Updated September 30, 2026
A fabrication shop put the question on r/CMMC better than any regulation does: "If a vendor isn't CMMC certified, are we even able to send them CUI?" They used a string of small platers and heat treaters, and nobody could tell them whether the parts could still go out the door.
You can send a controlled drawing to an outside processor only if you pass the contract's security clauses down to them and they hold the right CMMC status first. Most of the time you shouldn't send it at all. An anodizer needs the alloy, the spec, and where to mask. It doesn't need the drawing, and a work order without it keeps the processor's shop out of your problem.
Some terms, once. CUI (controlled unclassified information) is the drawings, models, and specs the government marks as sensitive; on a print it usually shows up as a "CUI" banner or a distribution statement B through F in the notes (DTIC marking guide; how to tell if a drawing is CUI). FCI (federal contract information) is non-public contract detail like part numbers, quantities, and ship dates. CMMC is the Defense Department's program for checking that suppliers protect both. A flowdown is a clause from your contract that you're required to copy into the order you place with your own supplier.
Three ways to get the part processed
There are three routes, and you should pick one per processor, on purpose, before the next job ships.
The blind work order. You send the processor what the process needs and nothing else. No drawing, no model, no inspection report. This is how most commercial finishing already works, and it's the route we'd default to for every plater, anodizer, passivation line, and heat treater you use.
Paper only. The processor needs something from the drawing, so you send a printed copy with the parts and get it back with the parts. No email, no scan, no phone photo.
Full flowdown. The processor needs the drawing electronically, usually an NDT house (nondestructive testing: X-ray, penetrant, magnetic particle, ultrasonic) that needs the acceptance zones, so you pass down the clauses and confirm their status before anything moves.
Each route has a real cost and a real limit. They're below in order.
Route 1: send the spec, not the drawing
Here's what each common process actually needs. If the answer fits in the right-hand column, the drawing stays home.
| Process | What the processor needs | Why they might ask for the drawing |
|---|---|---|
| Plating, anodize, chem film | Material and alloy, the finish spec with its type and class, color, thickness, masking locations | Masking. Solve it with a marked-up photo of the part or a plain outline with no dimensions |
| Heat treat | Alloy, starting condition, target condition or hardness, the heat-treat spec, any test coupon requirement | Rarely. If they ask for "the print," ask which number they're missing |
| Passivation | Alloy, the passivation spec and method, the test required | Almost never |
| NDT | Method, spec, acceptance class, which areas to inspect | Inspection zones and acceptance criteria that live on the drawing. This is the one that often needs Route 2 or 3 |
The masking sketch is where shops slip. A marked-up photo that says "mask these two bores" is fine. A redrawn outline with the bore diameters and positions and their tolerances is a piece of the controlled drawing wearing a different file name. If the sketch needs a controlled dimension, it's CUI, and you're on Route 2 or 3.
A blind work order still carries FCI. The part number, quantity, and due date for a defense job are non-public contract information. That's a small burden, not a big one. Under the CMMC rule, a supplier that handles only FCI needs Level 1 (Self): 15 basic safeguards, self-scored, posted in SPRS (the DoD's Supplier Performance Risk System) (32 CFR 170.23). The DoD estimates that at $5,977 a year for a small business (CMMC final rule). Most processors that also serve primes have it already. Ask.
Route 2: paper only
The DoD's own FAQ, revised in July 2026, answers the paper question directly: "organizations that only handle hard-copy CUI data are not required to complete a CMMC third-party assessment" (DoD CIO CMMC FAQ, C-Q11). Read the rest of that answer before you lean on it. The processor still has to protect the paper under the security clause (DFARS 252.204-7012) when it's flowed down, and the moment anyone scans, photographs, emails, or prints the drawing, the computer or phone that touched it must meet CMMC first. The same FAQ lists printing as placing CUI on a system, so your own printer is in your scope regardless.
In practice, paper only means: you print one numbered copy, it travels in a sealed envelope with the parts, the processor keeps it in a locked drawer while the job runs, and it comes back with the parts. Your traveler log shows it went out and came back. The processor signs the flowdown, because the protection duty still applies. What they avoid is having their office computers pulled into anyone's assessment. It works well for a heat treater that wants the print "just in case." It works badly for anyone who will photograph the page to show the second shift, and you should ask about that directly.
