CMMC for AEC Firms

Firms designing and building for the federal government handle controlled information constantly without always recognising it. Facility drawings, site plans, utility routing, security system layouts and base infrastructure detail all commonly carry distribution statements, and a distribution statement other than A is a strong indicator of controlled technical information.

What makes AEC distinctive is not the information. It is where the information lives.

Your CUI is probably in someone else’s platform

Most industries scope by walking their own network. AEC firms scope by walking a supply chain of collaboration platforms — Procore, Kahua, Autodesk Construction Cloud, BIM 360, a client’s own project portal.

Scope follows the information rather than the asset register. A controlled drawing sitting in a construction management platform is in scope, which raises two questions at once: is your access to it controlled to the standard, and does the platform itself satisfy the cloud service provider requirements in DFARS 252.204-7012?

That second question is frequently unanswered because nobody in the project team owns it. The general contractor assumes the client selected a compliant platform; the client assumes the contractor checked. See DFARS 252.204-7012 on the equivalency requirement.

Project teams cross organisational boundaries by design

A design-build team is typically a prime, an architect, several engineering disciplines, specialist subcontractors, and sometimes a joint venture wrapper. The controlled drawing set passes through all of them.

Three consequences:

• Flow-down is wide and shallow. Many parties, each holding a subset, each needing the clause where they handle controlled information. See flow-down requirements.
• Joint ventures need the question settled in the teaming agreement. Who owns the shared environment, whose controls apply to it, and who answers for it in an assessment.
• Design consultants are often the weakest link — small firms, high technical value, and rarely a compliance function.

The field is part of your scope

Design firms tend to scope the office and stop. Construction pulls controlled information onto the site: drawings on a tablet in a trailer, printed sets in a site office, RFI responses containing facility detail, as-built markups photographed on a phone.

Mobile devices, site connectivity and printed material are all in scope where they carry controlled information. Physical Protection and Media Protection matter more here than in most industries, and the three Physical Protection requirements that can never be deferred to a POA&M — 3.10.3, 3.10.4 and 3.10.5 — land squarely on site security and visitor control. See POA&M eligibility.

Reading a distribution statement on a drawing set

AEC scoping decisions usually come down to a title block. Distribution statements A through F appear on federal technical documents and tell you directly how the originating agency intends the document to be handled. Statement A is approved for public release and carries no restriction. Anything from B onward restricts distribution — to government agencies, to contractors, to DoD components — and that restriction is the signal to treat the document as controlled technical information until somebody with authority says otherwise.

The practical habit worth building is that the drawing set is assessed once, on receipt, by somebody who knows what they are looking at, and the answer is recorded against the project rather than rediscovered by each discipline. Firms that skip this end up with the same drawing treated as controlled by the structural engineer and as ordinary project paperwork by the estimating team. See CUI categories for how the markings map onto the registry, and marking CUI for what you must apply to derivative documents you produce from a controlled source — which, in design work, is most of what you produce.

Project lifecycles versus compliance lifecycles

A federal construction project might run eighteen months. A compliance programme runs continuously, and the obligation attaches to the contract rather than the schedule.

The practical implication is that firms bidding federal work intermittently face a harder economic question than a manufacturer with steady defense revenue: the cost is ongoing while the revenue is episodic. Two responses tend to work — scope hard to a small enclave used only for federal projects, or decide deliberately that this market is not worth the overhead. Both are respectable; drifting between them is not.

Whichever you choose, base it on real numbers. See what compliance actually costs and start from the clause test.