of equipment and that the cold junction is working correctly.
It’s important to read the user manual because there’s often a very critical step to make sure that you are either calibrating the equipment in a real-life environment where the temperature change may be, or ensuring sure that your system has got cold junction compensation. Otherwise, what you believe is a true measurement and accurate, may be the calibration laboratory accuracy where the temperature is controlled very, very strictly. In a real life situation, you may not be seeing exactly the same results.
Heather Falcone: It is really important to consider because there are specific accuracy considerations for AMS2750 and CQI-9.
Steve Offley: I often make an analogy to racing. The Formula One racing cars are tuned up to perform highly on a racetrack environment. They can do 200 miles an hour, having been finely tuned, and they work well. If you take that same racing car off the road into the countryside, it is not going to be working quite as effectively.
The same can be said for data logger technology. A data logger that works well in a calibration laboratory and under fairly safe conditions may or may not be working as effectively on the shop floor, particularly when you consider the variation and the challenges that that environment will bring to a measuring system like this.
Linear Interpolation Correction Factor Method (27:22)
Heather Falcone: Can you explain how you use the linear interpolation correction factor method, because that’s one of the only that is allowed by AMS2750, and why it is beneficial to your data quality?
Steve Offley: We discussed the nominal requirements for the data log accuracy for its measurement, but for AMS2750, logger correction factors and also thermocouple correction factors can be applied to the test data that you are collecting with your monitoring system.
Firstly, for the data logger, we can create a data logger correction factor file, which basically shows the correction factors that need to be applied to each of the separate channels of the data logger for the data that you are collecting. Inside the data logger, we store the calibration information that was gleaned in the calibration laboratory. That can then generate an automatic calibration template, which can be automatically applied to each one of the channels on the data logger automatically as part of the test routine.
The last thing we want to do is to make some error by transferring raw data manually from a spreadsheet into a piece of software. So, the nice thing about that is that it’s automatically applying the pre-programmed offsets from the calibration routine in the laboratory itself.
Secondly, with the thermocouple, we can take a calibrated thermocouple where there will be a nominal reading at two ends of the thermocouple, and you then get the average correction factor. In some circumstances, people will apply a thermocouple correction factor of one nominal temperature below the test level that they are applying. At Phoenix, we calibrate the thermocouples across the complete temperature range of the data logger. Then, we apply what we call the linear interpretation method. What that means is that between each calibration point, we can calculate, using a linear regression line, the true correction factor at any temperature over the measurement range of the device itself.
The linear interpolation schematic showing thermocouple correction factors across the full calibration range | Image credit: PhoenixTM, taken from Achieving Accurate Measurements in Real Heat Treat Production in the March print edition of Heat TreatToday.
It cannot go beyond the bounds of the upper and lower limit, as extrapolation is not allowed as it says in the standard. But within the upper and lower bounds, we can interpolate linearly between each data point. There is a tight 140° between each point that we can then ensure that we are correcting for or playing the correct correction factor at each temperature from start to finish, not a nominal value over the whole range. In our view, that gives a far more accurate interpretation of the corrected data over the complete working range of the system as opposed to a single nominal value.
Final Thoughts (31:09)
Heather Falcone: We have talked about a variety of topics: thru-processing monitoring, thermal protection at the data logger, the benefits of making sure that you apply cold junction correction, and the specific accuracy considerations that we have to make sure we bundle in all together. What is the big takeaway you want to leave us with?
Steve Offley: Be careful you do not assume that the condition of operation in the calibration of laboratory is going to be reproduced on the shop floor because the conditions are very different. This comes back to the argument for the importance of cold junction compensation. If you are using technology or a data logger, check with the manual for what cold junction compensation should be applied and if there are any steps you need to make to ensure that that is applied correctly on the shop floor. If you do not, there is a high risk that what you think is accurate data may or may not be if you have a situation where your data logger temperature is varying with time, either in process or even on the shop floor with changing environmental conditions.
Heather Falcone: In the end, we want to make sure that we’re making good parts, and this sounds like a great system to make sure that you’re getting as accurate as possible.
Steve Offley: Quality data at the end of the day is essential for you to understand what your process is doing. It’s no good relying on data you cannot trust. Take that extra time to investigate and put steps in place to make sure that you are measuring what you think you are measuring at the hot junction and that the cold junction is being considered as part of that measurement process.
About the Guest
Dr. Steve Offley Product Marketing Manager PhoenixTM Ltd.
Dr. Steve Offley, aka “Dr.O” is a product marketing manager with PhoenixTM Ltd. with 30 years of experience of temperature monitoring in the industrial thermal processing market.
Heat TreatRadio host Heather Falcone is joined by Andrew Bassett, president of Aerospace Testing and Pyrometry, for a deep dive into AMS2750 and best practices for managing pyrometry compliance. Drawing on more than 35 years of hands-on experience and his role on the AMS2750 writing team, Bassett explains how the specification has evolved and why pyrometry continues to drive a majority of audit findings. The conversation explores common compliance pitfalls, practical system-level solutions, and how heat treaters can better prepare for audits without over testing. Falcone and Bassett also discuss the value of industry involvement in shaping standards that directly impact daily heat treating operations.
Below, you can watch the video, listen to the podcast by clicking on the audio play button, or read an edited transcript.
The following transcript has been edited for your reading enjoyment.
Introduction (00:04)
Heather Falcone: Hi, I’m Heather Falcone, and welcome to Heat TreatRadio. Today we are talking about AMS2750, and the best practice to manage pyrometry compliance. Joining me today is Andrew Bassett, president of Aerospace Testing and Pyrometry. Andrew has more than 35 years of experience working alongside manufacturers, captives, and commercial heat treaters to ensure their testing calibration and pyrometry programs meet the demands of industry specifications like AMS2750 without losing sight of how shops actually operate.
Aerospace Testing and Pyrometry (ATP) provides accredited testing, calibration, and pyrometry services nationwide that support heat treaters and aerospace manufacturers across compliance, audit readiness, and ongoing system integrity. The company also developed the Aerospace Compliance System (ACS), a software platform designed to support compliance and documentation requirements tied to testing and pyrometry programs.
Andrew is deeply involved in the aerospace, metals, and engineering committee responsible for writing AMS2750 specification and is an active contributor within the Nadcap Heat Treat Task Group. He brings practical systems level views of quality that go beyond checklists and audits.
Tell us a little bit about yourself, other than my delightful intro. There’s more about you, your industry involvement, and about ATP.
Andrew Bassett: I’ve been involved with pyrometry for 35 years now. My involvement with pyrometry started with a family-owned business. About the time when the Nadcap process was coming to fruition, some of my mentors, who are still my mentors today, dragged me to my first Nadcap meeting and said, “Well, if you’re going to do this pyrometry stuff, then you better learn it.”
Off I went to Hartford, Connecticut for my first understanding of Nadcap and how much pyrometry is a big part of the thermal processing industry. From that point forward, I dove into the specifications and wanted to be a part of a solution rather than contributing to the problem.
I got involved with AMS2750 and AMEC. When I showed up to my first meeting, the chairman at the time wanted to know who I was and what I was doing there. After explaining what I do and my desire to join the 2750 team, he said absolutely, because at that point, I was the only person in the sub-team that had hands-on experience in pyrometry and was writing the standard. I’m the one that actually picks up the thermocouple, sticks it inside a furnace, and knows what the real world is. Thankfully the chairman saw that and said, “You need to be a part of this.”
I started Aerospace Testing and Pyrometry (ATP) in 2007. When I first started the company, I wanted to dedicate my focus on helping our clients succeed, and make sure that we are the industry experts, providing the customer service that they deserve. I wanted to look at what the specification allows for frequency reductions and stop over testing the equipment, while staying within the compliance requirements of the standards.
AMS2750 is not the only pyrometry specification out there. We then got involved with the other aerospace prime specifications, ensuring our customers maintained compliance to those as well.
We have branched out since those early days of 2007, which consisted of me running around the country, taking care of pyrometry. Now we have 28 people in the business and multiple offices coast to coast with a great team behind us that shares the same vision, ensuring pyrometry service is our ultimate focus for our clients.
Heather Falcone: What is really important about that is that, as a former heat treater actively helping the heat treat industry now, there is not one system that puts all of these standards and specifications together. Companies have their records, data collection, and everything is all separate.
What is ACS? (5:37)
Heather Falcone: Tell us a little bit about ACS and how this software helps with this issue.
Andrew Bassett: The dream of the aerospace compliance software came out of us doing things the old-fashioned way, entering calibration data into an Excel spreadsheet, which enables the human factor and leads to human errors. When it comes to compliance audits, human errors cannot happen. So we tightened up our processes in the Excel world, but I knew there had to be a better way.
That is how we started down the road of developing aerospace compliance software. The idea was that it was going to be strictly an ATP tool to use for my technicians and the team to use the software. But the industry is small enough that people started hearing about what we were doing. Clients began requesting to be able to use the software. That is how the system has grown to where it is today.
