The CUI tripwire: when drawings push a shop from Level 1 to Level 2
Drawings for defense tooling are very often controlled technical data, which counts as Controlled Unclassified Information. The moment CUI enters the picture, a Level 1 self-assessment no longer satisfies the requirement.
What counts as CUI here
Controlled technical data includes designs, drawings, and specifications that describe how to develop, produce, or maintain a defense article. If the drawings you work with show how a defense tool is made, they are strong candidates for CUI. A tool list, by contrast, usually just says which tools live in which tray slots. It does not describe how to design or build anything, so it is not normally the thing that makes data CUI.
Who decides
The customer or prime marks the data. Markings govern. If your customer marks the drawings as controlled, treat them as CUI regardless of your own reading. If the tool list is marked, treat that as controlled too. When nothing is marked and you are unsure, ask the prime's security contact which bucket each artifact sits in, and get the answer in writing before you bid.
What changes at Level 2
Level 2 means 110 practices aligned to NIST SP 800-171 and, for most contracts, an assessment by an accredited third party (C3PAO) on a three-year cycle. That is a different effort and a different budget from a Level 1 self-assessment. Settle the CUI question first, then pick the lane. Spending on the wrong level is the most expensive mistake a small shop can make here.
Educational guide, not legal or compliance advice. CUI determinations depend on your contract and the data markings; confirm with the prime or a qualified advisor.