Route 3: full flowdown
When a processor needs the drawing electronically, two clauses go into your PO to them. DFARS 252.204-7012 must go into any subcontract whose performance "will involve covered defense information," and it makes the processor meet the 110 NIST SP 800-171 requirements, report cyber incidents to DoD within 72 hours, and give you the incident report number (DFARS 252.204-7012(m)). DFARS 252.204-7021 goes into subcontracts involving FCI or CUI, commercial off-the-shelf items excepted, and it requires you, before you award, to "ensure that the subcontractor has a current CMMC certificate or current CMMC status" at the right level (DFARS 252.204-7021(f)). For a processor with CUI, that's Level 2 (Self) at minimum, or Level 2 (C3PAO), an outside assessor's certificate, only if your prime's contract requires one (32 CFR 170.23). Older contracts that still carry DFARS 7020 add one more rule: no award unless the processor has at least a Basic self-assessment on file from the last three years (DFARS 252.204-7020(g)). If the drawing carries an export warning, only U.S. persons at the processor may see it, which is a separate question under ITAR.
You can't see their score either
SPRS scores are visible to DoD and the company that posted them, and nobody else (7020(d)). Your prime can't see yours, and you can't see your plater's. So you ask, and you keep what they send. Ask for their CMMC status and level exactly as SPRS shows it, the CMMC UID, the status date, the date of their last annual affirmation, and a screenshot of the SPRS page. A processor with CUI should also tell you where the drawing will live on their side and, if that's a cloud service, its FedRAMP Moderate listing. If a small processor has never posted to SPRS, the 7020 clause offers a route: a Basic assessment can be emailed to [email protected] for posting.
This isn't paperwork for its own sake. Swiss Automation, a precision machining shop in Illinois, paid $421,234 in December 2025 over drawings it didn't protect, in a case its own quality-control manager started. DOJ's point was that the company knew the rules reached subcontractors and suppliers (DOJ; what that case means for shops). Your processors are your subcontractors.
When the processor says no
Plenty of small finishers will not sign a 7012 flowdown, and some won't post anything to SPRS. They have other customers, and your one lot a month doesn't justify it. Here's the order we'd work through.
Start by removing the reason they need the drawing. Usually the ask was "send the print" out of habit, and a proper blind work order ends it. If they truly need one detail, try paper only. If they refuse even the Level 1 (Self) posting for FCI, change processors for defense work and keep them for commercial. The processors most likely to have status already are the ones working for primes directly, and Nadcap accreditation, the aerospace industry's audit program for special processes like heat treating, chemical processing, and NDT, is a good sign you're dealing with one (PRI Nadcap). Nadcap is a process audit, not a cybersecurity one, so still ask for the SPRS status.
The hard case is a sole source: the one NDT lab the prime approved, which needs the drawing and won't flow down. Put it in writing to the prime. Name the processor, the process, what the processor needs, and that it won't accept 7012. The prime can supply the processor directly, approve a different source, or change the inspection requirement. It's the prime's contract and the prime's call. Sending the drawing anyway, with a note in the file that you had no choice, is the Swiss Automation fact pattern with extra steps.
The blind work order
Paste this into your outside-processing PO or traveler. Every field is something the processor can act on, and nothing on it is copied from the controlled drawing.
OUTSIDE PROCESSING ORDER – [PO number]
Our part number: [internal P/N, not the prime's drawing number if it can be avoided]
Quantity: [qty] Ship-back date: [date]
Material / alloy: [e.g., 6061-T6 aluminum, 17-4 stainless]
Current condition: [as machined / annealed / etc.]
Process: [anodize / heat treat / passivate / plate / NDT]
Specification: [spec number, type, class, method]
Requirement: [color, thickness, hardness range, test method]
Masking: see attached photo, masked areas marked in red (no dimensions)
Certification required: [cert of conformance / test report / furnace chart]
Handling: No drawing is provided. Contact [name, phone] if the process
cannot be performed from this order. Do not request drawings from our customer.Flowdown checklist, for Route 2 or 3
Run this before any drawing, paper or digital, leaves the building.
- The processor can't do the job from a blind work order, and you wrote down why.
- Your PO to them includes DFARS 252.204-7012 and 252.204-7021, plus 7020 if your prime contract still has it.
- You have their CMMC status, level, UID, status date, and last affirmation date, with an SPRS screenshot, on file.
- The level matches the job: Level 1 (Self) for FCI only, at least Level 2 (Self) for CUI, Level 2 (C3PAO) if your prime's contract requires it.
- You know where the drawing will live on their side, and any cloud service holding it is FedRAMP Moderate or equivalent.
- You have a named contact who will pass you their DoD incident report number within the 72-hour window.
- For paper: one numbered copy, sealed, logged out and logged back in against the traveler.
- The processor appears on your SSP's list of outside parties that receive CUI, so your own assessment matches reality.
Item 8 is the one people skip. Your prime's questionnaire will ask whether you flow requirements down, and the answer should come from that list. How to answer the prime's questionnaire →
For where the processor sits in the full path of a drawing through your shop, see CMMC for a machine shop, from inbox to mill.