Back in my early days in pyrometry when I started ATP, I would literally build pyrometry compliance notebooks, old fashioned binders. When we would get a new client, I would go buy a bunch of notebooks from Staples and put in their little dividers of a pyrometry program together. We would have information and specifications about their furnace, calibration reports, SAT reports, TUS reports, thermocouple control logs, etc. That’s where ACS has now been built, replacing my old notebooks.
Now we have a system that’s 100% not just a pyrometry tool — it’s also a compliance tool. New features we have added have a focus on compliance, just not pyrometry-related tools. We now have tools for preventive maintenance leak rate testing checks that are required and controlling your thermocouple replacement schedule. It’s bigger than a pyrometry tool now.
This software has now expanded across multiple industries, not just in heat treating and thermal processing, but also chemical processing, NDT, composites, etc. It is a fully compliant software for multiple industries.
Heather Falcone: It’s meant to be that holistic, wraparound software for your quality folks to have someplace safe that all their data can get stored, aggregated, and usable.
Andrew Bassett: It’s also and most importantly a self-checking software to not only the industry specifications, but client internal specifications. It doesn’t have to be solely what AMS2750 says. It could be 2750 or GEs requirements, or Boeing’s requirement, or an internal spec. It will parse all that information to make sure it’s compliant to those standards, and it’s completed faster than you can blink your eye.
AMS2750 (9:20)
Click the image to get a deep dive into AMS2750F fundamentals, as Andrew breaks down the core requirements of AMS2750F.Click the image to learn about navigating AMS2750F compliance challenges.Click on the image to understand the critical role of Temperature Uniformity Surveys (TUS) in ensuring repeatable heat treating processes under AMS2750F
Heather Falcone: Can you talk about AMS2750, how it has evolved beyond I think what many of us ever thought it would be, and some best practices on how you can best get your arms around that standard and manage that day to day?
Andrew Bassett: When I got into the industry, we were at Rev C, AMS2750C, and those who’ve been around long enough to know that revision of the spec was the Bible. You gave it to a hundred different people and you got a hundred different interpretations.
It was very unclear on the spec. The iterations from there have gotten better, with 2750D and then the major changes going into E, then all the way up to our current state of Rev H. It’s now more clear, though there are still some confusing parts. My goal personally is to make sure that document is clear and understandable. Even if it’s 300 pages and we use stick figures and crayons to explain what the intent is — I’m okay with that. So it shouldn’t be a document that is hard to understand. The aerospace standards for heat treating are fairly clear on the intent of the spec, but for some reason, pyrometry has always been this scary black hole that you have to try to figure it out. I’m looking forward to the day where that is not the case.
Click on the image above to check out Heat Treat Radio #91 where Andrew demystifies one of AMS2750’s most critical yet often misunderstood specs: the ±0.1°F requirement.
Coming to a understanding of that specification is not easy to do. Understanding what the intent and the requirements are takes some good studying, as well as getting the intimate training of that specification.
We do provide pyrometry training, and when I first started doing it, it was a 6- to 8-hour day class, the 30,000-foot level. Over the last several years, I’ve broken it now into a two-day class. My PowerPoint presentation has expanded to 168 slides when the spec is only 57 pages. But now I’m doing more of a crop-dusting training level so everybody can understand it. That is extremely helpful for suppliers that need to meet that standard.
Heather Falcone: Interpretation is key for suppliers, understanding how the standard applies to their shop, their floor — that’s a real challenge.
Andrew Bassett: The specification is just not a North American spec. It’s a global specification, and it’s not even just an aerospace standard anymore. It’s gone into the commercial world, the FDA. Now, if you’re doing heat treatment of dental drill bits or knee replacement parts, anything that’s metal, the FDA now requires compliance to AMS2750. Having someone walk you through the standard and reaching out, there are many ways to figure out the intent of the spec and how it applies to each organization.
Best Practices in Managing the Beast (14:40)
Heather Falcone: What are some best practices in managing this if you have to integrate AS, ISO, Nadcap? You have your whole QMS, and then you have 2750, P10TF3, etc. How do you do it?
Andrew Bassett: That’s a huge undertaking. My experience over the years is diving in with our clients and finding out what types of heat treating they are doing. I like to find out who they are heat treating parts for, who are the clients, where are the parts ending up? There could be POs coming in for the clients to heat treat “X” part, and maybe they are not doing their due diligence and the part is actually going to GE Aviation. Well, GE Aviation has their own pyrometry requirements that are offset from AMS2750 or Saffron or any of the other aerospace primes that may have a requirements from a pyrometry standpoint.
So first gathering that information altogether and making sure you are constantly up to date of what you’re processing is critical. From there, with the aerospace compliance software, now that tool can be utilized to manage all your requirements, from your calibrations, your TUS, your SATs, everything can be managed in one location.
For instance, if you’re doing work for GE, and you have to follow their requirements of P10TF3. GE does not have anything in their specification that talks about the alternate SAT that’s specified in AMS2750, but GE also do work that needs to comply with that standard. So this tool is going to keep you on track. This kind of management tool is cabale of managing that for you, so nothing gets missed.
Once that knowledge base is put together and we have a clear path of what needs to be done from the heat treater or the captive shops standpoint of who they are processing work for, then you can use something like ACS that can manage that whole aspect for you.
How Does ACS Work with Other Systems? (17:06)
Heather Falcone: From what I understand, ACS is plug and play. It comes on-site, ready to go as a standalone tool. But how does it also work with other systems that you might have?
Andrew Bassett: ACS is a standalone system. People have access to it; we have a tiered subscription for it depending on what level of the ACS you want. We have also been working with a few industry giants out there to integrate ACS software with certain systems that help manage heat treat processes. There will be an integration point there where ACS will be able to make sure that jobs don’t get processed if TUS or calibration or SATs are past due for heat treat equipment. They won’t be able to enter a job into that piece of equipment. It will stop them from putting something that shouldn’t be going into a furnace. These are some of the features that we will be integrating in 2026 where we’ll be able to work with other software solution providers out there in the heat treating realm to make sure everybody is looking at the same thing.
Heather Falcone: The reason that we want those lockouts in place is because we are trying to avoid NCRs during our audits. We’re trying to get NCRs that will be value-add, not something that we knew we should have been doing and were not. The whole point is to better the company so that we do not have a bunch of pyrometry NCRs during our audits.
Common NCRs for Pyrometry (19:08)
Heather Falcone: What are the top NCRs that you’re seeing for pyrometry currently?
Andrew Bassett: It has been well documented through the Nadcap process that 80% of NCRs actually do come from pyrometry. That has always baffled me, especially being a member of AMS2750 sub-team that writes the standard. What have we done as a team to fail the suppliers out there by not writing clear consistency?
Over the last two revisions, I think many requirements have been clarified. But there are still some pyrometry-related issues that I still see. For example, you may have your preventive maintenance or unscheduled maintenance that is being completed to a piece of equipment. You have a requirement to have that maintenance documented and then approved by a by someone from quality to make sure that no further pyrometry testing is required. Sometimes those logs are missed, or possibly a maintenance manager verifies a door seal was replaced, but then quality does not sign off and date that log.
That is an example of an issue that we identified and put into ACS. Now you can keep that preventive maintenance program in ACS for that particular piece of equipment. With unscheduled maintenance, when the maintenance is completed, it automatically shoots an email to the quality team to have them review and ensure no pyrometry requirements are missed.
That’s an example of one of those top NCRs that you always see with Nadcap. We saw the need and created a solution to that with ACS.
Benefits of Getting Involved (21:11)
Heather Falcone: We want to make sure that everybody can get more involved in shaping the face of compliance so that they do not become a victim of it. How can everybody, including captives, get more involved, and why is that valuable to their bottom line?
Andrew Bassett: This is something I preach constantly with our client base. If you’re Nadcap accredited, firstly, go to a meeting. Learn, be present. You have a say. I’ve been going to Nadcap meetings for 30+ years now, and even though I’m not a supplier, I’m not an aerospace prime, I’m a guest that that shows up. But I keep going and I raise my voice and share my concerns with the group at Nadcap and with the suppliers. Having that voice is important. I know that suppliers need to get more involved. I know it’s an expense to send several people from a company out to a Nadcap meeting, but it’s money well spent when you get involved with AMEC and with creating the specifications.
I had this myth early on in my career that this golden group of aerospace gods were creating standards. When I showed up to the meeting, there were more suppliers there writing the standards than there were the primes. It was amazing to see that we have people that are in the industry that do the heat treating or in the metallurgist or for these organizations that are in charge of the specs. It’s the everyday heat treater, the people with boots on the ground, so to speak, that get involved. So getting involved with AMEC, getting involved with Nadcap, that’s key to any success when it comes to compliance and having that say in writing standards that you know what you’re going to have to comply with.
Heather Falcone: Absolutely. They give us so many opportunities to get involved. There’s four AMECs a year and three Nadcap meetings.
