--- title: How Teramis Works | CUI Discovery and Validation description: See how Teramis discovers CUI, validates findings, produces defensible boundary evidence, and monitors for movement and spillage over time. --- [Skip to content](https://teramis.us/company/how-teramis-works#main-content) [![Teramis Logo](https://teramis.us/hs-fs/hubfs/Untitled%20design%20-%202026-07-20T135654.427.png?width=3000&height=2000&name=Untitled%20design%20-%202026-07-20T135654.427.png)Homepage](https://teramis.us?hsLang=en-us) - [Home](https://teramis.us?hsLang=en-us) - [Platform](https://teramis.us/platform?hsLang=en-us) - [How Teramis Works](https://teramis.us/company/how-teramis-works) - [CUI Discovery](https://teramis.us/platform/cui-discovery?hsLang=en-us) - [Evidence & Validation](https://teramis.us/platform/evidence-validation?hsLang=en-us) - [Ongoing Monitoring](https://teramis.us/platform/ongoing-cui-monitoring?hsLang=en-us) - [Remediation](https://teramis.us/platform/remediation?hsLang=en-us) - [Deployment & Data Sources](https://teramis.us/platform/deployment-and-data-sources?hsLang=en-us) - [Who We Help](https://teramis.us/who-we-help?hsLang=en-us) - [Solutions](https://teramis.us/solutions?hsLang=en-us) - By Decision - [CUI Scoping](https://teramis.us/solutions/cmmc-scoping?hsLang=en-us) - [CUI Boundary Validation](https://teramis.us/solutions/cui-boundary-validation?hsLang=en-us) - [CUI Remediation & Spillage Monitoring](https://teramis.us/solutions/cui-remediation-spillage-monitoring?hsLang=en-us) - [Migration Support](https://teramis.us/solutions/migration-support?hsLang=en-us) - [Post-Incident CUI Scoping](https://teramis.us/solutions/post-incident-cui-scoping-and-discovery-teramis?hsLang=en-us) - [Supply Chain and M&A](https://teramis.us/solutions/supply-chain-ma?hsLang=en-us) - By Organization - [Small Business](https://teramis.us/solutions/by-organization/small-business?hsLang=en-us) - [Enterprise](https://teramis.us/solutions/by-organization/enterprise?hsLang=en-us) - [Government](https://teramis.us/solutions/government-agencies?hsLang=en-us) - [Compliance Advisors](https://teramis.us/solutions/by-organization/compliance-advisors?hsLang=en-us) - [Partners](https://teramis.us/partners?hsLang=en-us) - [Partner Program](https://teramis.us/partners/partner-program?hsLang=en-us) - [Partner Resources](https://teramis.us/partners/partner-resources?hsLang=en-us) - [Who We Partner With](https://teramis.us/partners/who-we-partner-with?hsLang=en-us) - [Partner MSPs & MSSPs](https://teramis.us/partners/who-we-partner-with?hsLang=en-us#MSPs-MSSPs) - [Compliance Advisors & Consultants](https://teramis.us/partners/who-we-partner-with?hsLang=en-us#CMMCAdvisoryandRPOs) - [GRC and Enclave Providers](https://teramis.us/partners/who-we-partner-with?hsLang=en-us#GRC-EnclaveProviders) - [Technology Partners](https://teramis.us/partners/who-we-partner-with?hsLang=en-us#TechnologyPartners) - [Become a Partner](https://teramis.us/partners/become-a-partner?hsLang=en-us) - [Resources](https://teramis.us/resources?hsLang=en-us) - [FAQ](https://teramis.us/resources/faqs?hsLang=en-us) - [Videos & Webinars](https://teramis.us/resources/videos-webinars?hsLang=en-us) - [Resource Library & Downloads](https://teramis.us/resources/library?hsLang=en-us) - [Blog](https://teramis.us/teramis-blog?hsLang=en-us) - [Company](https://teramis.us/company?hsLang=en-us) - [About Us](https://teramis.us/company/about?hsLang=en-us) - [Use Cases](https://teramis.us/use-cases?hsLang=en-us) - [FAQ](https://teramis.us/resources/faqs?hsLang=en-us) - [Careers](https://teramis.us/company/careers?hsLang=en-us) - [Contact](https://teramis.us/contact-us?hsLang=en-us) [Request Demo](https://teramis.us/request-a-demo?hsLang=en-us) - [Home](https://teramis.us?hsLang=en-us) - [Platform](https://teramis.us/platform?hsLang=en-us) - [How Teramis Works](https://teramis.us/company/how-teramis-works) - [CUI Discovery](https://teramis.us/platform/cui-discovery?hsLang=en-us) - [Evidence & Validation](https://teramis.us/platform/evidence-validation?hsLang=en-us) - [Ongoing Monitoring](https://teramis.us/platform/ongoing-cui-monitoring?hsLang=en-us) - [Remediation](https://teramis.us/platform/remediation?hsLang=en-us) - [Deployment & Data Sources](https://teramis.us/platform/deployment-and-data-sources?hsLang=en-us) - [Who We Help](https://teramis.us/who-we-help?hsLang=en-us) - [Solutions](https://teramis.us/solutions?hsLang=en-us) - By Decision - [CUI Scoping](https://teramis.us/solutions/cmmc-scoping?hsLang=en-us) - [CUI Boundary Validation](https://teramis.us/solutions/cui-boundary-validation?hsLang=en-us) - [CUI Remediation & Spillage Monitoring](https://teramis.us/solutions/cui-remediation-spillage-monitoring?hsLang=en-us) - [Migration Support](https://teramis.us/solutions/migration-support?hsLang=en-us) - [Post-Incident CUI Scoping](https://teramis.us/solutions/post-incident-cui-scoping-and-discovery-teramis?hsLang=en-us) - [Supply Chain and M&A](https://teramis.us/solutions/supply-chain-ma?hsLang=en-us) - By Organization - [Small Business](https://teramis.us/solutions/by-organization/small-business?hsLang=en-us) - [Enterprise](https://teramis.us/solutions/by-organization/enterprise?hsLang=en-us) - [Government](https://teramis.us/solutions/government-agencies?hsLang=en-us) - [Compliance Advisors](https://teramis.us/solutions/by-organization/compliance-advisors?hsLang=en-us) - [Partners](https://teramis.us/partners?hsLang=en-us) - [Partner Program](https://teramis.us/partners/partner-program?hsLang=en-us) - [Partner Resources](https://teramis.us/partners/partner-resources?hsLang=en-us) - [Who We Partner With](https://teramis.us/partners/who-we-partner-with?hsLang=en-us) - [Partner MSPs & MSSPs](https://teramis.us/partners/who-we-partner-with?hsLang=en-us#MSPs-MSSPs) - [Compliance Advisors & Consultants](https://teramis.us/partners/who-we-partner-with?hsLang=en-us#CMMCAdvisoryandRPOs) - [GRC and Enclave Providers](https://teramis.us/partners/who-we-partner-with?hsLang=en-us#GRC-EnclaveProviders) - [Technology Partners](https://teramis.us/partners/who-we-partner-with?hsLang=en-us#TechnologyPartners) - [Become a Partner](https://teramis.us/partners/become-a-partner?hsLang=en-us) - [Resources](https://teramis.us/resources?hsLang=en-us) - [FAQ](https://teramis.us/resources/faqs?hsLang=en-us) - [Videos & Webinars](https://teramis.us/resources/videos-webinars?hsLang=en-us) - [Resource Library & Downloads](https://teramis.us/resources/library?hsLang=en-us) - [Blog](https://teramis.us/teramis-blog?hsLang=en-us) - [Company](https://teramis.us/company?hsLang=en-us) - [About Us](https://teramis.us/company/about?hsLang=en-us) - [Use Cases](https://teramis.us/use-cases?hsLang=en-us) - [FAQ](https://teramis.us/resources/faqs?hsLang=en-us) - [Careers](https://teramis.us/company/careers?hsLang=en-us) - [Contact](https://teramis.us/contact-us?hsLang=en-us) [Request Demo](https://teramis.us/request-a-demo?hsLang=en-us)   HOW TERAMIS WORKS # Find the CUI. Validate the Boundary. Monitor What Changes **Turn Unknown CUI Sprawl Into Defensible Boundary Evidence.** Teramis examines supported data sources to identify potential Controlled Unclassified Information, validate findings, document the resulting CUI footprint, and monitor how that footprint changes over time.  Replace interviews, assumptions, and incomplete inventories with technical evidence that supports more accurate CUI scoping and boundary decisions.  [Request a Demo](https://teramis.us/request-a-demo?hsLang=en-us) **Find the CUI you actually have. Prove the boundary. Monitor what changes.** ## **A Documented Boundary Does Not Always Match the Data Environment** Policies, system diagrams, asset inventories, and employee interviews describe where CUI is expected to exist. They do not necessarily prove where it is stored across the organization. CUI may also be located in: - Microsoft 365 repositories - Network file shares - Email and attachments - Local or distributed endpoints - Engineering and CAD repositories - PDFs and scanned documents - Archives and legacy project folders - Other approved cloud, hybrid, or on-premises systems ![Teramis Intro Animation](https://teramis.us/hs-fs/hubfs/Teramis%20Intro%20Animation.gif?width=650&height=366&name=Teramis%20Intro%20Animation.gif "Teramis Intro Animation") When these locations are not examined, organizations may build a CUI boundary around incomplete information.  