# Controlled Unclassified Information in Your ERP > Source: https://netray.co/resources/controlled-unclassified-information-in-erp > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Knowledge Base ## Short answer Where CUI hides in a manufacturing ERP: attachments, routings, BOMs, travelers and reports, plus how to scope, permission and audit it for NIST 800-171. ## Category ai-automation ## Content **Intro:** Controlled unclassified information in ERP is usually hiding in four places: document attachments on items, jobs and POs; routings and work instructions derived from controlled drawings; bills of material for export-controlled assemblies; and reports and exports that copy that data elsewhere. Whether your ERP is inside your CUI boundary depends on what it stores. Most defense shops keep the drawing in a controlled repository and let the ERP hold only non-CUI metadata, which keeps the ERP out of scope. **Sections:** #### The Four Places CUI Shows Up in an ERP **Body:** Start with attachments. JobBOSS, E2 Shop System, ProShop, Global Shop Solutions, Epicor, Infor SyteLine and NetSuite all let users attach PDFs and models to items, jobs, quotes and purchase orders. Those attachments are the most common CUI store. Next, routings and operation text: if an operation note says how to machine a controlled feature to a controlled tolerance, it may inherit the marking. BOMs for controlled assemblies can themselves be controlled. Finally, reports, scheduled exports, email notifications and BI extracts duplicate whatever was in the source. Map each, because every copy is another system that must meet NIST SP 800-171. **Bullets:** - Item, job, PO and quote attachments - Routing and operation notes derived from drawings - BOMs and structure for controlled assemblies - Report outputs, scheduled exports and data warehouse extracts - Backups and test or sandbox copies of the production database #### Option A: Keep CUI Out of the ERP **Body:** The cleanest design stores controlled drawings and models only in a restricted document library or PLM and puts a reference number or link in the ERP. Operators open the drawing from the controlled system at the machine. The ERP then holds part numbers, quantities, dates and costs, which are usually Federal Contract Information at most. This shrinks the assessed boundary and avoids FedRAMP questions if the ERP is a cloud service. The trade-off is user friction: everyone who needs a drawing must have access to the second system, and shops must resist the habit of attaching a PDF to make a job easier to run. Enforce it with a rule and a periodic attachment audit. #### Option B: Bring the ERP Inside the Boundary **Body:** Some shops need drawings, routings and BOMs in the ERP for traceability and paperless travelers. Then the ERP and its database, application servers, backups, admin consoles and integrations are in scope. For an on-prem install that is manageable: segment it, enforce MFA and role-based permissions, log access, encrypt at rest and in transit with FIPS-validated cryptography, and restrict administrators to vetted US persons where ITAR applies. For cloud ERP, the provider must meet FedRAMP Moderate equivalence if it processes CUI, and you need a customer responsibility matrix. Many mainstream SaaS ERPs do not offer this, which is why on-prem or a government cloud tenant matters for CUI-heavy shops. #### Permissions, Auditing and Reports **Body:** Inside scope, treat the ERP like a CUI system. Assign roles by least privilege, so the person entering receipts cannot open every program's drawings. Review who can see attachments on controlled item groups. Turn on audit logging for views, downloads and exports where the product supports it, and send logs to central storage. Examine scheduled reports and BI connectors, since a nightly export to a shared drive can quietly break your boundary. Test sandbox and training databases: a refreshed copy of production carries CUI along unless you scrub it. Keep a data-flow diagram that shows each of these paths, because assessors will ask for it. #### Where AI Fits and Where to Be Careful **Body:** AI over ERP data can be useful for quoting, planning and quality questions, but it adds a new place CUI can land: prompts, retrieval indexes, embeddings and logs. A model hosted by an outside provider turns your ERP into an exporter of controlled data. A model that runs on your own hardware inside the boundary does not, provided the index and logs are protected the same way as the source. If your ERP holds no CUI and the AI sees only that metadata, the scoping is simpler. Decide the policy first, then pick the tool. **Cta:** Netray deploys read-only, on-prem AI over ERP data that respects your ERP roles and stays inside your boundary. Ask for a data-flow review before you decide what the AI should see. **Faq:** #### Is my ERP in scope for CMMC and NIST 800-171? **Answer:** It is in scope if it stores, processes or transmits CUI. If drawings and controlled routings are attached in the ERP, it is in scope along with its database, servers and backups. If the ERP holds only part numbers and costs, it may be out of scope, but document the reasoning and verify nothing controlled leaks via attachments or notes. #### Can I use cloud ERP with CUI? **Answer:** Only if the cloud provider meets FedRAMP Moderate or equivalent and supports the security requirements, with a clear shared-responsibility matrix. Many general SaaS ERPs do not. Check the provider's CMMC and FedRAMP documentation, or keep CUI out of the ERP by linking to a controlled repository. #### Are job travelers and routers CUI? **Answer:** They can be if they contain controlled technical details copied from the drawing, such as controlled dimensions or process parameters. Ask your prime how they mark such data. A traveler with only operation names, quantities and signoffs usually carries less risk than one with embedded drawing content. ## Related Slugs - cui-enclave-architecture-defense - export-controlled-data-ai-governance - how-to-configure-syteline-itar-compliance - defense-manufacturing-compliance - private-ai-data-governance-framework ## Search terms CUI in ERP, controlled unclassified information ERP, ERP for CMMC compliance, ITAR ERP attachments, ERP for defense contractors CUI, NIST 800-171 ERP scope, cloud ERP CUI FedRAMP --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json