Andrew Bassett: To me it’s well worth it. At least go to the Nadcap meeting that’s always once a year in Pittsburgh. It is the most well attended meeting typically out of all of them. That one is really going to get your feet wet and get that whole experience of Nadcap.
Heather Falcone: That’s usually where they’re making major decisions, like finalizing checklist changes. Being able to get out in front of that and not just wait to get the email from the automated PRI.
Andrew Bassett: I will move mountains to make sure that I am at every Nadcap meeting. For us, I can take that information for those meetings for my clients that don’t end up going and be able to disseminate that information. It doesn’t matter if it’s pyrometry or heat treating or whatever that’s coming out and say, this is coming down the pike. Where do we need to tighten some things up?
Developing Compliance Software For Complex Specifications (25:46)
Heather Falcone: Most of the time I’ve seen when I’m going in to see a heat treater that their compliance program is great at a base level, but there’s too many pieces. So what has that been like trying to develop a compliance software for literally one of the most technically complex and arguably important specifications in our industry?
Andrew Bassett: It’s been a challenge for sure. With AMS2750, at one point it was starting to be updated every two years. Thankfully, we have four developers on our software team, so all the developing for us is in-house. Being on the forefront of changes by attending Nadcap meetings and being a part of AMEC, we can jump right into development and be ready for the update.
Future Specifications and Revisions (27:30)
Heather Falcone: We are on Rev H — what’s next? Is there another spec change on the horizon?
Andrew Bassett: Letter J is on the horizon. We did start working on it. Once the spec is released, the team keeps a parking lot of issues that come up. Then we just basically put it on a storyboard, and when we’re ready to start working on them again, we start working on it. The changes over the last two revisions on G and H, have been minor. It was the first time in the history of the specification, back at Rev G, that there were change bars for the first time.
A change bar is on the left-hand side of the document, indicating where we changed something in the spec. Prior to that, we rewrote the spec and people had to read the whole thing to know what had changed.
I don’t see a time where we’re ever going to have a complete overhaul rewrite of the spec in the future. So yes, we are working on Rev J. These updates will be more clarifications that have sprung up over the last several years. We were trying to put one out every two years to keep up to date. The aerospace community, Nadcap, and AMEC, they were getting a little antsy that we were writing it so quickly, so we put a little pause on that.
We did jump back into it a couple weeks ago. We had our team meeting and worked out a few more issues that are out there. Not a big major overhaul, more clarifications and trying to get more intention of what the requirements that we’re writing.
From a Nadcap standpoint, with any changes to industry specifications, there will be updates on new checklist revisions. That’s always a grinding process to get a checklist that everyone’s going to be happy with. I did not yet look at the agenda for the next meeting in February in San Francisco, but it seems like every time we do have a meeting, there’s a checklist that we’re working on.
Heather Falcone: That is a great takeaway — get involved, right? Go to the meetings, take your opportunities, get involved with people like Andrew that have been in the industry. It’s a wealth of knowledge, and if we’re not taking advantage of your expertise, your experience, then we’re really missing out on taking knowledge back to our own shops.
Is there anything that you want to leave us with before we close out?
Andrew Bassett: You’re spot on with that. That’s that actually what brings me the most joy of what I do is being able to part the knowledge that I have to my clients. Anytime I meet somebody and we talk pyrometry, my business card comes out and I have my cell phone number on there. I tell them, go ahead and call me, text me, smoke signals, whatever you want to do. If there’s a question you have, I’m more than happy to answer it to the best of my abilities. I mean, I’m only one of 12 people on the team. It’s about parting that knowledge and assisting our clients to be successful and have a great understanding of what the requirements are and really make sure that they understand it.
About the Guest
Andrew Bassett President Aerospace Testing & Pyrometry
Andrew Bassett has more than 35 years of experience working alongside manufacturers, captives, and commercial heat treaters to ensure their testing, calibration, and pyrometry programs meet the demands of industry specifications like AMS2750 without losing sight of how shops operate. Aerospace Testing and Pyrometry provides accredited testing, calibration, and pyrometry services that support heat treaters and aerospace manufacturers across compliance, audit readiness, and ongoing system integrity. The company also developed the Aerospace Compliance System, a software platform designed to support compliance and documentation requirements tied to testing and pyrometry programs. Andrew is deeply involved in the Aerospace Metals and Engineering Committee responsible for writing the AMS2750 specification and is an active contributor within the Nadcap Heat Treat Task Group. He brings a practical, systems-level view of quality that goes beyond checklists and audits.
Heat TreatToday is excited to announce the addition of Heather Falcone to the editorial and podcast team, beginning on Monday, March 3, 2025. She will be taking on the responsibilities of content editor for the daily e-newsletter, original content writer, and Heat TreatRadio contributor.
Heather, the founder and principal of Falcone Consulting, LLC, is a servant leader with over 20 years of experience in heat treating, brazing, and chemical processing. She spent most of her formative years as a second-generation member of a family-owned heat treating and brazing business. As the former CEO of Thermal-Vac Technology, she successfully led the company through the pandemic, ensuring stability while propelling it into a new era that resulted in a successful exit in 2024. Passionate about challenging the status quo, she champions diverse teams and fair chance hiring, with a focus on developing successful teams that are future-proof and thriving.
Beyond her position as founder and principal at newly formed Falcone Consulting LLC, Heather is a board member, coach, speaker, and writer, advocating for small businesses, workforce development, and success for the heat treat community at large. She provides her expertise in aerospace specifications and the Nadcap process in an ongoing role as the special project consultant for Cook Induction Heating in Maywood, California. Additionally, she has played a pivotal role in industry organizations like the Metal Treating Institute, AMEC, and Nadcap, while also supporting local nonprofits such as Chrysalis and the Orange County Workforce Development Board.
“We’re thankful to have Heather joining the Heat TreatToday team,” said Doug Glenn, founder, owner, and publisher of Heat TreatToday. “I’ve known Heather for many years and have been impressed with her initiative, courage, and fearlessness in everything she does. As an organization that is deeply invested in making sure in-house heat treaters have the information they need to become more efficient and profitable, Heather will be an excellent addition to our editorial team. She knows the industry; she knows what our readers need. And as we all know, the happier the readers, the happier our advertisers.”
Heather is an Ironman triathlete, a Seven Summits enthusiast who has summitted Mt. Kilimanjaro and trekked in the Everest region, and a loving wife and mother to two teenage boys.
For more information, click here for Heather’s LinkedIn page, here for Falcone Consulting’s website, or here for her Heat TreatToday 40 Under 40 recognition in 2019.
Welcome to a special edition of Heat Treat Today’sThis Week in Heat Treat Social Media. We’ve discovered a furnace-full collection of posts that document the excitement of the past week at Furnaces North America (FNA). From the arrival of booth materials to the final speech at the MTI awards ceremony, they’re all here: check out these posts and videos for a roundup of FNA and heat treat social media.
As you know, there is so much content available on the web that it’s next to impossible to sift through all of the articles and posts that flood our inboxes and notifications on a daily basis. So, Heat Treat Today is here to bring you the latest in compelling, inspiring, and entertaining heat treat news from the different social media venues that you’ve just got to see and read!If you have content that everyone has to see, please send the link to editor@heattreattoday.com.
1. Lightening the Pre-Show Heavy Lifting
A good show is more than just what happens from curtain rise to curtain fall. Whether it’s a play on the stage or a trade show in a convention hall, there is a lot of work that goes into setting up and tearing down . . . sometimes back-breaking work. The advent of 3D printing has made that task a little easier, and ironically, at FNA 2024, that means models set out for display were processed with 3D printing to preserve the look of metal while making it easy for team to carry to the floor. Thanks to Sarah Jordan for bringing this post to the web.
2. Kudos and Awards from Beginning to End
We love it when social media is full of the faces of the heat treat industry, and this week is no exception. We found individual recognition posts, the celebration ofHeat Treat Today’s40 Under 40, and the Metal Treating Institute‘s honorees at the awards ceremony on the last night of the show.
Eyes and ears were open and trained on all that’s new in heat treating presented at FNA 2024, whether in technical sessions; impromptu, on-the-floor demonstrations; or new product reveals.
What does cybersecurity look like in a heat treat shop? In this episode, Doug Glenn, publisher of Heat TreatToday and host of Heat TreatRadio, will be speaking with four industry experts about this challenge: Heather Falcone, CEO of Thermal-Vac Technology, Inc.; Brian Flynn, plant manager at Erie Steel Ltd.; Mike Löpke, head of software & digitalization at Nitrex Metal; and Don Marteeny, VP of Engineering at SECO/VACUUM Technologies LLC. Watch, listen, and learn all about the risks, preventions, practical steps, and future outlook that this panel has to share.
Below, you can watch the video, listen to the podcast by clicking on the audio play button, or read an edited transcript.
The following transcript has been edited for your reading enjoyment.
