How to Protect CAD and Design Files Before You Sign a Vendor or Client Contract

Short answer: Protecting CAD files and design IP comes down to four things: know where every copy lives, limit who can open each project, control how files leave the firm, and write the rules into the contract before you sign. Do the first three before the contract talks start. Then you'll know what you can promise a client, and what you need a vendor to promise you.

Architecture and engineering firms work with large, valuable files that move a lot. Drawings and models go to consultants, contractors, clients and cloud platforms, and every hand-off is a place where control can slip. A long-term vendor contract, whether it's a cloud CAD platform, a file-sharing service or an outsourced drafting partner, can lock in how your files are handled for years. So settle the questions before you sign.

Where do your CAD and design files actually live?

You can't protect files you can't find. Before you review any contract, list every place project files sit:

• The office file server or NAS

• Cloud storage and sync folders (including personal sync folders on laptops)

• Cloud CAD or BIM collaboration platforms

• Email attachments and download links sent to consultants

• External drives and old project archives

CIS Controls v8.1 starts data protection the same way. Its Control 3 calls for a data inventory and data access control lists, so you know what sensitive data you have and who can reach it. For a design firm, "sensitive data" includes drawings, models, specs, bids and client site information.

Who should be able to open each project?

Most small firms give everyone access to everything on the file server, because it's easier. That also means one stolen password exposes every client's drawings.

Tighten it without slowing the studio down:

• Project-based access. People get the projects they work on, plus a shared library. Archives are read-only.

• MFA on everything that holds files. That means email, cloud storage, remote access and collaboration platforms.

• Same-day removal for leavers and finished consultants. Departing staff and outside collaborators lose access when the work ends, not months later.

• Separate admin accounts. Day-to-day accounts shouldn't be able to change permissions on every folder.

How do design files leave the firm, and how do you control it?

Files leave through normal work far more often than through a break-in. Controls that fit how design teams actually work:

• Share links that expire and are limited to named people, instead of open links or large email attachments.

• Alerts on unusual bulk downloads or mass sharing, especially right before someone resigns.

• A clear rule against personal email, personal cloud accounts and USB drives for project files, plus an approved fast way to send big files so people don't go around it.

• Encryption on laptops that carry project files to job sites.

If big files and a slow VPN are pushing people toward workarounds, fix the file access problem first. Our post on how engineering firms can fix file access without losing control covers that.

What should you settle before signing a long-term vendor contract?

When a vendor will store, process or touch your design files, ask these questions in writing before you sign. This is practical IT guidance, not legal advice. Have your own counsel review contract language.

1. Who owns the files? That includes drawings, models, revisions and anything the vendor's platform generates from them.

2. Where are the files stored, and who at the vendor has admin access? Ask about regions, subcontractors and support staff access.

3. What security controls does the vendor commit to? At minimum: MFA, encryption, logging and backups. Ask what evidence they can give you, such as an independent audit report.

4. Who must be told about a breach, and how? Get the notice duty in writing, and make sure it covers your files, not only the vendor's own systems.

5. Can you get everything out? Ask what export formats you get, whether revision history comes with it, and how long it takes.

6. What happens at the end? Return of data, deletion of copies, and written confirmation of deletion.

What should you settle before signing a client contract?

Clients, especially public agencies, utilities and defense-related owners, increasingly put data handling terms in design contracts. Before you sign, check that you can actually meet them:

• File handling requirements. Where files may be stored, who may see them, and whether consultants are bound by the same terms.

• Security requirements. These include MFA, encryption, background checks or a named framework. If the contract involves federal contract information, see our CMMC Level 1 self-assessment guide.

• Incident notice. How fast you must tell the client, and who in your firm makes that call.

• Return or destruction at closeout. This needs a real process, not a promise.

If you can't meet a term today, find out before you sign. Agreeing to controls you don't have is a bigger risk than negotiating the wording.

How does 24uNet help design firms protect their files?

24uNet works with engineering firms and architecture firms in the Denver area and Bryan–College Station. We map where your project files live, set up project-based access and MFA, and control how files leave the firm. Our Security Baseline is a written list of the controls we put in place and review with you, and it's built to support the client and vendor questions above. We can also look at your network and remote access through a network security review.

FAQ

What's the first step to protecting CAD files at a small firm?

Make a list of every place project files are stored, including laptops, sync folders and cloud platforms. Access rules and contracts only work once you know where the files are.

Should every employee have access to every project?

Usually not. Project-based access with a shared library and read-only archives keeps the studio moving and limits what one stolen password can expose.

What should I ask a cloud CAD or file-sharing vendor before signing?

Ask who owns the files, where they're stored, who has admin access, what security controls are committed in writing, how breach notice works, how you export everything, and how data is deleted at the end.

How do we send large drawing sets securely?

Use named, expiring share links from an approved platform, not open links, personal accounts or USB drives. Make the approved way easy so people don't work around it.

Is this legal advice?

No. This is practical IT and security guidance. Have your attorney review contract language.

Talk to 24uNet about protecting your design files

Want a second look at where your CAD files live and who can reach them before your next contract? Call us at Denver (303) 468-5515 or College Station (979) 256-5100, email sales@24unet.com, or book a network security review.

---

Sources: CIS Critical Security Controls v8.1, Control 3 (Data Protection): https://www.cisecurity.org/controls/v8-1

ABOUT THE AUTHOR

Dane Gray — Cofounder, 24uNet. 30+ years in IT and cybersecurity. CMMC-AB Registered Practitioner, CompTIA Security+, CEH. Texas A&M '91. Dane Gray on LinkedIn.