Who This Guide Is For
If you’re a defense contractor who works with CAD files — whether you’re a machine shop receiving drawings from a prime, a design firm building complex assemblies in SolidWorks, or somewhere in between — this guide is for you.
CAD users represent one of the largest segments of the DIB pursuing CMMC Level 2 certification. But “I use CAD and think I need CMMC” doesn’t tell you much about what your path to compliance looks like. A manufacturer who opens a self-contained .dwg file to run a CNC job has a very different compliance challenge than a design team collaborating on a 10,000-part assembly through a PDM database.
This guide walks through the major scenarios we see across our customer base, explains what each requires for a successful C3PAO assessment, and shows where PreVeil fits — and where you’ll need additional measures.
The First Question: Is Your CAD Data Actually CUI?
Before diving into technical architecture, you need to determine whether your CAD files are CUI (Controlled Unclassified Information). Not all CAD work on defense contracts involves CUI, and the answer determines whether CMMC Level 2 applies to those files at all.
CAD files become CUI in two ways. First, they may be sent to you marked as CUI by a prime contractor or government customer. If a drawing arrives with a CUI marking, you must treat it as CUI — full stop — even if the marking seems incorrect. The proper recourse is to contact the contracting officer and request reclassification; until that happens, the marking governs.
Second, if you are designing to specifications that are themselves marked CUI, then the models and drawings you produce are derived CUI and must be treated accordingly.
In practice, overmarking is far more common than undermarking. Many contractors find that virtually everything they receive is stamped CUI. If your workflow involves CUI-marked CAD files in any capacity, CMMC applies to those files and the systems that process them.
The Decision Tree: How Are You Using CAD?
The single most important question for determining your compliance path is not which CAD software you use — it’s how you use it. Your answer places you into one of three scenarios, each with a different compliance architecture.
Scenario 1: You Receive and Use Self-Contained CAD Files
Who this is: Manufacturers, machine shops, and fabricators who receive completed CAD files (e.g., .dwg, .dxf, .sldprt, .sldasm, .step, .iges) from a prime or upstream customer and use them to manufacture parts or assemblies. You open the files, read them, possibly generate machine code from them, and build what they describe. You are not designing or modifying the models.
Why this is the simplest path: A self-contained CAD file is just a file. It behaves like any other document — a PDF, a Word file, a spreadsheet. You can store it, open it, and share it using standard file-management tools. There is no database dependency, no need for collaborative design infrastructure, and no complex reference chains to manage.
Your compliance architecture:
PreVeil serves as the core of your CUI enclave in this scenario. The approach is:
Store all CAD files on PreVeil Drive, which appears as a mapped drive on your workstation. Files stored there are encrypted end-to-end at rest and in transit, with access controls, audit logging, and FedRAMP Authorized cloud infrastructure on AWS GovCloud. This directly addresses CMMC control families including Access Control (AC), Audit & Accountability (AU), Identification & Authentication (IA), and System & Communications Protection (SC).
Redirect application temp and backup paths. Both SolidWorks and AutoCAD write temporary data to your local disk during normal operation — auto-recovery files, backup files, swap files, and cache data. These files can contain CUI and must be protected.
Enable BitLocker on all drives. Both SolidWorks and AutoCAD write scratch data to the Windows %TEMP% directory during active sessions. These transient files cannot be redirected to PreVeil Drive, but BitLocker full-disk encryption covers them at rest, satisfying the encryption at rest requirements. BitLocker should be enabled on all drives on any workstation where CAD software processes CUI.
Disable cloud features. This is especially critical for AutoCAD users. Autodesk has been actively pushing users toward AutoCAD Web, browser-based AutoCAD, and Autodesk Docs (cloud storage). These features pose a significant CUI risk — files could be silently synced or opened in a cloud environment that falls outside your CMMC boundary and is not FedRAMP Authorized.
SolidWorks’ cloud features (3DEXPERIENCE) are more explicitly opt-in and less aggressively pushed, but any cloud integration should be reviewed and disabled if it is not within a compliant boundary.
Enforce access controls and MFA. Restrict workstation access to authorized personnel only, enforce multi-factor authentication for both Windows login and PreVeil access (satisfying IA controls), and apply the principle of least privilege for PreVeil Drive sharing permissions.
Share CUI only through PreVeil. When you need to send CAD files to subcontractors or colleagues, use PreVeil encrypted email or Drive sharing. Never transmit CUI via standard email, USB drives, or unencrypted file-transfer services. Subcontractors can create free PreVeil accounts to receive files securely.
Scenario 2: You Design with a PDM Database (SolidWorks PDM, AutoCAD Vault, etc.)