Doug Glenn (DG): Welcome to another episode of Heat Treat Radio. We’re going to talk about a relatively serious issue today. I hope to have a little bit of enjoyable time doing it. I’m really happy to have these four people on the call with us. We’re going to talk about cybersecurity -- probably one of the most pressing issues. Obviously, it’s not heat treat specific, but we’re hoping to take some of the specific issues that deal with cybersecurity and, if possible, drill them down into the heat treat industry, as best we can.
So, I’d like to introduce our prestigious crowd here today. They’re going to talk a little bit about it.
Contact us with your Reader Feedback
Heather Falcone CEO Thermal-Vac Technology, Inc.
First, I’d like to introduce Heather Falcone who is the CEO of Thermal-Vac Technology, Inc. out of California. Heather is the CEO, as I mentioned, and currently serves as a member on the board of directors of the Metal Treating Institute. She is a recognized trainer, writer, public speaker on a variety of topics such as leadership, business, and heat treat equipment. At her company, she has led them to be fully compliant in missed 800-171 and DFAR 252.204-7012 -- that’s important, I’m sure -- cybersecurity program as well as EOS system. Heather is, in fact, a member of Heat TreatToday's 40 Under 40 Class of 2019. And I, also -- I don’t know if they’re going to be able to see this; I’ll put it up on the screen if not -- there’s Heather’s picture in a really nice magazine that we got about leadership. Anyway, I am glad to have you here, Heather.
Brian Flynn plant manager Erie Steel Ltd.
Next is Brian Flynn from Erie Steel, Ltd. Brian is a third-generation heat treater. He attended the University of Cincinnati earning a Bachelor of Science and Chemical Engineering degree with a minor in Material Science. He’s also completed an executive MBA from the University of Toledo. As a plant manager, he has close familiarity with technology development, people skills, customer service, and management of technical services. He is also a member of Heat TreatToday's 40 Under 40 Class of 2021. We’ve asked Brian to get involved here because I think he’s probably got a good perspective on implementing some of this cybersecurity stuff. I appreciate you being here, Brian, thank you.
Mike Löpke head of software and digitalization Nitrex Metal
Next on our list we have an international entry -- Mike Löpke from Nitrex, actually. He’s working out of Germany, right now, but let me read what we’ve got here. Mike has been with Nitrex going on two years and is leading the creation, implementation and marketing of new digital platform for the Nitrex group. He has a background in mathematics and physics as well as substantial knowledge in R&D and metallurgical modeling and is currently in charge of Nitrex software and digitalization department. His expertise in AI (artificial intelligence) and process prediction led Nitrex to develop the very first IIoT-based platform called QMULUS. His thirst for knowledge enables him to remain ahead of evolving technologies. As I mentioned, he’s working out of Germany and he was, and maybe still is, a professional wind surfer. I did enjoy the videos, by the way, Mike. It was very, very good.
Mike Löpke (ML): Thank you very much!
DG: It’s interesting and it looks exciting. You certainly went to some nice places there.
Don Marteeny VP of Engineering SECO/VACUUM Technologies LLC
Finally, I would like to introduce Don Marteeny (DM) who I’ve had the pleasure of working with in the past. Don, it’s always good to see you. Don is the VP of engineering at SECO/VACUUM Technologies for over 5 years. During his career, Don has fulfilled many roles including 3 years as a project engineer, 2 years project manager and 2 years as the engineering team leader. He’s a licensed professional engineer. Don led the implementation of a 3-D modeling tool at SECO/WARWICK, when he is not busy being a Cub Scout den leader, which is great, Don presents papers on state-of-the-art heat-treating technologies. Don is also a Heat TreatToday's 40 Under 40 Class of 2021 recipient; congratulations on that. And Don’s just a heck of a nice guy all around, which I’m sure all of you are!
It's good to have you all.
Let’s jump in, guys. This is a relatively serious topic that we’ve got going on here but let me just throw out some questions to you. Heather, maybe I’ll start with you, if you don’t mind.
When we look at the risk potential in the heat treat market, I guess the first question that comes to my mind is: Okay, who should really be worried about this? Who are some of the people? Brian, maybe I’ll jump to you after Heather is done with some input on that, as well. Go ahead, Heather.
Heather Falcone (HF): Well, the short answer is literally everybody. Literally every person in the United States is subject to being a target for a nation-state level adversary such as China, Russia, Iran, North Korea. No one is safe, no one should assume they are safe, and every single person in this country, regardless of whether you’re a businessperson or not, should protect the data that keeps us safe.
DG: Do we have a sense, Brian, maybe over to you on this -- and again, as I mentioned before we started, if somebody doesn’t have a comment on this, just pass on it -- but are there people or organizations or systems in the heat treat industry, specifically, that are at a higher risk? What do you think as far as risk?
Brian Flynn (BF): In terms of age group demographics the Baby Boomers as well as Gen Z and younger are considered the most vulnerable for cyberattacks. Baby Boomers didn’t have great exposure to today’s brand of cyberattacks nor did they grow up with the internet and computers as we know them today. Gen Z and younger, there is a certain carelessness in terms of sharing personal information they’re too trusting. On top of that, Covid created new types of uncertainty in conjunction with the influx of new users going online since 2020.
But more from a business perspective, I guess it depends. Healthcare, government and financial-like institutions pose the highest potential reward but also the highest risk. In terms of frequencies, small businesses, like myself as a commercial heat treater, are the number one target as they typically lack resources and capital expenditures in order to invest in the infrastructure. And it might just be a pipeline where they’re going through the small businesses to get to my bigger Fortune 500 customers, but it’s really mainly phishing emails that are infected with malware. Over the past 12-18 months, it’s been crazy how many have made it through our firewall.
DG: Over to our equipment guys. I should mention -- Heather and Brian are both commercial heat treaters, Mike and Don are really both kind of equipment guys, although Nitrex also does some commercial heat treating, as well. Don, why don’t we start with you. The same question: Who’s at risk here? And then, Mike, we’ll end with you, please.
Don Marteeny (DM): Well, in addition to what Brian said, which I found interesting on some of the demographics, it’s important to realize, too, that it’s not just people, it’s also equipment. The equipment is becoming more and more interconnected, especially with the IIoT capabilities that most of them have now and all the unique features that that brings, but what that means is -- in order for that technology to function as it intended, it has to be connected to the internet which opens up more doors for access to sensitive data. And it’s not just data that you receive, it’s data that you generate, right? And that’s the important thing, I think, that everybody’s got to realize is that once you’re in that chain of subcontracts, shall we say, and you’re working with those folks that are contracting to the government -- handling sensitive data, you’re in that, too. It’s important to recognize that it’s not just you and your users but also your equipment and how it’s interconnected to the network.
DG: I’m reading a book right now -- I’ll give a plug to this guy -- Mark Mills, who we’ve interviewed before, on this show actually -- it’s called The Cloud Revolution and he’s been talking a little bit about this. The amount of data that is out there, because we’re able to get data off of machines and things like that now and are doing more and more, is just skyrocketing. It’s that data that’s going to be an issue.
Mike, over to you; I just want to wrap up as far as risk assessment, here. Who are the people, organizations, equipment or whatever that is most at risk?
ML: From our perspective, there’s not that much to add. We covered already the topic so we have this human factor which plays a really, really big role in terms of cybersecurity, how people are really sloppy and do not have the right mindset to treat data as they should. We have also, a lot of times, not the right policy in place, we do not have the education needed and so on. There is always this human factor.
But also, with heat treatment as a really old industry and steel manufacturing, as well, we have a lot of facilities with outdated infrastructure. This is also a also big topic. Outdated infrastructure, old, dated network designs firmware which we do not need to talk about it’s 20 years old and older so nobody knew about the potential risks that arise during the last decade and during the last years. This is also a really important factor. That’s it, from my perspective. Everyone, as said, is at a high risk, so, summing it up -- it’s literally everyone and everywhere.
DG: If you think you’re safe, you’re not, right? I think when Heather first started talking, I thought, “Boy, this is going to be a horror show.” If you think you’re safe, you’re not; you’re most at risk.
Let’s talk about data and data storage. Those types of things are really at the core of this, I think. Where are we going to store of all our data? How do we do it safely? When it comes to data storage, what problems have you witnessed or are you aware of, and how about solutions for data storage?
Don let’s start with you on this one then we’ll go to Mike. I know a lot of companies say, “Well, I just want to keep my data in-house.” Is that the answer? What are we doing with data?
DM: That varies. From my observations, it varies from customer to customer, industry to industry. There is a sense to move it to the Cloud, just because it’s easier to manage there, but with that brings risks. I think everybody’s got to be aware of that when they make that decision. On one hand, do I maintain my own servers, do I hire the people to man those servers, etc., or do I pay somebody else to do that in the Cloud? Do I take that risk of the data being someplace I don’t know and I rely on the Fortune 500 company who I’m contracting to maintain the Cloud to secure it, or do I do it myself? Especially for small businesses, these are not easy questions to answer. Like I say, I’ve seen both. And, again, with the invent of Industry 4.0 and IIoT, the pressure to move to the Cloud is pretty high, so, if you want to take advantage of those technologies.
