Updated September 30, 2026
The mailbox it landed in, every device that synced that mailbox, and the laptop your estimator opened it on are now holding CUI, whether or not you quote the job. CUI (controlled unclassified information) is the government's label for sensitive technical data; for a machine shop it means drawings and models for military parts. From the moment it arrives, those systems belong in your CMMC scope, the set of computers and people that have to meet the 110 security requirements of Level 2.
That's the uncomfortable part of quoting. Most shops set up their defenses around the job they won. The RFQ shows up weeks earlier, often from a buyer you've never met, and it goes to sales@ like everything else.
What happens in the first ten minutes
Take a real Tuesday. At 8:52 a.m. an email arrives at sales@ from a distributor you've never heard of. Subject: "RFQ, 3 line items, due Friday." Three PDFs and a STEP file are attached. The title block says Distribution Statement D and carries an export warning. (If you're unsure what those marks mean, read the title block first.)
By 9:05, here's where that drawing lives:
- The shared mailbox in your Microsoft 365 or Google tenant, and whatever email security gateway filtered it on the way in.
- The owner's and the office manager's phones, which sync sales@.
- The estimator's laptop, twice: in Outlook's offline cache, and in the Downloads folder where he saved the PDF to measure it.
- The quoting folder on the file server, where he dropped the STEP file for the programmer to look at cycle time.
- The printer by the front desk, because he printed sheet 2.
Nobody did anything unusual. A small manufacturer on r/CMMC summed up the whole industry: "we do get prints via email." Each of those places now has to meet the rules, the same way the stops after an award do (the drawing's full path through a shop). The cloud mail service has to be FedRAMP Moderate or equivalent (DFARS 252.204-7012), which for Microsoft 365 means Microsoft's government cloud, not the commercial tenant most shops run (Microsoft 365 and GCC High for a shop). The laptop, the phones, and the file server each need encryption, multi-factor login, and the rest of the 110.
"We haven't won it yet" doesn't get you out. The DoD's marking rules say anything carrying Statement B through F is handled under its CUI procedures, contract or no contract (DoDI 5230.24). And if you win, the same inbox and laptop carry the same drawing for the next two years.
Does keeping it in the prime's portal keep us out of scope?
Usually not. This is the most expensive misunderstanding in quoting.
A prime's supplier portal looks like the drawing never leaves the prime. But when your estimator clicks "view" in a browser, the portal sends the file to his laptop, and the browser renders it there. The file sits in the browser's cache and temporary files. That's processing and storing CUI on your laptop, which makes it a CUI asset.
The one arrangement that keeps a laptop out of scope is narrow and specific. The Pentagon's CMMC FAQ says a laptop reaching CUI through a virtual desktop is out of scope only if the session sends nothing but keyboard, video and mouse, and the virtual desktop blocks copying (including screenshots), saving and printing, and access requires its own multi-factor login separate from the laptop (DoD CMMC FAQ, Nov. 2025, questions E-Q6 and E-Q7; 32 CFR 170.19). If the prime offers a virtual desktop set up that way, use it and you're clean. If it offers a download button, or a viewer in a browser tab, the laptop is in. And the moment anyone clicks download, everything the file touches afterward is in too.
When the solicitation wants your score before the drawings
A solicitation or prime portal may refuse to release the technical data package until you enter your SPRS score or confirm Level 2 (Self) status. SPRS is the Pentagon's Supplier Performance Risk System, where you post the score from your self-assessment against the 110 requirements. Two things are true here.
First, the answer is a representation to the government. Primes can't see your score in SPRS; the rule limits access to DoD and your own company (DFARS 252.204-7020). So they ask you, and they rely on what you say. An Illinois precision machining company paid $421,234 in December 2025 to settle claims that it hadn't met the requirements it represented (DOJ; what the Swiss Automation case means for shops). Typing a number into a portal to get at a drawing is the same representation.
Second, the gate protects the prime, not you. Once you pass it and download, your systems are in scope. If the drawings are export-controlled with Statement C or D, the same DoD rules expect the sender to confirm you hold a current DD Form 2345 before releasing them.
Build a quoting lane, not a quoting habit
Here's what we'd do in a 20 to 60 person shop that wants defense work: make quoting its own small, controlled workflow, and keep the rest of the office out of it.
That means one address for controlled RFQs, such as rfq@, that lives inside your controlled environment, whether that's a GCC High tenant, a FedRAMP-authorized secure file and mail service, or an enclave. It means one or two estimator seats and managed laptops inside that same boundary, encrypted, with multi-factor login. It means quoting folders that live there, not on the general file server. And your published contact pages and supplier profiles tell buyers to send technical data to rfq@ or through their own portal.