That creates two opposing risks: - **Over-scoping** can increase licensing, infrastructure, consulting, control implementation, and assessment costs. - **Under-scoping** can leave CUI outside the documented boundary and create security gaps, assessment rework, and uncertainty around compliance representations. **Before you define the boundary, establish the actual CUI footprint.** --- DISCOVERY TO CONTINUOUS VISIBILITY WITH THE TERAMIS WORKFLOW ## **How Teramis Creates CUI Evidence** 1\. Define the Approved Discovery Scope The organization identifies the repositories, systems, data sources, and portions of the environment authorized for review. This helps establish: - Which systems will be examined - Which repositories are included - Which business units or projects are relevant - Where CUI is expected to reside - Which locations should remain outside the approved boundary - What questions the discovery effort must answer 2\. Deploy Within the Customer Environment Teramis is deployed so scanning and analysis remain within the customer-controlled environment. Its multi-agent architecture can support distributed and complex environments, including situations where data exists across separate repositories, networks, business units, or Microsoft 365 locations. **Key deployment principles:** - Scanning remains under customer control - Sensitive files do not need to be uploaded to an external discovery service - Supported repositories can be examined where they reside - Multiple scanning agents can support larger or distributed environments - Discovery can be limited to the authorized scope Teramis materials identify in-environment deployment and multi-agent scanning as core differentiators, especially for organizations that do not want sensitive data transferred to a third-party discovery cloud. 3\. Scan and Identify Candidate CUI Teramis examines supported files and repositories to identify content that may contain CUI. The platform is purpose-built for CUI discovery rather than broad commercial data classification. It is designed to examine complex, technical, structured, unstructured, and visual content commonly found throughout the Defense Industrial Base. Discovery may include supported sources such as: - SharePoint - OneDrive - Exchange - Network file shares - Endpoints - Email systems - CAD and engineering repositories - PDFs - Images and scanned documents - Archives - Legacy storage environments - Other supported repositories The result is a more focused set of findings for review rather than an unfiltered collection of broad keyword matches. [Explore CUI Discovery](https://teramis.us/cui-discovery-readiness-assessment-teramis?hsLang=en-us) 4\. Validate the Findings Discovery results must be reviewed and validated before they can support important boundary or compliance decisions. Teramis uses review and sampling workflows to help confirm the precision of the findings and distinguish relevant CUI from unrelated content or false positives. Validation helps teams: - Confirm whether candidate findings are relevant - Review classifications and categories - Evaluate representative samples - Understand where findings are concentrated - Identify exceptions requiring closer review - Improve confidence in the resulting CUI inventory **A dashboard may suggest where CUI exists. Validation helps create evidence that can withstand scrutiny.** 5\. Package the Evidence Validated findings are organized into outputs that help technical, compliance, executive, and advisory stakeholders understand the actual CUI footprint. Teramis can support the production of: - CUI inventory information - File-level findings - Repository and location details - Boundary evidence - Exception lists - Validation and sampling output - Findings requiring customer action - Spillage reports - Delta reports - Monitoring history - Self-attestation and compliance evidence The Teramis workflow is defined as Scan, Validate, Package, and Monitor. Its intended outputs include the CUI inventory, boundary proof, exceptions, delta reports, spillage reporting, and a monitoring trail. 