DG: Mike, how about you? What do you think as far as data storage and things of that sort?
ML: I think Don mentioned already the two options we have. We could take of all the data storages ourselves, having big data service on premises, having people responsible for it, managing everything, keeping it running, no creation of redundancy, call it like this, having back-up systems -- all of these things you would need to manage by yourself. And the requirements are getting tougher. If you think of having data for the aerospace stored, you’re talking about decades of years, so that’s it.
The alternative is to put everything to the Cloud so then you’d just say, “Ok, I need more data” and more data storage space is available. You can also make use of all the security measures created, for example, by the big Cloud infrastructure providers like AWS in Asia. They are professionals in this. If they say your data is secure because we are using the latest technologies, I think you can be sure that it is. We, at Nitrex, rely fully on this. We say we could not do it better. There are thousands of people working every day on Cloud security, on infrastructure security, and so on and so on. I think our facilities could not be safer.
DG: Brian, let’s go to you on this one and then, last, to Heather. Data security -- if you want to make comments on that and maybe even, if I can put a little sharper point on the pencil on this -- just because a person keeps data in-house, does that make them safe from cyberattacks? General question, or if you want to answer that specific one, Brian.
BF: In today’s climate, the security of the data storage remains at the top of our lists. Knock on wood, very fortunately, we haven’t been on the receiving end of any of those types of cyberattacks, likely because we have a good firewall in place. More relevant to Erie Steel, the problems we face are data storage limits, length of data retention and scalability, and also accessibility -- whether it be video records, furnace records, quality records, shipping records, the list goes on, as far as how long do we want to retain that data and how accessible does it need to be? We utilize surveillance cameras, not spying on employees but really more proof of key operations, proof of start, proof of completion. The cardinal sin of heat-treating is don’t ship a green part back to the customer, so what better way to prove that other than by surveillance systems.
But that poses an issue -- we make sensitive cameras, increase the sensitivity, length of retention goes down. It’s a nice balance between form and function as well as retention, whether we use IP high-definition cameras or low-definition cameras. But that’s on its own internal server, on-site.
A lot of our continuous furnace trending software is continuously recorded -- that’s on its own separate dedicated server with off-site back-ups. Then we have all of our PLC data -- that could fill up a server in a matter of weeks if we really wanted it to. At times, we were recording every second; we don’t need to do that for most operations. Every minute, make the data accessible for a month and then, after that, we send it off to the Cloud.
For our ERP system and our quality management system, we utilize Bluestreak which is a web-based platform. We used to have on-site grid-based platform and that frees up a tremendous amount of space for the server so we can A. keep it 70% or less for capacity reasons. The only issue then, of course, is if we have a power outage, we lose internet -- but those are risks, at this point, that we’re willing to take.
DG: Heather, how about you? Data storage, generally speaking, what’s the situation?
HF: I think whether you’re deciding to store locally or in the Cloud, there are a couple things to consider: your digital rights management and your data loss prevention. If you’re working in-house, that means isolating assets on the land to make sure that, if there is an infection, it stops immediately. That’s one of the basic controls in, what is now, level 1. You have to have some of that in place so that if someone does get into your system, and we’re not talking a brute force attacker, we’re talking a person with the password of 1 2 3 4. We’re talking about the person that has not changed their password in 23 years and they’re still working on a DOS-based system. All those legacy systems that are not yet updated, that’s where the real risk comes from -- storing data locally. It’s really user behavior oriented that’s backed up by the solid digital rights management and data loss protection, as far as storing locally. One thing to be very careful about when moving to Cloud solutions, most commercially off the shelf available Cloud solutions are not compliant within the 800-171. If you’re talking about just Office 365, you have to move to the government version. Now we’re on zoom.gov instead of regular zoom, Doug, I don’t know.
DG: We are not, so be careful what you say.
HF: The problem with that is when you move to those Cloud solutions, they are inherently user prohibitive. They’re awful to work with, and they’re extremely expensive. You are kind of in a rock and a hard place: do we store locally and take on more risk and more in-house compliance cost or do we trust these big guys who have a billion-dollar backing them up who seems to know what he’s doing but also humans are humans and it’s still an inherent broken system? We all have to be careful and take our ownership of the programs that we’re putting in place -- that we have working knowledge where our data is going, how it’s being backed up, how it’s being stored or retained.
DG: Just a quick round-robin question, just kind of a yes or a no, and if you want to elaborate a little bit, feel free: Do you think, in today’s day and age, that it’s just as safe to store things in the Cloud as it is locally? Mike, what do you think?
ML: Yes. But you have to respect the requirements.
DG: Don, what do you think?
DM: Yes, for the most part. Like we said, the larger companies have teams of people working on this every day, so not only can they react, they can be more proactive in staying out in front of it than the rest of us can because they the resources. So, in theory, yes.
DG: Heather, what do you think? Just as safe to store in the Cloud as local?
HF: I believe that it has the potential to be more safe because you can rely on a group of resources that you don’t have to actively manage yourself. However, it takes a lot of oversight and research. It might be easier for a smaller company to create a very small locus of control as opposed to moving to a large collect Cloud solution during their migration to CMMC.
DG: Brian, how about you? Just as safe?
BF: I think the short answer is yes but, you know, it depends on which Cloud are we talking about and what does your internal infrastructure look like as well as what are your internal policies. Then it gets into more of a convenience discussion. How do you need that data? How frequent do you access it? But, I think, there’s the potential to be as safe or potentially more safe.
DG: I want to take a brief break and ask Heather a question. If you can just do a 30-second/60-second explanation of CMMC for us, and then we want to ask some questions about that. But I want to make sure that those who are listening who might not know what that is -- what is that? CMMC -- it’s important.
HF: It’s the Cybersecurity Maturity Model Certification. The government, in all of their perpetual wisdom, decided that they’re really tired of getting attacked by all the bad guys. To protect the state of the defense infrastructure and, I guess, maybe protect themselves because they have to do it too, they designed this system. Now, for today’s talk, I want to make sure that we understand that I’m personally going to be vacillating between CMMC 1.0 and CMMC 2.0. They are drastically different -- CMMC 2.0 is in rulemaking, but it’s got a lot of exciting, better things, potentially, in it versus CMMC 1.0. The point is, CMMC 1.0 is the law of the land and has been since 2019, so, it’s up to everyone who deals with the federal government to ensure that they are up to the minimum standard requirements for CMMC 1.0 which is just, basically, a self-assessment and some basic controls.
The government really wants to put in place the supply chain that is not full of holes for the enemy to take our most trusted and effective data.
DG: I’m curious, when it comes to CMMC then, implementation, best strategies for implementation, how do we find out about it more? Heather, I’ll stick with you on this one and then maybe we’ll move down to Mike and Don and then over to Brian.
CMMC -- what are some good strategies for implementing this?
HF: The first thing is to identify what you’re going to attack. If your whole company does not deal with CUI or FCI (control of unclassified information or federal contract information), then you don’t need to be talking about CMMC. The first step is to get your senior leadership team together and start with a block of information that’s manageable, either by location, by area, by contract, by project. Start at that top level and read the flow-downs to find out if you even have to do this, then decide a plan of action. I strongly recommend a phased integration approach over a period of about 18 months. If you’re trying to jam this into a 6-month process, it likely will be unsuccessful, strictly because that’s not enough time to even get the written policies and procedures in place. Plan for this to take about 18 months to 2 years and plan for it to cost you about $180,000; it’s about 60 grand a year. This is what the government, the Department of Defense says it will cost.
"The first thing is to identify what you’re going to attack. If your whole company does not deal with CUI or FCI (control of unclassified information or federal contract information), then you don’t need to be talking about CMMC. The first step is to get your senior leadership team together and start with a block of information that’s manageable, either by location, by area, by contract, by project. Start at that top level and read the flow-downs to find out if you even have to do this, then decide a plan of action." - Heather Falcone, Thermal-Vac Technology, Inc.
DG: Alright. You’re speaking from experience though, yes? You guys have done this?
HF: Absolutely, yes. It took us closer to 2 ½ years but, luckily, we started early enough to where that phased approach was okay.
DG: Mike, how about to you -- CMMC. Are some of your customers needing to do it? Are you guys needing to do it? What do you think?
ML: Nitrex is a solution provider so we are not only having commercial heat treatment, but we are also creating furnaces, we are building furnaces. We are also creating this control software and lately we released our QMULUS IIoT platform. We are really involved with this topic because we need to make sure that our customers are getting a solution which is CMMC compliant in the end. One thing which I really would like to mention here is that it does not only stop with the software. It’s not only software, it’s also controllers, it’s a hardware on the controllers, it’s even the network. Let’s say, a component on your controller which has to be CMMC compliant, in the end, which makes it really hard for small companies to take care of it. I suggest that you outsource a lot of these things. You can make your suppliers responsible for it, for sure. This would come with rising prices and so on, but for small heat treatment shops, it’s not maintainable, I guess. Maybe with the new approach of the CMMC release, which is relaxing a lot of things, it might be better, but we still do not know.
