CUI for the Shop Floor: What It Is, Where It Hides, and Why 'We Only Make Brackets' Is Not a Defense

The drawings arrive by email, like everything else

The owner of a 30-person machine shop in Ohio has held a sub-tier contract with a defense prime for six years. Brackets, housings, a few precision spacers. The drawings come from the prime's buyer as PDF attachments. The office manager saves them to the shared Dropbox, the same one that holds the quoting spreadsheets, the Christmas party photos and the owner's daughter's college essay.

The shop supervisor prints each drawing and clips it to the traveler. Copies live on the bench, in the inspection room, on the clipboard by the CMM. When the job closes, the prints go into a banker's box in the mezzanine. The Dropbox copy stays forever, synced to eleven laptops, two of which belong to people who left in 2024.

In August the prime's supplier-quality manager sends a flow-down letter with a new line: confirm that all controlled unclassified information is stored and handled in accordance with NIST SP 800-171, and report your current SPRS score by 30 September. The owner reads it twice and calls the buyer. "We only make brackets," he says. The buyer is kind about it. The drawings have a distribution statement on the title block, she explains, and that makes them CUI whether the part is a bracket or a guidance fin.

The owner walks out to the floor and looks at the clipboard by the CMM. Three drawings, one banner marking each, in plain view of the vending-machine delivery driver.

What this means in plain words

Controlled unclassified information, CUI, is government information that is not classified but still requires protection by law or policy. Technical drawings, specifications, test data and some contract documents are the common forms in a machine shop.

Federal contract information, FCI, is the broader category: any information the government gives you or you create for it under contract that is not meant for public release. All CUI is FCI. Not all FCI is CUI.

A CUI marking is the banner, the distribution statement or the export-control notice on a document. It is the government's way of telling you which papers on your bench carry an obligation.

NIST SP 800-171 is the list of 110 security requirements for protecting CUI on a contractor's systems. CMMC is the Department of Defense program that checks that you actually meet them.

SPRS is the government database where you post your self-assessment score. The Department of Defense paused the Phase 2 certification mandate in July 2026. The NIST SP 800-171 obligations in your contract did not pause with it, and neither did the affirmation you sign. A pause is not a pardon.

The numbers that matter

The CMMC acquisition rule in 48 CFR took effect on 10 November 2025, and Phase 1 requires contractors to post a self-assessment score in SPRS and affirm it annually to remain eligible for award (US Department of Defense, 2025). The flow-down letter is that rule reaching the shop floor.

The Department of Defense estimated a Level 2 certification at more than USD 100,000 for a small contractor, with the third-party assessment alone at about USD 76,743 (DoD CMMC rule cost analysis, 2024). Paying that to fail is the outcome a truthful inventory prevents.

Sixty-two percent of breaches involved a human element (Verizon 2026 DBIR). In a machine shop that is the drawing forwarded to a personal email so it can be opened at home, not a hacker in a hoodie.

What to do this week

1. Find every marked document. Search the shared drive, the email accounts of everyone who talks to the prime, the quoting folder and the mezzanine boxes for distribution statements, export-control notices and CUI banners. Write down where each one lives and who can open it. (CIS 3 Data Protection)
2. Draw the line between the shop and the CUI. Decide which people need to see drawings: the owner, the estimator, the supervisor, the inspector. Everyone else loses access to that folder this week. (CIS 6 Access Control Management)
3. Move the drawings out of the general Dropbox into a separate, encrypted location that only those people can reach, and remove the synced copies from the laptops of people who have left. A small enclave for four people is a smaller problem than a whole company brought up to standard. (CIS 3 Data Protection)
4. Inventory the software that touches CUI: the CAD viewer, the CAM package, the email client, the cloud storage, the phone app the supervisor uses to photograph prints. If it is not on the list, it does not get a drawing. (CIS 2 Inventory and Control of Software Assets)
5. Fix the paper. Prints stay with the traveler and go back to a locked cabinet at shift end. The banker's boxes get a lock and a log. The clipboard by the CMM faces the wall. (CIS 3 Data Protection)
6. Score yourself truthfully against the 110 requirements before you post to SPRS. A truthful 70 with a plan is defensible. A 110 you cannot support is a signed statement to the government that is not true. (CIS 6 Access Control Management)

Where AccuSights fits

Our assessment starts on the floor, finding every marked drawing and every place it has been copied, then scores you against NIST SP 800-171 the way an assessor will, so you know your real number before you affirm it. The Cyber Hygiene Test takes three minutes. A 15-minute call with an engineer will tell you whether a small enclave for the four people who touch drawings is the right answer, and what it costs. Our team implements these controls at a reasonable rate, from data loss prevention to scanning to protection of the machines that hold CUI, and Protect keeps an engineer and an AI watching 24/7. No CMMC, no contract. Readiness first, so you never pay to fail.

Questions people ask

Is an engineering drawing CUI? Often, yes. A drawing that carries a distribution statement, an export-control marking or a CUI banner from the prime or the government is CUI, and so is the file it lives in and the print on the bench. A drawing you made yourself for a commercial customer is not. If the part is going into a defense system and the drawing came down the contract chain, treat it as CUI until someone with authority tells you in writing that it is not.

Who decides if information is CUI? The government agency that owns the information decides, and it marks the document accordingly. The prime passes the marking down with the drawing and the contract clause. You do not get to decide that a marked document is harmless because your part of it is small. What you do decide is where that document is allowed to live inside your shop, and who may open it.

Can CUI be stored in regular Microsoft 365? The commercial version is not designed for it. CUI belongs in an environment that meets the NIST SP 800-171 controls, which in practice means the government cloud editions or a purpose-built enclave that keeps CUI separate from the family photos and the quoting spreadsheets. Many small shops find that a small enclave for the handful of people who touch drawings is far cheaper than bringing the whole company up to standard.

The bracket is small. The drawing that describes it is not. Protect the drawing the way you would protect the part it becomes, and the contract stays yours.