Traveler

Is the Data in Your Shop System CUI or ITAR-Controlled?

A 2-minute check for job shops

Most CUI checklists ask about your contracts. This one asks about what ends up in your shop software — the quotes, travelers, FAI reports and job records that copy part numbers and drawings from defense work. Ten yes / no / not-sure questions, a plain-English result with the reasons, and what to do next. If it turns out controlled data is in your system, the cloud vs on-prem cost calculator shows what the options cost. Runs in your browser — nothing leaves this page.

  1. 1.Do you store drawings or 3D models from defense primes or the DoD, directly or through a higher-tier sub?

    Lockheed Martin, RTX, another prime, a DoD buyer, or a shop that supplies one of them.

  2. 2.Do any of your POs, contracts or flow-downs include DFARS 252.204-7012?

    Look in the PO terms or the prime's supplier flow-down document for "252.204-7012" or "Safeguarding Covered Defense Information".

  3. 3.Do any drawings or documents carry CUI or distribution-statement markings?

    For example "CUI", "CUI//SP-CTI", "Distribution Statement D" or a "Controlled by:" block in the title block or banner.

  4. 4.Do drawings or POs carry ITAR or EAR export-control warnings, or do you make items on the US Munitions List?

    Warnings like "This document contains technical data whose export is restricted by the ITAR" or an ECCN / USML category on the PO.

  5. 5.Have you ever received a DD Form 254 with a contract or subcontract?

    The DD 254 is the contract security classification specification. Many small shops never see one.

  6. 6.Have you posted a NIST SP 800-171 score in SPRS, or has a customer asked you to?

    SPRS is the Supplier Performance Risk System. Primes such as RTX ask for a Basic Assessment score before award.

  7. 7.Does any contract or solicitation you've bid on specify a CMMC level?

    Level 1 is for Federal Contract Information; Level 2 is for CUI.

  8. 8.Do your quotes, travelers, routers, FAI reports or job records reference those part numbers or attach those drawings?

    Attached PDFs, models, inspection reports with dimensions from the drawing, or notes copied from the print.

  9. 9.Are any of these files or records stored in cloud tools — email, file sharing, quoting software or a cloud ERP?

    Gmail or Microsoft 365 commercial, Dropbox, Google Drive, a cloud quoting tool, or a hosted ERP.

  10. 10.Do any foreign persons work at the shop or have remote access to your systems?

    Anyone who is not a US citizen or lawful permanent resident, including an offshore IT contractor or software vendor's support team.

10 questions to go. “Not sure” is a fine answer.

Not legal advice. This check is a screen, not a determination. It can't tell you whether your data is CUI or export-controlled — your contract, the government's markings and your customer decide that. For a binding answer, ask your prime or contracting officer, or an export-control attorney. Your answers stay in your browser.

Straight answers

▸Is the data in my ERP or quoting software CUI?

It can be. CUI doesn't stop being CUI when it's copied out of a drawing: a quote that attaches the print, a traveler with dimensions from it, or an FAI report against a controlled part can all carry it. Whether a given drawing is CUI is decided by your contract and the government's markings, so start there — then follow the data into every system it touches.

▸CMMC Phase 2 is suspended. Do I still need to worry about CUI?

Yes. A DoD CIO memo suspended CMMC Phase 2 on 13 July 2026 "until further notice", but DFARS 252.204-7012, NIST SP 800-171 Rev 2 and SPRS self-assessment scores still apply wherever your contracts call for them, and so does False Claims Act exposure for scores you can't back up. That's the status as of October 2026; check dodcio.defense.gov for the latest.

▸Can CUI or ITAR drawings live in a cloud tool?

Sometimes. Under DFARS 7012, a cloud service storing covered defense information needs FedRAMP Moderate or a documented equivalency (DoD CIO memo, December 2023); a SOC 2 report doesn't qualify. ITAR doesn't ban the cloud outright — 22 CFR 120.54 exempts end-to-end encrypted technical data when the provider holds no keys — but any foreign-person access is still an export. Ordinary email, file-sharing and cloud quoting tools often meet neither.

▸Who actually decides whether my data is CUI?

The government, through the contract and the markings, and your prime as the one who flows it down. A September 2026 ISOO notice directs agencies to tell contractors what is CUI, so asking your prime or contracting officer in writing is reasonable. For help scoping, a NIST MEP center or a CMMC Registered Provider Organization (RPO) can work through it with you.

▸Does an on-prem server make me CMMC or ITAR compliant?

No product makes a shop compliant on its own. Compliance comes from your whole environment, your policies and your assessment. Keeping drawings and job data on a box on your own network means it isn't sitting with an external cloud provider, but the box is in your CUI scope and you still own the controls.