Beyond the CMMC pause: Protecting the engineering data defense programs depend on

Defense manufacturers need to share technical information quickly and securely. A supplier waiting for an approved drawing can hold up production. Sending it through an unmanaged channel can expose sensitive data. Engineering and cybersecurity teams need to address both risks together. 

The Pentagon’s suspension of CMMC Phase II requirements has changed the certification outlook. Phase I self-assessment requirements remain in place, as do contractors’ applicable obligations to safeguard defense information.

For defense leaders, protecting engineering data is also a program execution issue. Can authorized teams get the right information when they need it? Can contractors maintain control as that information moves between systems and organizations?

CAD models, technical drawings, requirements, bills of material, manufacturing instructions, and test results can all contain Controlled Unclassified Information (CUI). As designs evolve, teams share that information across engineering disciplines, production operations, and supplier networks.

Contractors need to understand those movements to protect sensitive data and keep people working from current, approved information. That requires a shared understanding of engineering workflows and cybersecurity responsibilities.

The CUI problem extends beyond individual systems

An inventory of applications containing CUI is a useful starting point. It does not show every place that information may go.

Consider a technical drawing. An engineer creates it in a CAD system and releases it through product lifecycle management (PLM). Manufacturing and quality teams use it, and a supplier receives it to produce a component. Along the way, people may create exports, downloaded copies, or email attachments that also require protection.

Each copy raises questions about access and revision control. Who can use it? Is it still current? What happens when the design changes? An outdated drawing can lead to rework, while an unmanaged transfer can create a security gap.

These questions become harder to answer across supplier networks. Partners need information to perform their work. Contractors need to control what they share, who receives it, and how updates reach the people affected.

Engineering and cybersecurity teams should be able to answer five questions together:

1. Where is CUI created and maintained?
2. Which systems, people, and partners need access?
3. Where do exports and downloaded copies go?
4. How are access and revisions managed when designs change?
5. What records show how information was accessed or shared?

Cybersecurity teams understand the safeguards required. Engineering teams understand how technical information is created, used, and changed. Together, they can identify gaps that an application inventory alone may miss.

PLM connects data protection with engineering execution

PLM manages information that defense programs depend on, including product definitions, bills of material, configurations, engineering changes, and technical documentation. That information supports work across manufacturing, quality, suppliers, and sustainment.

When product information contains CUI, decisions about access, sharing, and revision control become part of the contractor’s cybersecurity responsibilities. 

A well-governed PLM environment can help teams maintain an authoritative product record, manage permissions, preserve revision history, and coordinate approved changes. These capabilities help authorized users work from current information within a controlled environment.

PLM supports broader cybersecurity efforts by connecting data governance with everyday engineering work. Contractors still need the controls, processes, and oversight required across their environment, including wherever information is exported or shared.

Where FedRAMP enters the picture

Moving engineering information to the cloud adds another consideration: the security of the cloud service supporting those workflows.

FedRAMP and CMMC serve different purposes. CMMC assesses how defense contractors protect Federal Contract Information and CUI. FedRAMP provides a standardized approach to assessing and authorizing cloud services used by federal agencies.

For defense contractors, there is also a contractual connection. Where DFARS 252.204-7012 applies, an external cloud provider storing, processing, or transmitting covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline. The provider must also meet the clause’s additional requirements for incident reporting, evidence preservation, and support for investigation and damage assessment.

Using a FedRAMP-authorized service does not automatically make a contractor CMMC compliant. Contractors remain responsible for their own environment, including how they configure access, manage users, and handle information.

Cloud security therefore belongs in the PLM selection process. Engineering and cybersecurity leaders should evaluate how the service protects product information, which responsibilities remain with the contractor, and how teams and suppliers will collaborate.

PTC’s Windchill+ FedRAMP offering helps defense organizations manage product definitions, configurations, and engineering changes in a cloud-based PLM environment. It gives engineering and cybersecurity leaders a shared basis for evaluating how sensitive product information will be managed, protected, and shared.

Start with one engineering workflow

Contractors can begin with a familiar task, such as releasing a technical drawing to a supplier. Map how the information moves from creation through external exchange.

Engineering and cybersecurity teams should identify the authoritative record, the people and systems involved, and any copies created along the way. Then examine how access is controlled and how design changes reach everyone who needs them.

That review can reveal gaps in protection or revision control. Use the findings to prioritize improvements across other workflows and clarify responsibilities with cloud providers and program partners.

The goal is to protect sensitive information while keeping authorized teams working from current, approved product data. That work supports secure program execution regardless of what happens next with CMMC.

Explore how Windchill+ FedRAMP supports secure product data management and collaboration, so authorized engineering, manufacturing, and supplier teams can access the information they need