6\. Review and Assign Next Steps Teramis identifies where CUI exists and which findings require attention. Internal administrators, security teams, compliance leaders, or approved service providers determine what happens next. Possible next steps may include: - Confirming whether a file belongs in the approved boundary - Reviewing access or storage locations - Investigating an unexpected finding - Updating scope documentation - Planning and executing CUI migration - Assigning action to an internal administrator - Updating an SSP, asset inventory, or boundary diagram - Scheduling a follow-up scan Teramis reports findings and carries out approved remediation. It does not make the customer’s legal or compliance decisions.  7\. Re-Scan and Monitor What Changes CUI is not static. New files are created, attachments are forwarded, project folders are copied, employees change roles, and systems evolve. Recurring scans help identify: - New CUI findings - Changes since the previous scan - CUI appearing outside supported locations - Potential spillage - Boundary drift - Reappearance of previously addressed findings - Repositories requiring additional review Scan frequency can be aligned with the likelihood of change, operational importance, and the risk associated with each repository. [Explore Continuous Monitoring](https://teramis.us/platform/continuous-cui-monitoring?hsLang=en-us) ## **One Platform. Three Essential Outcomes.** ### Find Discover candidate CUI across approved Microsoft 365 environments, file systems, endpoints, email, technical repositories, and supported file types. **Questions answered:** - Where does CUI exist? - Which repositories contain it? - Which files require review? - Is CUI located outside expected systems? - What may belong inside the documented boundary? ### Prove Validate findings and organize the evidence needed to compare the documented CUI boundary with the actual data environment.  **Questions answered:** - Does the documented boundary match reality? - Which findings support the current scope? - What exceptions require investigation? - What evidence can support an internal review? - What information may be relevant during assessment preparation? ### Monitor Repeat the discovery process to detect new findings, movement, potential spillage, and changes to the CUI footprint. **Questions answered:** - Has new CUI appeared? - Has CUI moved outside approved locations? - What changed since the previous scan? - Is the boundary beginning to drift? - Which findings require follow-up? The **Find, Prove, Monitor** framework is the approved Teramis commercial story and should remain consistent across the website.       FROM RAW DATA TO ACTIONABLE EVIDENCE: WHAT TERAMIS PRODUCES ## **Give Every Stakeholder a Clearer View of the CUI Footprint** ### CUI Inventory A structured view of discovered and validated CUI findings across the environment where it lives. ### File-Level Findings Information that helps teams understand which files, repositories, and locations require review. ### Boundary Evidence Discovery output that can be compared with the documented CUI scope, system diagrams, asset inventories, and approved CUI destinations. ### Exception Reporting A focused list of findings located outside expected or approved areas. ### Output Validation Sampling and review information that supports confidence in the discovery results. ### Customer Action Queue A prioritized record of findings that administrators, security teams, or approved providers may need to investigate or address. ### Delta and Spillage Reports Results that show what changed between scans and where new or moved CUI may have appeared. ### Monitoring Trail A historical record of recurring discovery activity and changes to the CUI footprint. #### A PRECISE ROLE IN THE CUI WORKFLOW ## **What Teramis Does** Teramis helps organizations: - Discover candidate CUI - Categorize and catalog findings - Validate discovery results - Identify file and repository locations - Produce CUI inventory information - Document boundary exceptions - Compare results between scans - Monitor for movement and potential spillage - Provide evidence that supports NIST SP 800-171 planning, self-assessment, and review ## **What Teramis Does Not Do** Teramis does not: - Move files - Tag files - Quarantine files - Delete files - Remediate files - Alter discovered content - Make legal reporting decisions - Replace a formal assessment or government review - Guarantee a compliance, assessment, or audit outcome One Workflow. Multiple High-Stakes Use Cases. ## Apply CUI Discovery Evidence Across the Compliance Lifecycle 01 ### CUI Scoping Identify the actual CUI footprint before defining systems, assets, users, and controls as part of the assessment boundary. 