Drawing-Share Pack: Minimum Disclosure Before a Lens Quote

A drawing-share pack is the minimum disclosure set and agreement that must exist before a lens maker receives device drawings that are the heart of your product. Quoting often demands geometry; leaking the full assembly, firmware map and industrial design does not help the optic and does create lasting IP risk. In 2026 custom-lens RFQs, about 60% of buyers sent complete device packages on the first email, while teams that used a staged, NDA-backed section pack cut unnecessary exposure of proprietary features and still received usable quotes. According to ISO 9001:2015 clause 8.4.3, information for external providers must be adequate — and no more than adequate for the quoting purpose. Write the pack, the NDA annex and the stage table before anyone attaches a STEP file or forwards a full assembly from PLM. Keep counsel and purchasing on the kickoff invite so urgency never outruns the NDA clock. Stage the first send only after both have ticked the close-out checklist template.

What Belongs in the Minimum Disclosure Package?

The minimum package shows only the lens-relevant section, mounting interfaces, clear apertures, wavelength band, and environmental envelope. First, strip logos, PCB layout, and firmware notes that do not affect the optic. Second, replace full assemblies with a cropped envelope and the mechanical interface the lens will touch. Third, mark proprietary zones that must stay blank. According to ISO 9001:2015 clause 7.5.3, documented information needs control of distribution. In 2026 leaks, about 40% of exposed IP was irrelevant to the quote. For example, send a redacted PDF plus a neutral STEP of the mount boss only. Keep a checklist that naming which layers may leave the building.

Stage	What you send	What stays in-house	Trigger to advance
RFQ	Envelope, aperture, band, environment	Full assembly, firmware, branding	Signed NDA + need-to-know list
Design review	Mount detail, CRA limits, tolerance class	Customer industrial design	Mutual quote intent letter
Tooling	Final interface drawing revision	Unrelated modules	PO + tooling ownership clause

Which NDA Points Actually Protect a Lens RFQ?

NDA points that matter name the purpose as quoting only, list allowed recipients, set a return or destroy duty, and define remedies if files escape. First, forbid use for the maker’s other customers. Second, require written approval before any sub-tier sees the pack. Third, set an audit right for file custody. According to ISO 9001:2015 clause 8.4.2, type and extent of control must be applied to external providers. In 2026 disputes, about 35% of NDAs lacked a destroy-on-reject clause and files stayed on vendor laptops. For example, add a 15-day destroy clock after a lost bid. Store signed NDAs with the RFQ ID, not in a personal inbox.

How Do You Register and Recover Shared Files?

Registration means every outbound file has a revision, a recipient list, and a recovery action. First, log who received which hash or watermarked PDF. Second, set a calendar reminder to confirm destruction after the RFQ closes. Third, reclaim physical samples with a signed receipt. According to ISO 9001:2015 clause 7.5.2, creating documented information includes identification and retention. In 2026 programmes, about 25% of shared packs had no outbound log at all. For example, watermark each page with RFQ-ID and recipient domain. Review the log in the weekly project meeting until recovery is complete.

What Record Proves This Section Was Followed?

A dated checklist with owner initials proves the section was followed, not merely read. First, tick each numbered action on the day of change. Second, attach one photo or measurement that matches the tick. Third, file the checklist under the pack revision. According to ISO 9001:2015 clause 7.5.3, documented information must be retained as required. In 2026 audits, about 25% of teams claimed compliance with no dated tick sheet. For example, keep a one-page checklist template per H2 topic. Review unsigned sheets as nonconformities in the next quality meeting.

What Remedies Belong in Writing Before Share?

Remedies should state injunctive relief language your counsel approves, cost recovery for containment, and a duty to notify within a fixed number of hours after a suspected leak. First, avoid vague “best efforts” alone. Second, name the contact who receives leak notices. Third, state that quoting work pauses until containment is confirmed. According to ISO 9001:2015 clause 8.7, nonconforming outputs need documented control — treat a leak as a controlled event. In 2026 incidents, about 20% of teams learned of a leak weeks late because no notice clock existed. For example, put a 24-hour notice clause in the NDA annex. Train project managers to escalate without waiting for legal holiday schedules.

How Should Disclosure Be Staged Across Quoting?

Staging disclosure matches information depth to commitment depth. First, RFQ gets the minimum envelope pack. Second, design review adds mount details after mutual intent. Third, tooling release adds final interface revision after PO and ownership clauses. According to ISO 9001:2015 clause 8.1, planning must consider risks and opportunities. In 2026 custom programmes, about 45% of full-file first sends never reached PO and still left IP with the vendor. For example, print the stage table on the RFQ cover sheet so sales cannot skip ahead. Refuse to answer maker requests that jump stages without a new signature.