DG: Your suggestion is to outsource a lot of these, whether it be components or whatever.
ML: I would just like to add -- because we spend a lot of time to figure out what it really means (the CMMC things) and, as Heather already said, it will take you months to understand everything and if you’re not a professional in cybersecurity and maybe created these policies, you are lost.
DG: Don, how about you?
DM: I think I would echo a lot of what Mike is saying. As the whole industry goes more towards the IIoT implementing things, CMMC will be more and more difficult and you need help. Bottom line, unless you’ve got enough resources internally that can address the needs and understand, first off, as Heather mentioned, understanding the law (the regulations), in and of itself is usually enough to keep someone occupied for quite some time. But, even after that, then knowing what it means in implementing it, getting the right person on it, would certainly help the process.
DG: Brian?
BF: I think Heather really hit the nail on the head. The first step is to make sure it matches your strategic plan and your business plan. Currently, this is not a certification that Erie Steel possesses. It’s on our business plan as a threat under SWAT analysis but based on our current and forecasted customer base, this isn’t something that we plan on moving forward on here in the near future.
DG: Heather, you had mentioned about the control of unclassified information. Can you just expound on that a little bit? If I remember what you were saying, you were saying that it’s important to know whether you’re in that category, right? Because if you are, you need to do certain things; if you’re not, you don’t need to do certain things.
HF: Yes, if you handle CUI at your company or if you create CUI, then you’re likely going to be subject to the DFAR’s requirements when they’re flowed down to you. If you’re a federal contractor, it’s likely you don’t have a choice in this; it’s going to be in your contract flow-downs.
If you want to know more about control of unclassified information, there is an ongoing and everchanging list that’s available to you on the National Archives’ website which is archives.gov. If you go in there and you search controlled, unclassified information, it has a subsection list by industry. If all you do is firearms, cool, click on firearms and it’s going to tell you which CUI you have. If you only work defense, ok cool, here’s a nice little chart. It’s an invaluable resource on picking out key terms of your parts of your business to see if it matches up with the CUI.
But also, FCI, which is the Federal Contract Information, grand jury data is protected. Now, do we all deal with that? No. But financial transactions and general data information that you might not think is protected is protected. Spend some time in the National Archives -- it’s not boring, I promise, it’s actually pretty easy reading. It has nice charts and hyperlinks.
DG: It sounds boring, if I may just say so. Being the National Archives doesn’t sound like a place I want to spend my Friday afternoon.
HF: Well, call me, I’ll make it more exciting for you.
"Lately, we started with education because, we said it already multiple times in this discussion here, that the human factor is the most important part. We need to sensitize people about all the risks and all the things the internet brings. That’s why we started to have these security trainings, web-based and so on, which really help, also, to make people aware of these things."
DG: I want to deviate a little bit from the questions that we sent and maybe wrap up with two questions. We’ll deal with them individually but I’ll get you thinking about it just a little bit. Because we want to make this fairly practical for people, question one will be: Can you tell us what your company has done, thus far, to address cybersecurity? Again, it’s going to be a range of things; some have done a lot, some have done a little. Then, the second question I want to ask you which we will wrap up with is: If you could put on your prognostication hat here and you’re looking into the future -- what do you see being some of the major movements that we’re going to have to be dealing with as far as cybersecurity? It’s a little bit of fun looking into the future and seeing what we’re going to have to deal with in the heat treat industry.
Mike, if you don’t mind, we’ll start with you with Nitrex. What have you had to do so far to really deal with the whole cybersecurity threat?
ML: In the past, we started with the human factor. Until 6 years before, everyone had administrator rights on his local PC and everyone was installing everything -- malware, spyware and even things which were ‘unsuspicious.’ But a lot of things happen in the background without even noticing and these actions are opening doors for cybersecurity things. That’s why we installed something like MS LAPS which is a local admin password solution so that we can make really sure that people are only installing things which have been approved and so on. This was one of the things. Then, we also introduced something like MS Defender as an antivirus solution which is hosted in the Cloud which is making use of AI-identifying things before they get really serious. This for all internal IT infrastructure, making use of the latest approaches and software solutions we can get.
Lately, we started with education because, we said it already multiple times in this discussion here, that the human factor is the most important part. We need to sensitize people about all the risks and all the things the internet brings. That’s why we started to have these security trainings, web-based and so on, which really help
In terms of our solutions which we are offering, we planned accordingly a roadmap on how to make it CMMC compliant. All our hardware, we have to rework our whole controller infrastructure which we are offering to make our furnace CMMC compliant. The same for our MES software which we are having on premise for QMULUS, as well, which is our IIoT solution which is hosted in AWS. Here, it really depends on our customers if you’re hosting it in the Cloud or in the usual, let’s say, public Cloud. That’s what we are doing. We’re investigating our needs and to the needs of our industry.
DG: Good. And we will get to what do you plan on doing in the future, too.
Brian, why don’t we jump up to you on this. So far, what is Erie Steel been up to?
BF: As I stated during the risk assessment portion of management review, cybersecurity is regularly listed as a consistent internal and external threat. Historically, it’s been less relevant than it is today so little action was done. Now, over the past few years, we’ve really focused in this area and targeted internally on internal infrastructure. With that, we always try to keep a focus on understanding current environmental trends in cybersecurity, but with anything, any policy, any initiative, it should start and end with a strategic plan. Plans need to be well thought out, employee expectations clearly communicated prior to rollout, and feedback welcomed throughout these transitions.
Here, we practice self-audits and realize that server capacity as well as the life expectancy of our server was a great concern. We met with IT several times and came up with the plan to replace and upgrade our existing server and came up with it in four separate phases -- phase 1 being clean up the current system, phase 2 being change the system over, phase 3 being the new file structure for day-to-day operations, and phase 4 is to implement our new cybersecurity policy. Right now, we’re approaching the end of phase 3; so we’ll be sitting down again and reviewing the cybersecurity policy. Like I said, though, if you have doubts, self-audit, or you can always have a third-party auditor come in and share their two cents.
Some other things we’ve done are antivirus, antispyware software -- those should be givens. When individuals need to access the servers remotely, make use of VPN’s, utilize firewall security, ensure management has a firm understanding on the server capacity and requirements, regularly back-up the critical data, have redundant back-ups in different locations, of course make sure your Wi-Fi is secure, passwords should regularly change, same for all the usernames. You’ll see this with a lot of larger companies -- you really want to limit access to data and limit authority to make changes.
One thing we have done is our PLCs are operating locally on our own internal internet in case there is a server storm, in case there is a power outage. Well, a power outage wouldn’t help us in that situation but in case there is a server storm or internet outage, we can still operate locally, we just don’t have all the trending software to support it like day-to-day operations.
DG: That, just by itself, sounds like a huge task. Just switching over a server sounds like a lot of work. I think a lot of companies are going to be listening to this, especially some of the smaller captive heat treaters. Where to start? I think self-audit is a good idea and good advice.
Don let’s go to you then we’ll finish up this question with Heather then we'll move into thinking about the future.
DM: From our perspective, we’re focusing on the human factor. We’re trying to increase training and then once it’s out there, we test it. Once in a while, you’ll get forewarned that sometime within the next 24 hours you’re going to get a phishing email and what do you do with it? Sometimes they won’t tell us and all of a sudden, it’s, “Oo, what’s that?” I’m not going to click on that link. But honestly, those are the doors that are easier to close that we need to.
Some other activities have been like adding multifactor authentication where it’s necessary. Yes, it takes longer, yes, it’s a pain, but it’s necessary to make sure it is you and not somebody else. And then, as everybody else has mentioned, the usual firewalls, protecting Wi-Fi data networks, etc.
I did want to touch a little bit more on the equipment side, for just a minute. In my experiences with customers, sometimes an easier way to deal with this, especially because the interconnectivity to the equipment is becoming more and more prevalent, it’s just basically have a separate service, a separate internet connection that you control. And it’s basically if you need help, if you need to connect that piece of equipment to the internet, you physically plug it in, if not, you take it out. And when it’s out, you are in control. On your network, you’re passing data where you need to and that’s it. It’s back under that umbrella. Then, when you physically plug it in, you’re doing so making that decision consciously to say, “Okay, for this period of time, I need it to be connected.” But at least, then, you have some direct control. Is it rudimentary? Yes. Is it maybe not the most convenient? Yes. But, until you’re to the point where you can research all the needed data and regulations, they can get you to the point where, at least, you have some control.
DG: Right. Nothing like a physical line to plug in and unplug to help you feel safe.
Heather, how about you? What has Thermal Technology been doing?
