Key Insights:
Access flips to exception-based: Every drawing, contract, and RFI starts restricted, and each grant leaves a record an owner may request.
Permission depth beats project-level control: FAR 52.204-21 sets that floor, naming both the authorized users and the exact functions each one may perform, not just project-level access.
Distribution controls extend past permissions: Watermarking, view-only rights, and segmented bid packages govern what happens after a file opens.
Flow-down is your responsibility: Primes get no visibility into a subcontractor's CMMC standing from the Defense Department itself, so confirming it before work begins falls on you.
Export rules reach your drawings: Under International Traffic in Arms Regulations (ITAR), showing controlled technical data to a foreign national counts as an export, even if it never leaves your building.
Confidentiality has moved from a niche requirement to a standing condition of commercial construction. US private data center construction reached a $50.7 billion annualized rate in April 2026, passing conventional office construction for the first time, and owners in that segment routinely impose nondisclosure terms before the first submittal moves. Defense work, hospital expansions, and pharmaceutical plants bring the same conditions, and all of them put document control to the test.
What follows explains how contractors run document control when an owner treats every drawing as a protected asset. It covers permission design, distribution controls, subcontractor flow-down, and what survives closeout.
Why Do Confidential Projects Break Standard Document Control?
Standard document control assumes openness. You set up the project, invite the team, and anyone with a login reaches the drawing set, the request for information (RFI) log, and the submittal register. Confidential work inverts that default. Access becomes something you grant on purpose, and every grant leaves a record someone may later ask you to produce.
Confidentiality arrives from several directions at once, and the source dictates how tightly you lock things down. Four drivers show up repeatedly on commercial work:
Contractual secrecy: Owner agreements covering tenant identity, deal terms, or unannounced expansion, often running years past closeout.
Regulatory control: Federal work governed by the controlled unclassified information (CUI) program, the Federal Acquisition Regulation (FAR) basic safeguarding clause, and Cybersecurity Maturity Model Certification (CMMC) levels tied to award.
Competitive protection: Data center and manufacturing owners guarding cooling design, process layouts, and equipment specifications from rivals.
Physical security: Drawings exposing camera placement, access control points, egress routes, or utility entry on a finished facility.
The regulatory driver carries the sharpest teeth. CMMC took effect in December 2024 under 32 CFR Part 170, and the acquisition clause implementing it began appearing in solicitations in November 2025, making a current certification a condition of contract award. Healthcare work brings a parallel obligation, since the HIPAA Security Rule requires audit controls that record and examine access to systems holding electronic health information.
Permission Depth and Where Access Leaks
Permission models fail in two recurring ways, and both trace to how the underlying system stores information.
The first is shallow permissions. A contractor grants access at the project level, then an owner asks for proof that one superintendent never opened the security drawing package. Project-level control answers half that question. Confidential work needs permissions reaching the document type, the folder, and the individual record.
FAR 52.204-21 states the principle plainly, requiring contractors to limit system access to authorized users and to the specific transactions and functions those users may execute.
The second is tool sprawl. Separate applications for accounting, drawings, and field reporting each maintain their own user lists. Someone leaves the company, IT revokes three credentials, and the fourth stays live for months. A single database platform closes that gap, because financial and project information sit in one system of record. One identity governs reach across the whole picture, so revoking access happens once and holds everywhere.
Depth and consolidation matter more once portfolio-wide visibility becomes the exposure you manage.
How John Burns Construction Limits Access by Role
John Burns Construction Company, a general contractor delivering complex infrastructure across freight rail, power and utilities, data centers, transit, and telecommunications, hit this problem when growth outpaced its legacy systems.
Its CMiC security model keeps project managers focused on their assigned jobs, and designated super users retain full portfolio visibility. Each project manager works from a role-specific menu carrying dedicated reports for job cost, labor, equipment, and material and subcontractor costs. That separation limits how far a single compromised login travels.
Controlling Distribution and Preserving the Record
Permissions decide who can open a file. Distribution controls decide what happens to it afterward.
Several measures do that work. View-only rights with download disabled keep a restricted set inside the platform. Dynamic watermarking stamps the recipient's name and a timestamp on every rendered page, so a photographed screen traces back to one person. Redacted or segmented bid packages give each trade the scope it prices without handing over the full facility layout. A controlled-copy register records who holds which revision.
ISO 19650-5 formalizes the thinking behind these choices, setting out a sensitivity assessment that determines which security measures apply to a project's information before delivery begins.
The trail matters as much as the controls. Version control with superseded revisions retained and time-stamped lets you reconstruct what was live on any given day. Annotations linked to RFIs tie a markup to the decision behind it. When a change order or subcontract executes inside the platform, signer identity and timing attach to the record. Documents sent as email attachments scatter that evidence across inboxes nobody controls.
Retention closes the loop. Owner agreements frequently extend years past turnover, so the record has to survive intact and stay controlled. Apply the retention terms written into the contract, since some owners require destruction of specific packages and others require preservation for a fixed period. Preserve the audit history alongside the documents, because a dispute arriving three years later depends on evidence you cannot recreate.
Flow-down, Foreign Access, and Subcontractor Scoping
Trade partners create the widest exposure. They need current drawings, RFI responses, and pay application access. They have no business reaching budget detail, other trades' contracts, or unrelated projects in your portfolio.Collaboration tools that invite subcontractors as scoped participants handle this, and the record of what each collaborator reached stays inside the platform. Revoke those credentials as trades demobilize, without waiting for a portfolio cleanup months later.
Federal work makes the obligation explicit. FAR 52.204-21 requires you to include the substance of the safeguarding clause in subcontracts where federal contract information will reside on a subcontractor's system.
CMMC flows down the same way, and the Defense Department has confirmed it will not share subcontractor certification status with primes, leaving verification in your hands. ITAR adds a nationality test, treating disclosure of controlled technical data to a foreign person as an export whether that person sits overseas or inside your own office.
Contractors working this market daily show what the operating model looks like.
How MW Services Handles Federal Document Control
MW Services Inc., a Temecula, California engineering and construction business, delivers multi-year job order and indefinite-delivery contracts for the federal government, with work ranging from renovations to highly technical classified buildings. Every contract runs with a project manager, administrative support, and several dozen subcontractor partners.
The company consolidated accounting, job costing, and payroll on CMiC, then moved document control, drawing management, and change management onto the same platform while developing its CMMC policies and procedures.
Document Control That Holds up under Scrutiny
Confidential work rewards contractors who treat permissions, distribution, and retention as one connected system. Separate tools for drawings, accounting, and field records leave gaps that owner reviews find quickly. A single database platform closes them, giving you one identity, one permission model, and one audit history across the project record.
The Naval Facilities Engineering Command runs its Electronic Construction and Facility Support Contract Management System on CMiC, and one-quarter of the contractors on the ENR Top 400 list operate on the same platform.[C8]
Sources: