CUI (Controlled Unclassified Information)
CUI, or Controlled Unclassified Information, is government information that isn't classified but still has to be safeguarded and shared only under controls set by law, regulation, or policy.
CUI sits between public information and classified information. For machine shops, it usually arrives with the work: drawings, models, and specifications from a defense customer marked as CUI, often as controlled technical information. Once that data is in your shop, so are the obligations that come with it, wherever you store it: email, a file share, a laptop, or the shop system that holds the job.
In DoD contracts, CUI is protected through DFARS 252.204-7012, which points to the security requirements in NIST SP 800-171. Every system that stores, processes, or transmits CUI is in scope for those requirements, and any cloud service that stores it has to meet FedRAMP Moderate or an equivalent. This is a summary, not legal advice; your contract and your customer's markings decide what's CUI.
Traveler's Shop Server ($4,250) and Shop Server Defense ($6,500) are designed to keep job records and drawings on a box in your building rather than in a third-party cloud. That box is still in your CUI scope, and you still own the controls around it. Both editions are planned to ship after Traveler Cloud.
Related
Want this handled without the spreadsheet?
Traveler Cloud is quote-to-invoice for small machine shops at $109/month flat, unlimited users. It's in early access — leave your email and we'll bring you in by wave. No sales calls.
Free, no signup: Is My Shop Data CUI or ITAR-Controlled? (2-Minute Check) →