# Defense Contractors Vet CAD Subcontractors

A machine shop with a new defense subcontract is seeking temporary CAD support for drawings marked CUI, some of which also carry export-control notices. The procurement guidance is to review the RFQ, purchase order, and prime contract for applicable DFARS clauses and safeguarding requirements, flow applicable obligations down to the CAD subcontractor, and verify the subcontractor’s capabilities before sharing files. A FedRAMP claim should be checked against the specific software product and service in scope; it does not by itself establish that AutoCAD or Inventor is covered.

- Before sharing controlled drawings, procurement and security teams should confirm the applicable contract clauses and safeguarding obligations, then ensure relevant requirements are flowed down to the CAD subcontractor.
- Businesses providing CAD services to defense suppliers should be prepared to demonstrate how they handle CUI and any export-controlled information, and should substantiate claims about the specific products and services they use.
- Buyers should distinguish a software publisher’s product-level FedRAMP status from the security posture of the subcontractor’s overall CAD environment.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 09, 2026

### Government Entities
- National Institute of Standards and Technology (NIST)

### Vendors
- Autodesk (CAD software publisher)
- Dassault Systèmes (CATIA software publisher)

### Key Quotes
> Read your contract over for specifics - they should have requirements around DFARS 7012 and 7020 clauses in there.
> — Community commenter

### Sources
- [What CAD outsourcing companies work with aerospace and defense clients? Trying to figure out what proof to ask for](https://www.reddit.com/r/CMMC/comments/1x1dczc/what_cad_outsourcing_companies_work_with) - reddit-cmmc