A controlled drawing just landed in your inbox: handling CUI from a prime from receipt to delete

The email that changes your scope

It usually shows up without much ceremony. A buyer at a prime sends over a drawing package for a quote, or an engineer forwards a revised spec for a part you already make. Somewhere on the PDF there is a banner that says CUI, or a distribution statement, or an export control notice.

At that moment, the file is sitting in someone's inbox, probably on a laptop, possibly synced to a phone. Within an hour it may be in a shared folder, printed at the shop printer, loaded into CAM software, and forwarded to an outside shop for a quote on the plating.

Every one of those places is now holding Controlled Unclassified Information, and every one of them is part of what you have to protect.

This post walks through the life of a controlled drawing inside a typical small or midsize shop, from the moment it arrives to the moment it should be gone. It is not legal advice, and your contract language is what actually governs your obligations. But it should help you see where the information goes and where the gaps tend to be.

First, know what you are looking at

Controlled Unclassified Information is government information that requires safeguarding but is not classified. The federal rules for it are in 32 CFR Part 2002, and the categories are listed in the CUI Registry maintained by the National Archives. For DoD suppliers, contract clauses such as DFARS 252.204-7012 are what typically connect that information to the security requirements in NIST SP 800-171.

A few practical points matter on the shop floor:

• Markings are the first clue, not the only one. CUI should be marked by whoever created or designated it, usually with a banner at the top of the document. Older drawings may carry legacy markings like FOUO, or a distribution statement instead.
• You do not decide what is CUI. The government and the prime designate it. If something looks controlled and is not marked clearly, ask your customer rather than guessing.
• Not every manufacturer handles CUI. Plenty of shops make commercial parts and never touch it. This post is for companies in the defense supply chain that do, or that are about to.

Step 1: Receipt

Most CUI arrives by email, sometimes through a customer portal or file transfer site. Three questions matter:

• Where is it supposed to arrive? Ideally there is one known path, such as a specific mailbox or portal, inside the environment you have set up to handle CUI.
• Who receives it? Buyers, estimators, and engineers are usually the first to touch these files. They need to know what a CUI marking looks like and what to do when they see one.
• What happens when it arrives in the wrong place? Someone will eventually get a controlled drawing in a personal email or a general inbox. Have a short, written answer for that, including who to tell.

A good test: ask your estimator what they would do if a drawing marked CUI showed up right now. If the answer is a shrug, receipt is your first gap.

Step 2: Where it lives

Once the file is in the building, it needs a home. This is where most companies find out how many copies exist.

Think about every place a drawing package can land:

• Email inboxes and the laptops and phones that sync them
• The shared drive or cloud folder where jobs are kept
• The ERP or quality system, attached to a part number or job
• Engineering and CAM workstations
• Printers that store recent jobs

The goal is a defined boundary: the set of systems, people, and locations that are allowed to hold CUI. Everything inside the boundary has to meet the NIST 800-171 requirements. Everything outside it should not be holding CUI at all.

A smaller boundary is usually easier to secure and easier to prove. That is often the most important design decision a DoD supplier makes. Our CMMC Level 2 guide and our page on the NIST frameworks go deeper on scoping.

Step 3: Who can see it

Access should follow the job, not the org chart. In practice that means:

• Named accounts, not shared logins on shop floor machines that touch CUI
• Multifactor authentication on email and remote access
• Folder permissions set by role, reviewed when people change jobs or leave
• A clear rule on personal devices, because a drawing synced to a personal phone has left your boundary

Access reviews are easy to skip. They are also one of the places where evidence matters, since an assessor will want to see that reviews actually happen, not just that a policy says they should.

Step 4: Sharing it outside

This is the step that catches a lot of shops. Manufacturing is collaborative. You send work to platers, heat treaters, coaters, and machining partners. If the drawing you send them is CUI, the information is now leaving your boundary.

Before you forward a controlled drawing to a subcontractor:

• Check your contract. DoD clauses often require you to flow requirements down to subcontractors who will handle covered information.
• Send only what they need. A heat treater may not need the full model. Sometimes a stripped down sheet or a spec without the controlled detail does the job, if your customer allows it.
• Use a controlled, logged method to send it to a named person, not a regular attachment to a shared inbox, and keep a record of who got what.

Our earlier post on vendor and app access covers the other direction: outside parties who can reach into your systems.

Step 5: Printing, the shop floor, and the machines

Drawings end up on paper and on machines. That is fine, but they count.

• Printed copies should be kept in a controlled area and collected when the job is done, not left on a bench or in the recycling bin.
• Printers and copiers can store images of recent jobs. Know which ones handle CUI and how their storage is cleared.
• Machine controllers and CAM stations that hold programs or models built from controlled drawings may be inside your boundary. Legacy shop floor PCs are a common problem here, and they need to be accounted for in your plan, even if they cannot be upgraded.

Step 6: Retention and destruction

The federal CUI rule says destruction should make the information unreadable, indecipherable, and irrecoverable, and it points to NIST guidance, including NIST SP 800-88 for media sanitization, when no other method is required. Your contract may also set retention requirements, so check before you delete anything.

A workable approach for most shops:

• Decide how long job files are kept, based on your contracts and quality requirements
• Delete old revisions and lost bids from inboxes, desktops, and download folders, not just the main job folder
• Shred paper copies
• Sanitize or destroy drives from retired laptops, workstations, and printers that held CUI, and keep a record of it

A retired laptop in a closet that once held controlled drawings is still holding them.

Step 7: Proving it happens

Everything above is only half the job. The other half is evidence: showing that the process is followed, consistently, over time.

That looks like training records, access review notes, transfer logs, destruction records, and a System Security Plan that describes how your environment actually works. You cannot create months of that history the week before an assessment. It has to build up from normal operation.

If you posted a score in SPRS, it should reflect how you really handle information like this. Our post on what your SPRS score represents explains why that matters.

Where to start this week

You do not need to solve all of this at once. Pick one recent controlled drawing and trace it. Where did it arrive? How many copies exist now? Who has seen it? Did it go to a subcontractor? Is any of it on a device that is not supposed to have it?

That one exercise will tell you more about your real CUI boundary than any policy document. Then work through our compliance checklist to see where you stand against the rest of the requirements, and read how we support manufacturers dealing with customer security requirements. If you would rather walk through it with someone, book a time with us.

The drawing is going to keep showing up. The goal is to know exactly where it goes when it does.