CMMCpedia
Work with me

Terms / What you protect

Controlled technical information (CTI)

Controlled technical information with military or space use. It is the CUI category most defense work produces, and it must carry distribution statement B to F.

Also called CTI, controlled technical info.

Official Source Material

Controlled technical information means technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. Controlled technical information would meet the criteria, if disseminated, for distribution statements B through F using the criteria set forth in DoD Instruction 5230.24, Distribution Statements on Technical Documents. The term does not include information that is lawfully publicly available without restrictions.

Source: 48 CFR 252.204-7012(a), eCFR text current as of September 17, 2026

Practitioner Guidance

What it means in practice

CTI is the category that puts most manufacturers at Level 2.

Controlled technical information is technical information with military or space application: drawings, specifications, process descriptions, test data, and the models behind them. If you machine parts, fabricate assemblies, or engineer to a Government print, this is the category you are most likely holding. It is defined in DFARS 252.204-7012, the clause that also imposes NIST SP 800-171.

A distribution statement is a clue, not the test.

The definition points at DoD Instruction 5230.24 and its distribution statements. CTI must carry statement B, C, D, E, or F, and never A, which means approved for public release. The reverse does not hold. The DoD CUI marking guide says a distribution statement does not by itself mean a document contains CUI. A print can carry statement D with no CUI authority behind it, and a document with no statement can still be CUI. Settle who owns the information and what the contract says first. Then read the statement as one piece of evidence about which authority applies.

Publicly available technical information is excluded, and that exclusion is narrow.

The definition excludes information lawfully publicly available without restrictions. A catalog page for a commercial fastener qualifies. A drawing you found on a supplier portal does not, because the portal restricted access. Test the exclusion against how the information became public, not against how easy it was for you to obtain.

Most CTI is also export-controlled, which raises the stakes beyond CMMC.

Technical information with military application usually falls under the International Traffic in Arms Regulations or the Export Administration Regulations. That makes it export-controlled information as well, and export rules carry personal criminal liability that CMMC does not. Treat a CTI determination as the start of two obligations, not one.

What falls short

  • A scoping decision that rests on distribution statements alone. The statement is one clue, and it cannot settle ownership or the controlling authority.
  • A shop sketch, traveler, or inspection report that copies dimensions or tolerances from the customer's print, treated as uncontrolled. Any document that reproduces the customer's technical data carries it forward and needs the same protection.
  • A toolpath that reproduces the customer's geometry, treated as uncontrolled because only the drawing carried a statement. Code that recreates the bores, hole pattern, or profile from the print is a copy of that data.

Edge cases

  • You created the design yourself, independently, with no Government funding or print. That work may be your own intellectual property rather than Controlled Unclassified Information, but it can still be export-controlled. Read both questions separately.
  • A document carries no distribution statement at all. Ask whoever sent it for the statement and the export classification. The absence of a statement is not an answer.
  • The technical information relates to a commercial product sold to a defense customer without modification. A commercially available off-the-shelf item is outside the program, but a modification made to a military specification usually is not.
  • A work instruction says only to machine the part "per the drawing" and repeats no dimensions. The reader still needs the drawing to act on it, so the instruction is not a copy of the controlled data.
  • Your shop wrote the machining method itself from a performance requirement, and the code does not reproduce the customer's geometry. That process knowledge is yours and sits outside the customer's controlled data. Answer the export question about it separately.
  • The data describes only fasteners. Fastener technical data is never CTI or export-controlled, however it arrives marked.

Over-engineering

  • A separate enclave for every program's technical data. One assessed environment with access separated by program meets the requirement, and export controls may add their own separation for specific programs.
  • A classification review of every legacy file before you scope. Scope the environment, then work through the archive inside it.