Who this is: Design and engineering teams who actively create and modify CAD models, typically using a Product Data Management (PDM) system to manage part hierarchies, version control, and multi-user collaboration. In SolidWorks, this is SolidWorks PDM. In AutoCAD, this is Autodesk Vault. Other CAD platforms have equivalent products.
This scenario is more complex because the design environment depends on a relational database that tracks assemblies, parts, hierarchies, and revision history. Some assemblies involve thousands of parts, all managed through the PDM system’s database. PreVeil Drive stores unstructured files — it cannot host a relational database. The PDM database requires an ODBC or similar interface, and PreVeil’s encrypted file system does not support database connectivity.
This is not a limitation unique to PreVeil — it’s the nature of how encrypted file-storage systems and relational databases work. No encrypted Drive product can replace a PDM database.
Your compliance architecture:
In this scenario, compliance requires a split approach. PreVeil handles CUI file storage and secure communication, while your PDM environment must be brought into compliance independently.
Bring your PDM server into compliance on-premise. Most design-focused contractors run their PDM database on-premise or in a managed colocation facility. This server must meet CMMC Level 2 requirements on its own. That means:
- Multi-factor authentication for all users accessing the PDM system
- Encryption at rest (BitLocker or equivalent) on the server hosting the database
- Audit logging of all database access and modifications
- Vulnerability scanning and regular patching of the PDM server and its OS
- Access controls limiting database access to authorized designers and engineers
- Network segmentation isolating the PDM server from non-CUI systems
- Documented configuration management for the server environment
This is an IT operations challenge, not a software limitation. On-premise servers can absolutely be made CMMC-compliant — it just requires implementing and documenting the appropriate controls.
Alternatively, use a FedRAMP Authorized CAD environment. Autodesk offers a federal version of AutoCAD that is FedRAMP Authorized, which would allow you to run the full design environment (including Vault) in a compliant cloud. However, this option comes at a significant cost premium — often double the price of the commercial version — and most contractors opt for on-premise compliance instead.
Use PreVeil for completed outputs and sharing. Even in a PDM-heavy design environment, PreVeil plays a critical role. Final CAD files, drawings, and specifications that are released from the design process should be stored on PreVeil Drive for long-term encrypted storage and secure sharing with customers, primes, and subcontractors. PreVeil also provides the secure email channel for all CUI communications.
Separate your CUI from commercial data. Many contractors have a single file server that holds everything — CUI and commercial data mixed together. This creates a scope problem: every user and system touching that server falls within your CMMC boundary. The cleaner approach is to move CUI files to PreVeil Drive and keep commercial data on your existing infrastructure. This limits the number of users and systems that require CMMC controls, reducing both cost and complexity.
Scenario 2.5: CAD Files with External References
Who this is: Contractors working with CAD assemblies where the master file references external component files stored on a separate file server or network drive. For example, an assembly drawing that pulls in 100 parts from a shared Q: drive.
While in theory, these are all just files — each one could be stored individually on PreVeil Drive. In practice, this is tricky because the references (links from the master file to the component files) are usually absolute paths pointing to a specific drive letter and directory. Moving everything to PreVeil Drive would break every link, and relinking hundreds or thousands of references is an impractical amount of manual work.
Your options:
If the file references use relative paths, you may be able to move the entire directory structure to PreVeil Drive and maintain working links. This is worth testing but uncommon in practice.
If the references are absolute (the far more common case), the practical approach is to leave the working files where they are, bring that file server into compliance using the same controls described in Scenario 2 (encryption, access control, MFA, audit logging, patching), and use PreVeil for the finished outputs and secure sharing.
CNC Machines and the Shop Floor
Many CAD users are manufacturers with CNC mills, lathes, and other computer-controlled equipment on the shop floor. These machines are a frequent source of confusion during CMMC planning, so let’s address them directly.
From CAD to Machine Code
The typical workflow is: CAD files are translated into machine instructions (G-code or a similar machine language) on a workstation, and those instructions are then transferred to the CNC machine. The machine doesn’t read CAD files directly — it reads the derived machine code.
How CUI Gets to the Machine
The most common method is what’s sometimes called “SneakerNet” — the machine code is loaded onto a FIPS-validated encrypted USB drive, and an operator physically carries it to the machine and plugs it in. This is compliant as long as:
- The USB drive uses FIPS 140-3 validated encryption — many popular options include biometric (fingerprint) locks built directly into the drive
- Access controls are in place: only authorized operators can access the USB drives, and there’s a documented policy for who is authorized
- The drives are physically secured when not in use (e.g., stored in a locked cabinet with a sign-out log)
Some newer, modern CNC machines do have up-to-date Windows-based controllers that could potentially run PreVeil directly and pull files from PreVeil Drive. But this is rare — the vast majority of shop-floor equipment runs legacy operating systems or proprietary consoles that cannot be modified.
