Where CUI hides on a machine shop floor

CUI moves with the job

A machine shop owner usually pictures controlled information as a document in a locked office. In practice it moves with the job. A customer drawing arrives by email, gets saved to a shared drive, becomes a CAM program, rides a USB stick to the control, and comes back as an inspection report. Each stop along that path may be part of what you have to protect.

This matters for a plain reason. In December 2025, the Justice Department announced that an Illinois precision machining company had agreed to pay $421,234 to resolve allegations that it failed to provide adequate cybersecurity for certain drawings of parts it made for DoD prime contractors. The case was brought by a former quality-control manager. As the release states, the claims are allegations only, and there has been no determination of liability.

What counts as controlled technical information

DFARS 252.204-7012 defines controlled technical information as technical information with military or space application that is subject to controls on its access, use, reproduction, modification, performance, display, release, disclosure or dissemination. The definition says such information would meet the criteria, if disseminated, for distribution statements B through F under DoD Instruction 5230.24.

The clause's list of technical information is broad and reads like a shop inventory: "research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code." Covered defense information also includes information collected, developed, received, transmitted, used or stored in support of the contract, so what you create from the customer's data can carry the same protection.

Start with the distribution statement

The first place to look is the drawing itself. A distribution statement B through F is a clear signal that you are holding controlled technical information. Train the people who receive drawings to look for it, and to record the contract or purchase order it came under.

The absence of a statement does not settle the question. The clause's definition reaches information identified in the contract as well as marked material, so read the purchase order, the quality clauses and the flowdowns too. If a drawing is unmarked and you cannot tell, ask your customer in writing and keep the answer.

Follow one job through the shop

The fastest way to find CUI is to pick one real defense job and walk it from quote to shipment. Sit down with the person at each step and ask where the file came from, where it went and who else could open it. Here are the usual stops.

Where it sits	Why it counts	What usually goes wrong
Email and quoting	RFQ packages often arrive with the drawings attached	Copies live forever in mailboxes on ordinary commercial accounts
Shared drives	Job folders hold the master copies	Everyone in the company can read every job
CAD and CAM workstations	Models and toolpaths are derived from the controlled drawing	Local copies outlive the job, and vendor support connects remotely
CNC controls	Programs can be computer software built from the part geometry	Programs stay in control memory after the job ends
Removable media	USB sticks carry programs to older controls	Sticks have no owner, no encryption and no log
Travelers and paper	Process sheets and prints ride with the part	Prints sit at the machine, in plain view of visitors and vendors
CMM and inspection	Inspection programs and reports reflect the part definition	The CMM computer is forgotten, unpatched and connected to the network
Outside processes	Heat treat, plating and grinding vendors get prints	Full drawings go out when a partial view would do

Treat each row as a question to answer about your own shop, then draw the answers on one page. That page becomes the starting point for your boundary, your asset inventory and your system security plan.

The USB stick deserves its own conversation

In a shop with older controls, a USB stick or similar media may be the only way to get a program to the machine, and NIST SP 800-171 speaks to it directly. Requirement 3.8.7 says to control the use of removable media on system components. Requirement 3.8.8 prohibits portable storage devices that have no identifiable owner. Requirement 3.8.1 calls for physically controlling and securely storing media containing CUI, and 3.8.3 for sanitizing or destroying media before disposal or reuse.

A workable shop rule is simple. Issue a small number of numbered, owned devices. Keep them in a controlled location. Use them only between one transfer station and the machine, record who has them, and wipe them on a schedule. Better still, replace the walking stick with a wired transfer through a dedicated station on a separated network.

The cheapest asset to secure is the one CUI never reaches.

How CMMC treats your machines

Here is the piece of good news that shop owners often miss. The CMMC rule at 32 CFR 170.4 lists Specialized Assets as government furnished equipment, Internet of Things or Industrial Internet of Things devices, operational technology, restricted information systems and test equipment. Operational technology is defined as programmable systems or devices that interact with the physical environment. A CNC control and a coordinate measuring machine fit that way of thinking well, and you should classify your own equipment by those definitions.

Specialized Assets at Level 2 are treated differently from ordinary computers. Under Table 3 of 32 CFR 170.19, you must list them in the asset inventory, describe how they are treated in the system security plan, show they are managed using your risk-based security policies, procedures and practices, and include them in the network diagram. The assessment requirement is to review the plan, and the rule says "Do not assess against other CMMC security requirements."

Read the category closely. It covers assets that "can process, store, or transmit CUI but are unable to be fully secured." A standard desktop that happens to sit near the machines does not become a Specialized Asset by location, and a control you could secure with a reasonable change is a harder case to argue.

That treatment is not a waiver of the rest of your shop. The workstation that prepares the program, the file server that stores it and the laptop that opens the drawing are ordinary computers, and they are CUI Assets if they handle CUI. Also, the rule defines an enduring exception, naming test equipment and operational technology as examples, as a circumstance where full compliance is not feasible and which must be documented in the plan.

Terminals that should never hold CUI

The rule has a useful category for the computer that could hold controlled files but is not supposed to. Contractor Risk Managed Assets are assets that can, but are not intended to, process, store or transmit CUI because of your security policies, procedures and practices, and they do not have to be physically or logically separated from CUI Assets. A shop-floor time-clock terminal may fit. It still has to appear in the inventory, the plan and the diagram, and an assessor can run a limited check if your documentation raises questions.

Check your business software while you are at it. A job-costing or quality system that stores drawings or travelers belongs in the data flow, and if it is a cloud service holding CUI, it must meet the FedRAMP requirements in DFARS 252.204-7012.

The simplest way to keep the boundary small

The cheapest asset to secure is the one CUI never reaches. In most shops the goal is a small protected area where controlled files live, with narrow, documented paths out to the machines.

• One intake point for controlled files, such as a dedicated mailbox or portal account, so drawings stop landing in everyone's email
• One protected file store, with access limited to the people who work defense jobs
• A separate network segment for the machines, with no general internet access and a single controlled transfer path
• A small number of CAD and CAM seats inside the boundary, in place of every workstation in the building
• Print control: numbered prints issued per job and collected and shredded when the job closes
• Send vendors the minimum: the features they need to process, in place of the full drawing

Do not forget the physical side

A shop floor is a physical boundary as much as a network one. Requirement 3.10.1 limits physical access to systems and equipment to authorized people. Requirements 3.10.3, 3.10.4 and 3.10.5 cover escorting visitors, physical access logs and managing physical access, and all three are on the list of items that may not be left on a plan of action for a Conditional status. Requirement 3.8.1 covers media containing CUI "both paper and digital," so a print at the machine counts. Think about the tooling salesperson, the machine service technician and the delivery driver who walk past a print at the machine.

Common mistakes in shop scoping

• Scoping only the office. The file does not stop at the office door, and neither does the boundary
• Assuming machines are out of scope. They still have to be inventoried, documented and managed
• Leaving vendor remote access in place. A machine builder's support connection is an external connection into your environment
• Letting job folders live forever. Closed jobs still hold controlled files, so set a retention rule and follow it
• Treating quality records as harmless. Inspection reports can carry the part definition with them

Frequently asked questions