Collaboration does not remove the CUI boundary. It makes drawing it more important.
On a government project the drawings have to reach the people building from them: the superintendent, the trailer, the subcontractor’s estimator. Every one of those hand-offs takes Controlled Unclassified Information (CUI) further from the office where the controls were designed. The program has to follow it out there.
Collaboration doesn't eliminate the CUI boundary. It makes defining and controlling that boundary more important.
What CUI may look like here.
Examples of information that may constitute CUI when appropriately designated or contractually identified include:
- Facility drawings
- Site plans
- Utility diagrams
- Security system layouts
- Network and communications plans
- Access-control information
- Infrastructure assessments
- Government project specifications
The path a file takes.
- Government
- Project Manager
- Project Site
- Field Device
- Subcontractor
- Deliverable
Where it goes wrong.
The download that starts everything
The project manager downloads the drawings. From that moment the controlled copy is on a laptop, and the next copies are made from it. Where that laptop is managed, whether it is encrypted, and what happens when it goes home at night are the first questions, and they are usually answered by whatever the company did for ordinary IT.
Tablets, trailers and field laptops
The superintendent uses a tablet. A field laptop sits in a project trailer with a padlock on the door and a shared password on the screen. These devices are the working end of the project and the least managed part of the estate. They also hold the plans that show where the utilities, the security systems and the network runs are.
Convenient file sharing
Documents are emailed, or uploaded to whichever file-sharing platform the subcontractor already uses, because that is how the drawings get to the people who need them by Monday. Each of those platforms is now holding CUI outside any boundary the contractor defined, with no record of who downloaded what.
Subcontractors that need the plans
Subcontractors require plans to do their jobs, and the contract flows the protection obligation down to them. What is rarely settled is who among them receives controlled information, by what method, and whether they have acknowledged what they took on. The challenge is maintaining control of CUI while allowing the project team to function, and the team includes companies you do not manage.
"Our subcontractors need access to the drawings to do their jobs."
They do, and the program should be built on that assumption rather than against it. Collaboration does not eliminate the CUI boundary. It makes defining and controlling that boundary more important, because a boundary that everyone crosses informally is not a boundary at all. The question is not whether the subcontractor gets the drawings. It is through what door, on what terms, and with what record.
That means a defined channel for controlled documents that subcontractors can actually use, a written record of which subcontractors receive CUI and what obligations flowed down to them, and field devices that are managed by the contractor rather than by whoever happens to be holding them. Done that way, the project team works the way it always has. The difference is that the contractor can show where every copy went, and the subcontractor knows what it agreed to when it received one.
An environment that holds.
- 01
- A controlled document channel for the project — One sanctioned platform for controlled drawings and specifications, with named access per project, download logging and expiring shares. It replaces the email attachment and the ad hoc file-sharing link, and it works from the trailer.
- 02
- Managed field devices — Tablets and field laptops are company-owned, enrolled in device management, encrypted, protected by multifactor authentication (MFA) and remotely wipeable. A device left in a trailer or a truck is a lost device, not a lost project.
- 03
- A subcontractor register with flow-down on record — A maintained list of which subcontractors receive controlled information on which project, the method used, and the acknowledgement of the protection obligation each accepted. It is the answer to the first question a prime or an assessor asks about the supply chain.
- 04
- A boundary that includes the site — The System Security Plan (SSP) describes the field environment, not only the head office: the devices, the connectivity in the trailer, the printing and the physical handling of drawings on site. The evidence for those controls is collected from the field on the same schedule as everything else.
The order we do it in.
- 01
Discover CUI
- 02
Define Scope
- 03
Identify Gaps
- 04
Design Controls
- 05
Implement
- 06
Collect Evidence
- 07
Prepare for Assessment
- 08
Maintain Compliance
This is the CMMCg Method applied to your environment. Read the Method →
Open these first.
The working documents from the CMMCg Resource Library that fit this kind of organization, in the order to use them.
CUI Identification Worksheet
Worksheet to list the information your organization receives, creates, processes or transmits that may constitute CUI, with origin, access, storage and marking.
Open →CUI Flow Mapping Template
Template to trace each CUI type from receipt through processing, storage, transmission, sharing and disposition, and mark where it leaves your boundary.
Open →CMMC Scoping Worksheet
Worksheet to sort people, systems, endpoints, networks, cloud services, facilities and providers into CMMC asset categories, and defend every exclusion.
Open →CMMC Level 2 Readiness Checklist
High-level readiness review across all 14 NIST SP 800-171 Rev 2 requirement families that CMMC Level 2 assesses, 3 to 5 review prompts per family.
Open →
Further along than that? The path continues with the Evidence Collection Tracker, the Gap & POA&M Tracker (a POA&M is a Plan of Action and Milestones) and the Assessment Preparation Checklist.
Does this look like your environment?
The readiness call starts from where your information actually goes, not from a template. An engineer runs it.
- Your CUI boundary sketched on the call
- The requirements costing you the most points, named
- A written summary afterward, yours to keep
NDA signed before anything technical. No cost, no obligation.