CUI Markings on Drawings: What a Machinist Should See on the Print

Why are CUI markings on drawings getting attention right now?

The proposed FAR rule would bring CUI contract terms to agencies across the government, not only the Department of War. It is still a proposal. The final text and the date it takes effect are not settled.

You do not need to wait for it. Your Department of War contracts likely already include DFARS 252.204-7012. That clause covers CUI today.

The 7012 wording also causes confusion about what counts as CUI. TrustedSec pointed to this in a recent post. The marks on the print are your first clue, but they do not settle the question alone.

What should a machinist see on a CUI print?

Train your floor to look for these four things:

1. A CUI banner. The word "CUI" or "CONTROLLED" appears at the top and bottom of each sheet. It may add a category, such as controlled technical information or export control.
2. A designation block. It sits on the first sheet or cover. It shows who controls the data, the CUI category, any limits on sharing, and a point of contact.
3. A distribution statement. It uses a letter from A to F. A means approved for public release. B through F limit who may receive the drawing.
4. An export warning. This is an ITAR or EAR notice. It means the data cannot go to foreign persons without approval.

Older prints may carry legacy marks like "FOUO" instead. Treat those as controlled until you confirm otherwise.

You may also see data rights legends like "Limited Rights." Those deal with license rights. They are not CUI marks by themselves, but they often appear on the same prints.

If any of these marks is on the sheet, the rules are simple. The print stays in your controlled area and approved systems. No photos on personal phones. No emailing it to your plater or heat treater unless the prime has approved it and that vendor is covered.

What if the drawing has no CUI marking at all?

Missing marks do not prove a drawing is not CUI. DFARS 252.204-7012 covers information marked or identified in the contract. It also covers information you collect, develop, receive, use or store to perform the contract.

Check the contract and statement of work first. Look for any CUI guidance the prime sent with the order.

Then ask the prime or contracting officer in writing. Save the reply. Until you get an answer, the safer move is to handle the drawing as CUI.

Do my CAM files and setup sheets count as CUI too?

They often do. A CAM file built from a CUI drawing can carry the same controlled technical data. So can setup sheets, CMM programs and inspection reports.

Federal CUI rules and Department of War guidance expect new documents made from CUI to be marked as well. Your shop creates these files to perform the contract, so 7012 can reach them too.

Whether a given file counts depends on what it reveals about the part. When you are unsure, ask the prime and keep the answer on file.

What will an assessor ask to see about markings?

NIST SP 800-171 requirement 3.8.4 calls for marking media with CUI markings and distribution limits. An assessor will want proof that your shop does this in practice. Expect requests like these:

• A written procedure for how you check a drawing for CUI when it arrives.
• A sample marked print, plus a document your shop made from it with matching marks.
• Training records showing floor staff know the four marks.
• Your emails asking the prime about unclear or missing marks.
• A clear answer on where CUI prints and files live, and who can reach them.

A written policy alone will not carry the day. The assessor will look for evidence that your people follow it on the floor.

Sources

• 32 CFR Part 2002, Controlled Unclassified Information
• DoD Instruction 5200.48, Controlled Unclassified Information
• DoD Instruction 5230.24, Distribution Statements on DoD Technical Information
• National Archives CUI Program
• DoD CUI Program
• ISI Defense, CUI Rules Are Changing Under FAR Part 40
• TrustedSec, What is CUI? A Contractor's Perspective