HF: We started with an assessment that we paid people to do -- an expert that came in and evaluated our system against the CMMC requirements. That was very scary and expensive and it felt like someone was speaking Greek to me and, frankly, I got bored within the first 30 minutes of him giving me the report. But that’s where you start. And don’t be afraid if you get a negative score on the darn test because you’ve got to pick a place and you’ve got to get the baseline.
The nice thing about CMMC is it’s progressive; it’s meant to be transitional. You’re not going straight to level 3 and your whole life is going to change. You go from that assessment and then you work your way into phase 1. The CMMC level 1 is meaning we’re doing this stuff; we just can’t repeat it and we don’t have any documentation. And then level 2 -- okay, now we’re doing stuff and now we’re going to make it repeatable by documenting it. Then phase 3 is now we’re going to make machines manage the processes that are documented so we can repeat them and do them. It builds upon itself. So, embrace the stages. That’s what we’ve done and we started all the way back when we were a .79.
DG: Out of what?
HF: Out of the level 1 – 3. We were .79. Now, I’ve seen people who are minus numbers (-2, etc.) and that’s okay. Everyone starts somewhere, and if you haven’t had to look at infrastructure as related to information technology in 20 years, then why would you have ever looked at it? Take it in the phased approach. That’s what we did and we baby-stepped our way in and took all the painful points and broke them down into 1,000 substeps and that was the best thing we could have done.
DG: We’re going to go backwards in order, if I can, and let’s talk about the future. I guess, what I want to get a sense from you guys, to wrap up, is 1.What do you see as being the greatest risks to your companies, and, I think, especially with our equipment guys with Nitrex and with Mike and Don, if you’re able to address from your customer’s perspective, 2.What are the issues with new equipment going in? What are the biggest risks that you’re seeing, if there are any, and what do you see us doing in the future differently than what we’re doing now as far as mitigating any of those risks?
Heather, back to you on this one?
HF: The biggest risk is complacency or denial. This will come to you and it already has. If you take the viewpoint of, “Well, I’ll do it when my customer makes me,” you will be so far behind the ball, it’s going to be painful. The absolute worst risk you could possibly take is not looking at it or denying that you’re involved in it. If you’re in heat treating, it is 90% likely that this is going to apply to you in some way. Now, the great news is CMMC 2.0 -- over 60% of the industrial supply base is only going have to be a level 1 -- that’s a self-report annually. That’s not that big a deal. Anybody can do that. And there are great resources that are being developed to help people that want to get that basic level of CMMC compliance.
So, don’t wait, don’t deny it, get your customers to pay for it, put it in your RFPs. It is an allowable cost for reimbursement; don’t let anyone tell you otherwise. If you need more help on that, let me know.
"On the note of chaos, when it sets in, communication is key. If you’re the responsible party, designate primary and secondary points of contact for cybersecurity support. Have performance incentives in place for the responsible managers. If you’re rolling out a new policy, based on the successful rollout of that policy, put some incentives in place. Maintain open lines of communication and welcome feedback."
DG: That’s one of the questions we didn’t get to and that was how to make your customers pay for it which sounds like a very intriguing question, but yes, you mentioned it there.
Don, how about you? We’ll go over to you on this one.
DM: I think, moving forward, a couple of things are happening: The labor market is changing; it’s changing to a demographic that’s more familiar with this technology, which is a good thing. Although, as we said, I think it was Brian that said earlier on, some of those generations may not be as sensitive as they need to be. But what that means is that the older days when we relied heavily on operators to know what’s going on, now we’re switching more towards the technology managing the equipment from the equipment’s point of view. What that means is there will be fewer people managing more equipment from fewer places. So, if you’re looking at a multilocation operation that’s managing data from a central location, that becomes pretty complex pretty quick; but it’s becoming more commonplace in the industry than it used to be. Obviously, that opens up a lot of doors for cybersecurity risk and that’s got to be carefully managed, in the light of CMMC and others as far as cybersecurity goes.
I think the future is -- the technology is there, it’s available, but it has to be implemented carefully and it has to be well thought out by people who know what they’re doing.
DG: Brian, I think we go to you and then we end with Mike.
BF: When chaos sets in, the one standing by your side, without flinching, can be considered your family. When chaos sets in manufacturing, managers must remain flexible, patient and understanding which leads to the difference between a leader and a manager. A good manager is not always a leader, and good leaders are always managers. Managers have people work for them while leaders have people follow them. On the note of chaos, when it sets in, communication is key. If you’re the responsible party, designate primary and secondary points of contact for cybersecurity support. Have performance incentives in place for the responsible managers. If you’re rolling out a new policy, based on the successful rollout of that policy, put some incentives in place. Maintain open lines of communication and welcome feedback. Make sure that training materials are available. Something that I’ve come to realize is that employees often shy away from asking for help. Instead, try to get the help at their fingertips and ask specific, strategic questions to prove they’re understanding.
Really, at the end of the day, conduct your risk assessments. You don’t know what you don’t know, and that’s 95% of what is knowledge today. Be cognizant of what’s out there. Let’s face it -- cyberwarfare, cyberterrorism are very real, very selective, quick and cheap attacks from the hacker’s perspective, and they remain anonymous.
DG: And devastating for the companies that are on the receiving end, potentially.
BF: On the microscale, it’s real, especially for small businesses.
DG: You’ve hit on an interesting thing, Brian, and obviously we can’t spend time talking about everything but, it’s just the way you address this from a personnel perspective inside your company -- are you having someone there that’s the point person for cybersecurity? This shows my ignorance, but that’s okay, it’s easy to do. Do they have a chief security officer, a CSO, now, I assume, adding to the ‘C-suite’?
But yes, I think that’s a good point.
Let’s go over to Mike. What do you see as being the future threats and how are we going to be mitigating them?
ML: I think there is not that much to add here. We talked about the human factor, as I said, is the most important thing. Education and also more of education is needed here. Also, with the people on the shop floor, they are often working still with pen and paper -- they are not really used to going with the digital mediums and components and so on. So, really, we have to be sensible there, as well. You mentioned that the management has to take care that they are not "steamrolled" by all these approaches. This is really important.
The other thing, I already mentioned as well, is to outsource as much as possible, if it’s possible. Talking about the hardware, the software components and solutions and so on -- if you can get a solution which is CMMC compliant and the vendor is stating it, get it, because it’s taking a lot of work from you.
DG: The last thing we’ll do, and you may or may not have anything for this -- any final thought you want to leave with the people that might be listening to this, watching this? These are basically going to be people who are manufacturers who have their own in-house heat treat shops, commercial heat treaters, suppliers to the industry. Are there any last comments that you want to leave?
Don, anything?
DM: The only thing I’d add is just to be proactive. That always helps in these cases. And what that means is up to you but be proactive to address it.
DG: I was thinking the same thing: Don’t stick your head in the sand. Or, if it is there, get it out. Get it out of wherever it is and pay attention. Be proactive.
Heather, how about you?
HF: That’s exactly right. And some of us have larger egos that prevent us from reaching out for help. Understand that the literal federal government wants to help you, and there are so many resources out there that can be a nightmare to navigate but start with the people on this call. Reach out, talk to someone, get outside your circle and start figuring out how to make it work for you.
DG: Mike, how about you and then we’ll end with Brian, if you have any other comments. Again, if you don’t, no problem.
ML: That statement of Heather’s, I think, of being proactive, ask for help, don’t be shy. Invest the money. It will be worth it to invest.
DG: Brian, how about you?
BF: I think, find what works best for your organization and remain flexible. Solutions to cybersecurity should not be a one size fits all approach, so plan for the worst and strive for the best.
DG: Guys, thanks very much. I appreciate it. This is a huge, huge topic. I know we’ve just skimmed across the top.
Welcome to Heat TreatToday's This Week in Heat TreatSocial Media. You know and we know: there is too much content available on the web, and it’s next to impossible to sift through all of the articles and posts that flood our inboxes and notifications on a daily basis. So, Heat TreatToday is here to bring you a hot take of the latest compelling, inspiring, and entertaining heat treat chatter from the world of social media.
This week we'll check out some heat treating topics that are close to home (maybe even in your kitchen!) as well as learn about a metal that's a national security concern.
You may have used a knife to cut your steak last night, but what's the story behind that crisp, clean edge? Check out this video to learn the basics of heat treating knives.
2. Kudos to Past 40 Under 40 Winners!
Mastering the Subject
Alberto Ramirez, Contour Hardening, was excited to share a big milestone: a master's in Information Technology Management. We're proud to have him in the 40 Under 40 Class of 2021.
This month, social media was a-buzz with news from Family Business Magazine. Heather Falcone, CEO of Thermal-Vac Technology, was named as one of the "Transformational Women." This 2019 40 Under 40 winner sure has a knack for collecting awards.
Speaking Candidly
Mark Rhoa, vice president at Chiz Bros, delivered a talk on thermal performance in furnaces with refractory and insulation products at the ASM 2021 heat treat show.