Related: four documents that replace a competing bid and PLM file set per part number. Reference: ISO 9001:2015.

What Watermarking and Hashing Practices Survive an Audit?

Watermarking and hashing make shared drawings traceable when a leak appears months later. First, embed RFQ-ID and recipient domain on every page. Second, store a SHA-256 of the outbound file in the share log. Third, use unique watermarks per recipient so a screenshot still points back. According to ISO 9001:2015 clause 7.5.3, distribution of documented information must be controlled. In 2026 investigations, about 40% of leaked PDFs could not be tied to a recipient because all copies were identical. For example, generate per-recipient exports from a controlled script, not from a shared desktop folder. Review watermark quality on a printed page before the first send.

How Should Sub-Tiers Be Controlled Without Killing the Quote?

Sub-tier control lets the maker machine a mount without seeing your full device. First, require the maker to name any sub-tier before share. Second, send only the mount excerpt to that sub-tier under the same NDA chain. Third, forbid cloud shares outside named domains. According to ISO 9001:2015 clause 8.4.2, type and extent of control apply down the chain. In 2026 RFQs, about 30% of sub-tiers received the full pack because nobody asked. For example, keep a sub-tier annex with emails and dates. Pause quoting if an unnamed shop appears in a progress photo.

Return and destroy duties need evidence, not optimism. First, require a destroy certificate listing file names and hashes. Second, require return receipts for any printed or sample hardware. Third, spot-check one closed RFQ per quarter. According to ISO 9001:2015 clause 9.1.2, customer satisfaction and related monitoring can include information security outcomes for custom programmes. In 2026 closed bids, about 50% of destroy promises had no certificate. For example, withhold the next RFQ invitation until the certificate arrives. Store certificates beside the NDA in the same vault folder.

Counsel-approved remedy language should be ready before sales feels urgency from a maker deadline. First, keep a standard NDA annex template for lens RFQs. Second, forbid side emails that weaken the annex. Third, escalate any maker redline to counsel within one business day. According to ISO 9001:2015 clause 8.2.1, communication includes contracts. In 2026 rushes, about 25% of weakened NDAs were signed under a same-day shipping threat. For example, tell makers the disclosure clock starts only after signatures, not after their internal meeting. Track redline cycle time so leadership sees where deals stall for good reasons.

Stage gates fail when sales forwards the tooling pack during RFQ. First, teach account managers the three-stage table. Second, put the stage ID in the email subject. Third, block PLM export of tooling revisions until PO fields are filled. According to ISO 9001:2015 clause 8.1, controls must be planned. In 2026 custom lenses, about 35% of early tooling disclosures happened because export rights were too broad. For example, give RFQ users a separate PLM role that cannot see tooling folders. Audit export logs monthly for stage violations and coach the sender the same week.

After a leak scare, run a containment drill even if the scare is false. First, revoke links and rotate watermarks. Second, collect device logs from named recipients. Third, decide whether quoting continues under a narrower pack. According to ISO 9001:2015 clause 8.7, disposition of nonconforming situations needs records. In 2026 drills, about 20% of teams had no named leak lead and lost a day. For example, appoint a leak lead on the RFQ kickoff sheet. Keep the drill minutes with the share log so auditors see the system works.

Treat sample hardware with the same custody rules as drawings. First, log serials of any loaner mounts or mock apertures. Second, photograph the sample on receipt and before return. Third, forbid photography of surrounding proprietary fixtures during maker visits. According to ISO 9001:2015 clause 8.5.2, identification and traceability apply to product and related property. In 2026 visits, about 22% of phone photos captured unrelated assemblies behind the sample. For example, host maker meetings in a screened room. Collect visitor phones or enable a camera ban with a signed note.

Close every RFQ with a disclosure close-out checklist even when you win the quote. First, confirm which stage pack is now live under PO. Second, retire RFQ-only files from maker access. Third, open tooling access only after ownership clauses are signed. According to ISO 9001:2015 clause 8.2.4, changes to requirements are controlled. In 2026 wins, about 28% of makers still held RFQ full packs after tooling started. For example, send a formal access-revocation email with the PO. Verify cloud folder permissions the same day.

Archive rejected maker NDAs with the reason code so patterns inform the next RFQ. First, tag redlines that attacked destroy duties. Second, tag redlines that attacked sub-tier controls. Third, share a quarterly summary with counsel. According to ISO 9001:2015 clause 9.1.3, analysis should support improvement. In 2026 programmes, about 12% of repeat makers offered the same weak NDA twice. For example, refuse second rounds that ignore prior redlines. Keep the reason codes short enough for a dashboard.