CNC Machines Are “Specialized Assets”
Under CMMC’s scoping guidance, CNC machines typically fall into the Specialized Asset category (along with other operational technology, IoT devices, and test equipment). This means they are in scope for your assessment, but they are not assessed against the full set of 110 NIST 800-171 controls. Instead, the C3PAO will:
- Review your System Security Plan (SSP) to see how you’ve documented these assets
- Confirm that you’ve implemented whatever controls are feasible given the machine’s limitations
- Verify that you’ve applied compensating measures where direct compliance isn’t possible
In practice, this means documenting in your SSP the physical security measures around CUI machines (curtains, barriers, or separate rooms so unauthorized personnel can’t observe the work), any network isolation for connected machines (older machines are typically air-gapped by default), operator logging that tracks who ran which job on which machine using which files, and access controls limiting who can physically reach the machines and the USB drives that load them.
The guiding principle for specialized assets is simple: implement what you can, document what you can’t, and explain your rationale — a C3PAO won’t fail you because your 1990s-era Haas mill doesn’t support MFA, but they will want to see that you’ve thought through the risks and applied reasonable compensating controls.
The Full Compliance Picture: Beyond CAD Files
Regardless of which CAD scenario applies to you, CMMC certification requires more than just securing your CAD workflow. You’ll still need a complete System Security Plan, properly configured endpoint protection (MDM, full-disk encryption, MFA, patching), identity and access management, physical security controls, an incident response plan, annual security awareness training, vulnerability management, and configuration management across your entire CUI boundary. PreVeil’s platform provides support for 102 of the 110 NIST 800-171 controls, and the Compliance Accelerator provides pre-filled, C3PAO-validated documentation for the rest — but the controls outside your CAD workflow still need to be implemented and maintained by your team.
A Typical Tech Stack
For most CAD-using contractors, the compliance tech stack looks like this:
| Component | Solution | Role |
| CUI file storage, sharing and compliant email | PreVeil | End-to-end encrypted drive and email on AWS GovCloud, access controls, audit logging |
| CAD software | SolidWorks, AutoCAD, etc. | Design and/or viewing (your existing tools) |
| PDM database (if applicable) | SolidWorks PDM, Autodesk Vault, etc. | On-premise, brought into compliance independently |
| CNC file transfer | FIPS-validated encrypted USB | Secure transfer to shop floor equipment |
What This Costs
Every organization is different, but here’s a representative breakdown for a small manufacturer (15–25 employees, 5 CUI users):
- PreVeil (CUI users): Starting at approximately $6,500/year, including admin licenses
- Microsoft 365 Business Premium (all users, for Intune, Entra ID, Defender): Approximately $5,000–$7,000/year
- On-premise PDM server compliance (if applicable): Variable, but primarily an IT operations investment in your existing infrastructure
- FIPS-validated USB drives: Approximately $50–$150 per drive
For organizations in Scenario 1 (self-contained files, no PDM), the total first-year investment is typically under $14,000 plus the cost of the assessment — a fraction of what many contractors expect.
Getting Started: A Timeline
Using PreVeil’s Compliance Accelerator and the guidance in this document, most CAD-using contractors can move from kickoff to assessment readiness in approximately six months even with just one person working part-time on compliance.
Month 1: Deploy PreVeil. Define your CUI boundary. Determine which CAD scenario applies to you. Begin configuring your CAD applications (redirect temp paths, disable cloud features, enable BitLocker).
Month 2: Conduct a self-assessment against NIST SP 800-171 using PreVeil’s Compliance Accelerator. Identify gaps and create a Plan of Action & Milestones (POA&M).
Months 3–4: Implement missing controls. Configure endpoint protection. If you have a PDM server, begin the process of bringing it into compliance. Complete your SSP and supporting documentation. Train your team.
Month 5: Conduct an internal readiness review. Finalize all documentation. Ensure your audit logs are running and being retained.
Month 6: Engage a C3PAO to schedule your formal assessment.
Conclusion
CMMC compliance for CAD users isn’t one-size-fits-all — but it doesn’t have to be overwhelming, either. The key is understanding how you use CAD, which determines your compliance architecture:
- If you work with self-contained CAD files (the most common scenario for manufacturers), PreVeil provides the core of your CUI enclave, and the path to certification is straightforward.
- If you run a design environment with a PDM database, you’ll need PreVeil for file storage and sharing alongside an independently compliant on-premise PDM infrastructure.
- If your CAD files have complex external references, the practical approach is typically on-premise compliance for the working environment with PreVeil handling finished outputs and secure distribution.
In every scenario, PreVeil dramatically reduces both the cost and complexity of achieving CMMC—75+ defense contractors have used PreVeil to achieve perfect 110/110 CMMC scores. Your CAD workflow doesn’t have to make you the exception.
