HOW TERAMIS WORKS
Turn Unknown CUI Sprawl Into Defensible Boundary Evidence.
Teramis examines approved data sources to identify potential Controlled Unclassified Information, validate findings, document the resulting CUI footprint, and monitor how that footprint changes over time.
Replace assumptions, incomplete inventories, and broad search results with technical findings that support more informed CMMC scoping and boundary decisions.
Replace interviews, assumptions, and incomplete inventories with technical evidence that supports more accurate CMMC scoping and boundary decisions.
Find the CUI you actually have. Prove the boundary. Monitor what changes.
CUI may also be located in:
When these locations are not examined, organizations may build a CMMC boundary around incomplete information.
That creates two opposing risks:
Over-scoping can increase licensing, infrastructure, consulting, control implementation, and assessment costs.
Under-scoping can leave CUI outside the documented boundary and create security gaps, assessment rework, and uncertainty around compliance representations.
Highlighted statement:
Before you define the boundary, establish the actual CUI footprint.
DISCOVERY TO CONTINUOUS VISIBILITY WITH THE TERAMIS WORKFLOW
The organization identifies the repositories, systems, data sources, and portions of the environment authorized for review.
This helps establish:
Teramis is deployed so scanning and analysis remain within the customer-controlled environment.
Its multi-agent architecture can support distributed and complex environments, including situations where data exists across separate repositories, networks, business units, or Microsoft 365 locations.
Key deployment principles:
Teramis materials identify in-environment deployment and multi-agent scanning as core differentiators, especially for organizations that do not want sensitive data transferred to a third-party discovery cloud.
Teramis examines supported files and repositories to identify content that may contain CUI.
The platform is purpose-built for CUI discovery rather than broad commercial data classification. It is designed to examine complex, technical, structured, unstructured, and visual content commonly found throughout the Defense Industrial Base.
Discovery may include approved sources such as:
The result is a more focused set of findings for review rather than an unfiltered collection of broad keyword matches.
Explore CUI Discovery
Discovery results must be reviewed and validated before they can support important boundary or compliance decisions.
Teramis uses review and sampling workflows to help confirm the precision of the findings and distinguish relevant CUI from unrelated content or false positives.
Validation helps teams:
A dashboard may suggest where CUI exists. Validation helps create evidence that can withstand scrutiny.
Validated findings are organized into outputs that help technical, compliance, executive, and advisory stakeholders understand the actual CUI footprint.
Teramis can support the production of:
The Teramis workflow is defined as Scan, Validate, Package, and Monitor. Its intended outputs include the CUI inventory, boundary proof, exceptions, delta reports, spillage reporting, and a monitoring trail.
Teramis identifies where CUI exists and which findings require attention. Internal administrators, security teams, compliance leaders, or approved service providers determine what happens next.
Possible next steps may include:
Teramis reports the findings. It does not make the customer’s operational, legal, or compliance decisions.
CUI is not static. New files are created, attachments are forwarded, project folders are copied, employees change roles, and systems evolve.
Recurring scans help identify:
Scan frequency can be aligned with the likelihood of change, operational importance, and the risk associated with each repository.
THE COMMERCIAL STORY
Discover candidate CUI across approved Microsoft 365 environments, file systems, endpoints, email, technical repositories, and supported file types.
Questions answered:
Validate findings and organize the evidence needed to compare the documented CMMC boundary with the actual data environment.
Questions answered:
Repeat the discovery process to detect new findings, movement, potential spillage, and changes to the CUI footprint.
Questions answered:
The Find, Prove, Monitor framework is the approved Teramis commercial story and should remain consistent across the website.
FROM RAW DATA TO ACTIONABLE EVIDENCE: WHAT TERAMIS PRODUCES
A structured view of discovered and validated CUI findings across the approved environment.
Information that helps teams understand which files, repositories, and locations require review.
Discovery output that can be compared with the documented CMMC scope, system diagrams, asset inventories, and approved CUI destinations.
A focused list of findings located outside expected or approved areas.
Sampling and review information that supports confidence in the discovery results.
A prioritized record of findings that administrators, security teams, or approved providers may need to investigate or address.
Results that show what changed between scans and where new or moved CUI may have appeared.
A historical record of recurring discovery activity and changes to the CUI footprint.
Keep the Stack. Add Defensible Evidence.
Teramis is not intended to replace every security, governance, compliance, or assessment platform in the environment.
It provides specialized CUI discovery and validation output that strengthens the tools and services already in use.
|
01
|
Inputs Data SourcesMicrosoft 365, file shares, endpoints, CAD repositories, scans, archives, email systems, and other approved sources. |
|
02
|
Specialized Ground Truth TeramisCUI discovery, validation, inventory, exceptions, boundary evidence, and recurring monitoring. |
|
03
|
Existing Tools Act on the Output Governance, Enforcement, and EvidenceLabels and Access GovernanceExisting tools may apply labels, manage permissions, review access, or govern collaboration. Policy and EnforcementDLP and security platforms may enforce rules, restrict movement, or prevent unauthorized activity. Compliance and Evidence ManagementGRC systems, advisors, and assessment teams may organize controls, documentation, findings, and assessment evidence. |
Teramis does not replace the security stack. It gives the stack a more defensible understanding of where CUI actually exists.
Teramis helps organizations:
Teramis does not:
One Workflow. Multiple High-Stakes Use Cases.
Identify the actual CUI footprint before defining systems, assets, users, and controls as part of the assessment boundary.
Compare the documented boundary with findings from the underlying data environment.
Provide file and location information that authorized administrators can use when preparing customer-led migration into approved environments.
Run recurring scans to identify CUI that appears outside approved locations.
Examine approved portions of affected systems to help determine whether candidate CUI may have been present.
Test whether representations about an organization’s CUI footprint align with the discovered environment.
A Shared Source of CUI Truth
Understand where CUI exists and which systems or files require closer review.
Compare technical findings with SSPs, asset inventories, policies, and documented boundaries.
Gain stronger evidence for decisions involving risk, investment, scope, and compliance representations.
Support scoping recommendations with technical findings rather than relying only on interviews and assumptions.
Create repeatable CUI discovery and monitoring services across customer environments.
Organize inventory, validation, exception, and monitoring information that may support assessment preparation.
Keep the Stack. Add Defensible Evidence.
Teramis is not intended to replace every security, governance, compliance, or assessment platform in the environment.
It provides specialized CUI discovery and validation output that strengthens the tools and services already in use.
|
01
|
Approved Inputs Data SourcesMicrosoft 365, file shares, endpoints, CAD repositories, scans, archives, email systems, and other approved sources. |
|
02
|
Specialized Ground Truth TeramisCUI discovery, validation, inventory, exceptions, boundary evidence, and recurring monitoring. |
Existing Tools Act on the Output
Existing tools may apply labels, manage permissions, review access, or govern collaboration.
DLP and security platforms may enforce rules, restrict movement, or prevent unauthorized activity.
GRC systems, advisors, and assessment teams may organize controls, documentation, findings, and assessment evidence.
See the Workflow in Action
See how Teramis examines approved data sources, validates findings, produces boundary evidence, and monitors what changes over time.
Start with a conversation about your environment, data sources, CMMC objectives, and current scoping questions.