The economics favor it. DoD's own estimate for a small business's Level 2 self-assessments is $37,196 over three years, before any fixes, and fixes scale with the number of people and machines in scope (89 FR 83178). Pulling three estimators into a controlled lane is a different project from pulling 40 mailboxes and every front-office phone into one. If you already have a controlled environment for production, quoting simply joins it. If you don't, the quoting lane is often the first piece to build, because it's where CUI shows up first. Enclave or whole company →
Two small settings back it up. In Exchange Online, a mail flow rule on the general mailboxes with the condition "Any attachment's content includes these words" set to "Distribution Statement B," "Distribution Statement C," "Distribution Statement D," "Distribution Statement E," "Distribution Statement F," and "Arms Export Control Act" can reject the message with a note pointing the sender to rfq@ (Microsoft Learn: mail flow rule conditions). Scanned drawings won't match, so treat it as a tripwire, not a wall. And block automatic forwarding out of the controlled tenant, so nobody "just sends it to my regular inbox."
The quote itself can stay outside. Price, quantity, material, lead time and part number are not CUI. Keep sketches, dimensions and screenshots of the print out of the quote and it goes to the buyer from any mailbox, or straight from your ERP's quoting screen.
Drawings nobody should have sent
The cold-call RFQ with obviously controlled prints is common enough that an r/CMMC poster, "busting my butt prepping to level 2," asked where to report the sender. Before you're ready to hold CUI, and sometimes after, the right move is to decline and clean up.
Your decision rule:
| What arrived | What we'd do |
|---|---|
| Controlled drawing from a customer you work with, and you have a controlled lane | Move it into the lane, delete the copies elsewhere, remind the buyer of rfq@ |
| Controlled drawing from a customer you work with, and you don't | Decline, ask them to hold the RFQ or send it as non-CUI, clean up |
| Controlled drawing from a sender you don't know | Don't quote. Reply without attachments, clean up, and tell the controlling office on the drawing |
| Export-controlled drawing already opened by an employee who isn't a U.S. citizen or green-card holder | Call export counsel the same day; that can be an unauthorized export |
Cleaning up means: remove it from every mailbox and folder it reached, including Deleted Items (in Microsoft 365, ask your admin to purge it from the Recoverable Items folder too), the laptop's Downloads folder, the file server, and the print tray. Then write down what happened.
Whom to tell. The sender, first, in writing. Your own customer's buyer, if the part is theirs. And for unsolicited drawings from an unknown sender, the controlling DoD office. Its name is in the distribution statement and its phone or email is in the designation block at the lower right of sheet 1. That office owns the drawing and is the one party that can decide whether someone leaked it.
Tool: reply to an unsolicited CUI RFQ
Reply without the attachments (use Reply, not Forward, and check the attachments are gone).
Subject: RE: [their subject]
Thank you for considering [Shop name] for this work.
The drawings attached to your email are marked [Distribution Statement D / CUI / export-controlled]. We don't accept controlled technical data by unencrypted email, so we have not reviewed them and have deleted them from our systems.
If you'd like a quote, please [send the package through your supplier portal / upload it to our secure folder at (link) / send it to rfq@(domain)], and confirm that you're authorized to release this data to us under the distribution statement shown. Our CAGE code is [code].
If this was sent in error, no action is needed; the files are gone.
[Name, title, phone]
Tool: the estimator's quoting procedure
Post this at the estimator's desk. It takes two minutes per RFQ.
- Open new RFQs only on the quoting laptop, never on a phone.
- Read the title block of every sheet before anything else. B through F, a CUI banner, or an export warning: it's controlled.
- Controlled and arrived outside rfq@ or the portal? Stop. Move it into the quoting folder, delete the original, and tell [owner] today.
- Unknown sender with controlled drawings? Don't quote. Send the reply template and log it.
- Work only from the quoting folder. No Downloads, no desktop, no USB, no personal email.
- Print only on [controlled printer]. Scrap prints go in the locked shred bin.
- Need the programmer's cycle-time estimate? Share the quoting folder link. No email attachments.
- The quote goes out with part number, rev, quantity, material, price and lead time. No dimensions, sketches or screenshots.
- No award in 30 days? Move the folder to the controlled archive or delete it, per the customer's instructions.
- Log every controlled RFQ: date, sender, part number, statement letter, and where it went.
That log is worth more than it looks. It's your CUI data-flow evidence for quoting, and it's the first thing an assessor will ask for. How to map every place CUI flows →