# Defense Contractors Clarify Derived CUI Scope

Defense contractors face unresolved questions about whether OEM drawings and manufacturer-created derivatives—including cropped views, work instructions, fixture drawings, and CNC/G-code—constitute controlled unclassified information (CUI). The cited DoD CUI FAQ states that a DoD distribution statement alone does not automatically make a document CUI, while commenters note that contract terms, CUI categories, and markings on source material may affect how project-specific derivatives should be handled. Contractors should review applicable contract language and export-control notices, request a written determination from the prime contractor or contracting officer, and consider interim enclave handling until the scope is resolved.

- The discussion identifies potential applicability of DFARS 252.204-7012, but does not establish that every drawing or derivative is covered; treatment depends on the contract and the relevant information and markings.
- **Why this matters:** Misjudging CUI scope can affect contractors’ safeguarding processes and the systems or enclaves used to create, store, and share technical data.
- Contractors can request a written determination that addresses each document type, including full drawings, cropped views, derived work instructions, and CNC programs, and retain the response in their system security plan.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Regulatory Compliance, Cybersecurity
**Published:** November 10, 2026

### Government Entities
- U.S. Department of Defense (DoD)
- National Archives and Records Administration (NARA)

### Key Quotes
> Send the prime or the contracting officer a short email listing the specific document types: full drawings, cropped views, derived work instructions and CNC programs. Ask which of them they consider CTI, and file the reply in your SSP.
> — Commenter (manufacturer enclave-scoping experience)

> The application of a distribution statement does not automatically mean the document is CUI. Do not confuse the two issues.
> — Commenter (quoting the DoD CUI Program website FAQ)

> My legal counsel argues that in the absence of a CUI marking, it's far safer to potentially overclassify the document and handle it as CUI
> — Commenter

### Sources
- [If we decide what is derived CUI, I'm worried it'll bite us in the butt.....](https://www.reddit.com/r/CMMC/comments/1xsxdzx/if_we_decide_what_is_derived_cui_im_worried_itll) - reddit-cmmc