3. A Triad of Trending Topics
Precious metals in your pocket, an exciting future in heat treating careers, and a new VOQ in Western PA? It's going to be a good weekend.
What's Going On in Your Phone?
Jobs, Jobs, Jobs
.VOQ Maiden Voyage Coming Soon
4. The Reading Corner
Doing a little personal development this weekend? Why not increase your heat treating knowledge by perusing these articles?
Integrity. . .the Mechanical Kind
Graphene, the Wonder Material That Became a National Security Concern
Heat Treat Today is privileged to oversee the 40 Under 40 recognition awards highlighting a group of young, up-and-coming talent in the North American heat treat industry every year. This year’s Class of 2019 is no disappointment–a group of industry elite, significant contributors to the heat treat market.
Every couple of weeks we highlight two of the current class of recipients. This week we introduce Heather Falcone of Thermal Vac Technology Inc. and Trisha Rouse of General Motors.
Name: Heather Falcone
Company: Thermal Vac Technology Inc.
Position: CEO
Heather’s passion lies in breaking things: whether it’s revenue goals, glass ceilings, or tired rhetoric, her 17-year track record in one of the world’s most exacting industries shows a dedication to destroying the status quo. As CEO of Thermal-Vac Technology, she has led the company to a 65% growth rate in the past four years, resulting in the company being recognized in several awards. She is a recognized trainer, writer, and public speaker on a variety of topics and her professional associations include: voting member of NADCAP heat treat task group, professional member of MTI, and participant in other professional societies and peer advisory groups. Her impact at Thermal-Vac is demonstrated in the implementation of several projects, such as a fully compliant NIST 800-171 and DFAR 252.204-7012 cyber security program and a foundational business management system called EOS, as well as the implementation and successful accreditation to AS 9100:D and ISO 9001:2015. As an Ironman triathlete, alpine hiker, wife, and mother, Heather seeks to promote growth and opportunity outside of people’s comfort zones with an invitation to be “Green and Growing”, to reject mediocrity, and embrace their unique talents to create meaningful and lasting legacy impact.
Nominated by: Thermal Vac Technology
Name: Trisha Rouse
Company: General Motors
Position: Senior Materials Engineer
Trisha Rouse is a brilliant materials engineer. Holding a position of Senior Materials Engineer at GM, she is currently supporting the Transmission Gear and Shaft Program Management Team of GM, providing metallurgical expertise for new product development as well as supporting the resolution of production and customer concerns. Her experience in the industry is unique as she has background in not only design but also running metallurgical labs, working with customers, and overseeing production deadlines. Trisha has a great personality and is alumna of Michigan Technological University’s Material Science and Engineering program.
Nominated by: Dr. Valery Rudnev, FASM, IFHTSE Fellow, “Professor Induction”; Director, Science and Technology, Inductoheat, Inc, an Inductotherm Group Company
Read more about the feature atHeat TreatToday’s40 Under 40 resource page and find out more about each of this year’s winners by clicking on their image. To nominate someone for the Class of 2020 40 Under 40, please click here.
A Dozen Quick Heat TreatNewsItems to Keep You Current
Heat TreatTodayoffers News Chatter, a feature highlighting representative moves, transactions, and kudos from around the industry.
Personnel and Company Chatter
Recent changes in leadership at Nucor Corporation include the following: Retired U.S. Army Lieutenant General Nadja Y. West has been elected to join the board of directors, effective immediately. General West retired earlier this year after 37 years with the U.S. Army. In addition, John J. Ferriola will retire as chairman and CEO on December 31, 2019; the board of directors elected Leon J. Topalian to be president and COO, effective September 5, 2019, and to succeed Mr. Ferriola as CEO on January 1, 2020.
StandardAero has acquired Safe Aviation Solutions (including Safe Fuel, Accel, and B&E ACR), formerly the MRO services subsidiary of the B&E Group, which will continue to expand StandardAero’s Components, Helicopters & Accessories (CH&A) division and its portfolio of MRO and component repair services.
Dana Incorporated announced the acquisition of Nordresa Motors, Inc., a prominent integration and application engineering expert for the development and commercialization of electric powertrains for commercial vehicles.
Central Machine & Tool, a manufacturer and global distributor of quick connect/disconnect couplings, castings, clamps and bandings and provider of heat treating, fabrication, machining, and injection molding services, will now be known as PT World Headquarters. The launch of the new branding and signage included employees, staff, and guests. Matt Parrish, president, and Amy Parrish, vice-president of corporate communications, spoke about the new branding and the direction of the Enid, Oklahoma, company.
Allison Transmission Holdings Inc., a global manufacturer of medium- and heavy-duty fully automatic transmissions, announced that it has acquired the assets and certain liabilities of Walker Die Casting located in Lewisburg, Tennessee, and C&R Tool and Engineering located in Muscle Shoals, Alabama. Walker produces aluminum castings and has been a supplier to Allison for 20 years. Allison is committed to continuing the 60-year-old company’s legacy. C&R Tool and Engineering is a leading supplier of metalworking tools for use at Walker and other companies.
Constellium N.V., Amsterdam, announces that it will be the primary supplier of aluminum auto body sheet for the new Mercedes-Benz CLS model, which entered the market in March 2018.
John J. Ferriola, retiring CEO and chairman, Nucor Corporation
Equipment Chatter
A company operating in the nuclear sector recently purchased an advanced heat treatment vacuum furnace with a maximum temperature of 2408°F (1320°C) from TAV Vacuum Furnaces Spa.
A prominent aerospace equipment manufacturer is working with SECO/VACUUM Technologies (SVT) to bring the company’s low pressure carburizing and hardening work in-house. SVT will be supplying a CaseMaster Evolution® (CMe) dual-chamber vacuum oil quench furnace.
An electrically heated heavy-duty Ferris wheel batch oven has been shipped to a company in the aerospace industry by Wisconsin Oven Corporation. This Ferris wheel oven will be used to cure epoxy resins & varnishes on assorted aerospace parts. In addition, Wisconsin Oven shipped a natural gas-fired conveyor oven to the automation industry, which will be used to cure a resin formed mat.
Primetals Technologies will build a combined aluminum hot rolling mill for the production of heavy plate and strip for BaoWu Aluminium Technology Ltd., which is part of BaoWu Iron and Steel Group Co., Ltd, the highest-profile steel producer in China. The new rolling mill will be built in Sanmenxia, in the Henan province, and have an annual production capacity of 300,000 metric tons.
Kudos Chatter
Onex, Inc., recently received a plant visit from Pennsylvania State Representative Lee James. Talks surrounded the need for skilled labor in manufacturing and the valuable careers available at Onex and in the industry.
Thermal-Vac Technology is proud to be included on Inc. magazine’s prestigious Inc. 5000 list for 2019. Inc. 5000 lists the fastest-growing private companies in the United States. Thermal-Vac has grown 64 percent in the last three years. “We are excited to have our team’s hard work recognized by Inc. magazine,” CEO Heather Falcone said. “As a service business, we only grow by delivering what we promise. I think everyone at Thermal-Vac can be proud of what we’ve built.”
Heat TreatTodayis pleased to join in the announcements of growth and achievement throughout the industry by highlighting them here on our News Chatter page. Please send any information you feel may be of interest to manufacturers with in-house heat treat departments especially in the aerospace, automotive, medical, and energy sectors to the editor at editor@heattreattoday.com
The aerospace team at a heat treating company based in Orange, California, is partnering with NASA to launch manned missions to deep space.
Senator Ted Cruz (R- TX), Chair, Senate Space Subcommittee with Thermal-Vac Administrative Director Heather Falcone after he spoke to suppliers about the commitment to fund deep space exploration in years to come through bipartisan legislation.
Thermal-Vac Technology, which provides brazing, heat treating, and finishing services at its southern California facility, is working with NASA’s exclusive exploration-class space systems: NASA’s Space Launch System (SLS) rocket, Orion spacecraft and the Exploration Ground Systems that launch these vehicles. Thermal-Vac’s aerospace division joins with NASA and aerospace leaders “to return Americans to the Moon and send astronauts to Mars in the early 2030s.”
“Our team is honored to be part of the American efforts to continue being leaders in space exploration,” said Steve Driscol, CEO of Thermal-Vac. “It is a vital part our humanity that we invest in and support these projects to ensure their success now and for years into the future.”
With suppliers in all 50 states, NASA’s journey to deep space is a national effort. 2019 marks the final integration and testing of the rocket and spacecraft leading up to the first integrated launch to the Moon late next year. Aerospace companies across the country are helping to meet NASA’s visionary plan and contribute to America’s unmatched legacy in space.
Photo credit / caption: Thermal-Vac Technology / Eight astronauts from multiple missions to the moon and ISS pose with Congresswoman Kendra Horn (D-OK), Chair, House Space Subcommittee during a reception for SLS-Orion suppliers.
What does cybersecurity look like in a heat treat shop? In this episode, Doug Glenn, publisher of 
