Electronics assembly has a different CUI shape from machining. A machined part comes from one drawing; a board build comes from a package — Gerbers, drill files, netlist, BOM, assembly drawing, test procedure — and every one of those files is small, portable, and routinely emailed to somebody else.
The files are the scope
- Gerber and drill files, which are the fabrication data and travel to your board house.
- The BOM, which names parts and often reveals the application.
- Netlists and schematics, where a design is most exposed.
- Test procedures and acceptance criteria, frequently the most sensitive item in the package.
- First-article and inspection reports that reproduce the above.
None of those live on a machine tool. They live in email, in a shared folder, in the CAM software's project directory, and — this is the part that surprises people — in the outbox of whoever sent them to a supplier last Tuesday.
Subcontracting is the real exposure
Most assemblers do not fabricate their own bare boards, and many outsource conformal coating, potting, cable harness work or environmental test. Every one of those handoffs sends controlled data outside your boundary, and the safeguarding obligation follows it.
That makes you the flow-down link rather than only its recipient. If your board house handles the same CUI, it inherits requirements from you the same way you inherited them from your prime. Assessors ask how you manage that, and "we send them a zip file" is not an answer.
Inventory your outbound handoffs before your inbound ones. Most assemblers can name their customers instantly and need a week to reconstruct which suppliers have received controlled data this year.
Cloud EDA and file transfer
Design and collaboration tooling in this industry is increasingly cloud-hosted, and free file-transfer services are the default way packages move. Both decisions place CUI in systems you do not control, which pulls those services into scope and raises questions about where the data physically sits.
This is worth settling early, because it is the one area where the cheapest habit — dropping a zip on a consumer file-sharing link — is also the hardest to defend in an assessment. Replacing it is inexpensive; explaining it afterwards is not.
The BOM drags your ERP in
This is where assemblers scope differently from machinists. A machine shop's ERP often holds only job numbers, quantities and dates, and can sometimes be argued outside the boundary. An assembler's ERP holds the bill of materials — which is the design, expressed as parts. Once controlled BOMs are loaded for purchasing and kitting, the ERP stores CUI, and it is in scope along with whoever administers it.
That matters most for hosted systems. If your MRP is a cloud subscription, the boundary now includes a service you do not run, and its provider becomes part of the story you tell an assessor about where controlled data lives.
The practical first week
List every package type you receive, every place a copy comes to rest, and every outside party you send one to. That list is your scope, your flow-down obligation, and most of your System Security Plan's first section — and it is a whiteboard exercise, not a purchase.