QuotedPartAnswers · Updated 2026-10-30
What does CUI on a drawing mean for my shop?
Price one of your own parts: Drop a STEP model or PDF drawing — about 90 seconds, no account.
Your part priced in about 90 seconds, no account.
CUI means Controlled Unclassified Information: unclassified information that the US government, or someone acting for it, has decided must be safeguarded. When a print carries a "CUI" banner, you must handle that file as the contract requires, which for defense work usually means NIST SP 800-171 controls, and you cannot treat it as an ordinary file in your email and shared drive. You can still quote it, but only after you know which rules the contract flows down and whether your systems meet them.
See how QuotedPart connects to your workflow with its API, MCP server, autonomous quoting and shop-specific learning.
What the marking looks like
Federal marking rules (32 CFR Part 2002, with guidance from the National Archives) require a banner marking with the control marking "CUI" at the top of marked documents, with category markings after it where they apply, for example CUI//SP-EXPT for export-controlled information. A designation indicator, often a "Controlled by" line on the first page or title block, says who designated the information. Drawings may carry the banner in the title block or the border and a distribution statement.
CUI is not a classification level. It marks sensitive but unclassified information, and it often sits on top of other rules. A drawing can be CUI and also export controlled under ITAR or EAR, and you must handle it under whichever rules are stricter.
What a shop has to do with it
The obligation comes from the contract, not from the marking itself. A defense prime's purchase order will usually flow down DFARS 252.204-7012, which requires safeguarding covered defense information with the security requirements of NIST SP 800-171. Under the CMMC program rule (32 CFR Part 170), a contract involving CUI needs Level 2: the 110 requirements of NIST SP 800-171, assessed by self-assessment or by a third party depending on the contract. Federal Contract Information that is not CUI falls under Level 1's 15 requirements. Rules about when these apply to which contracts have been shifting, so confirm with your customer and the contract, not a blog.
In practice a CUI file has to live on systems you control. Cloud storage and email used for CUI have to meet the standard: for a CMMC Level 2 assessment the rule says a cloud provider handling CUI must be FedRAMP Moderate or equivalent. A free file-sharing account or general-purpose email is the usual way shops fail.
| Question | Why it matters |
|---|---|
| Which contract or PO number flows down the requirement? | The clause tells you whether DFARS 7012 and CMMC Level 2 apply or whether this is a lower-level marking |
| Does the print also carry an ITAR or EAR warning? | Export-controlled data needs US-person access control, which is a separate issue from CUI |
| Who in my shop needs to open it? | Limit access to those people; log who has it |
| Where will it be stored and sent? | Only on systems that meet the contract's security requirement |
| How must it be destroyed or returned at the end? | Contracts often require it; set a retention date |
What changes in quoting
First, don't forward the RFQ to a subcontractor, an outside finisher or any online quoting tool until you have checked that it's allowed and that the recipient can protect it. Flow the marking down: the print goes to them with its marking intact.
Second, price the compliance. If you must keep a CUI system, restrict access and log it, that is a real cost that someone has to pay. Many small shops simply decline CUI work until the system exists. If you do take it, put the security cost in your overhead rate or on the quote.
Third, make marked files harder to send by mistake. Some quoting software checks uploads for markings: QuotedPart checks PDF and STEP text for ITAR, EAR and CUI markings before an upload and asks first, and an optional vault encrypts ITAR parts in the browser before upload. That's a safety net for a mistaken upload, and it isn't a substitute for your own CUI program or the contract's requirements.
Sources and limits
Claims are dated where they can change. Product calculations are examples from the stated inputs, not a promise about a customer's quote. Competitor wording is attributed to the source shown.
- CMMC Level 1 covers Federal Contract Information with 15 requirements and an annual self-assessment; Level 2 covers CUI with the 110 requirements of NIST SP 800-171 and requires FedRAMP Moderate or equivalent for cloud providers that handle CUI. — source (checked 2026-10-30)
- 32 CFR Part 2002 requires CUI to carry a banner marking and a designation indicator; the National Archives' CUI Marking Handbook describes the formats. — source (checked 2026-10-30)
- QuotedPart checks PDF and STEP text for ITAR, EAR and CUI markings before an upload in the app or on the RFQ page and asks before uploading a marked file. — source (checked 2026-10-30)
Questions
Is CUI the same as ITAR?
No. CUI is a marking and handling program for unclassified government information. ITAR controls exports of defense technical data. A drawing can be both, and then both sets of rules apply.
Can I just not open it?
If the RFQ is marked and you have it, you have already received it. Stop forwarding it, limit who can see it, and ask the customer what the contract requires.
Is this legal advice?
No. Check the actual clauses in your contract.
Price one of your own parts
Drop a PDF drawing or a STEP file. QuotedPart reads the print, measures the model and prices it in seconds, on default shop rates you can change.
Your STEP file or PDF drawingDrop a PDF drawing, a STEP file or both
Free. No account, no email. Priced at our default US rates until you set yours.
Related QuotedPart guides
Answers
CMMC Level 1 or Level 2: which does my machine shop need?
A decision tree for job shops: Federal Contract Information only means CMMC Level 1 (15 requirements, annual self-assessment); Controlled Unclassified Information means Level 2 (110 requirements). Examples and how to find out from your contract.
Answers
What CMMC means for a small machine shop
A contract-first explanation of CMMC Level 1 and Level 2, scoping, systems and the first actions a small defense supplier can take.
Answers
Can a customer email ITAR drawings? Gmail, Dropbox and safer quoting paths
How to pause an ITAR drawing transfer, ask the customer for an approved method and keep a quote moving without guessing at export-control compliance.
Answers
How to quote an ITAR-controlled drawing without mishandling it
A shop workflow for scoping an ITAR drawing: classify first, restrict US-person access, control suppliers and price the work only after the transfer path is clear.