02 ### CUI Boundary Validation Compare the documented boundary with findings from the underlying data environment. 03 ### CUI Migration Support Identify the files and locations that need to move, then move approved CUI into authorized destinations with verified transfers through Remedius.  04 ### Ongoing CUI Spillage Management Run recurring scans to identify CUI that appears outside approved locations. 05 ### Post-Breach CUI Impact Assessment Examine approved portions of affected systems to help determine whether candidate CUI may have been present. 06 ### Supply Chain and M&A Risk Review Test whether representations about an organization’s CUI footprint align with the discovered environment. [Explore Teramis Solutions](https://teramis.us/solutions?hsLang=en-us) A Shared Source of CUI Truth ## Support Technical, Compliance, Executive, and Partner Decisions 01 ### Security and IT Teams Understand where CUI exists and which systems or files require closer review. 02 ### Compliance and GRC Teams Compare technical findings with SSPs, asset inventories, policies, and documented boundaries. 03 ### Executive Leadership Gain stronger evidence for decisions involving risk, investment, scope, and compliance representations. 04 ### Compliance Advisors and Consultants Support scoping recommendations with technical findings rather than relying only on interviews and assumptions. 05 ### MSPs and MSSPs Create repeatable CUI discovery and monitoring services across customer environments. 06 ### Self-Attestation and Compliance Teams Organize inventory, validation, exception, and monitoring information that may support assessment preparation. Keep the Stack. Add Defensible Evidence. ## Teramis Provides Ground Truth. Existing Tools Act on It. Teramis is not intended to replace every security, governance, compliance, or assessment platform in the environment. It provides specialized CUI discovery and output validation that strengthens the tools and services already in use. | 01 | Approved Inputs ### Data Sources Microsoft 365, file shares, endpoints, CAD repositories, scans, archives, email systems, and other supported sources. | | --- | --- |   | 02 | Specialized Ground Truth ### Teramis CUI discovery, validation, inventory, exceptions, boundary evidence, and recurring monitoring. | | --- | --- |   Existing Tools Act on the Output ### Governance, Enforcement, and Evidence #### Labels and Access Governance Existing tools may apply labels, manage permissions, review access, or govern collaboration. #### Policy and Enforcement DLP and security platforms may enforce rules, restrict movement, or prevent unauthorized activity. #### Compliance and Evidence Management GRC systems, advisors, and assessment teams may organize controls, documentation, findings, and assessment evidence. Teramis does not replace the security stack. **It gives the stack a more defensible understanding of where CUI actually exists.** See the Workflow in Action ## Find the CUI You May Not Know You Have See how Teramis examines supported data sources, validates findings, produces boundary evidence, and monitors what changes over time. [Request A Demo](https://teramis.us/request-a-demo?hsLang=en-us) [Start a CUI Discovery Assessment](https://teramis.us/cui-discovery-readiness-assessment-teramis?hsLang=en-us)  Start with a conversation about your environment, data sources, compliance objectives, and current scoping questions.  [![Teramis\_logo\_horiz\_white (1)](https://teramis.us/hubfs/Teramis_logo_horiz_white%20(1).avif "Teramis_logo_horiz_white (1)")](https://teramis.us?hsLang=en-us) ###### Teramis provides precision discovery, validation, remediation, and ongoing monitoring of CUI, ITAR, and other covered defense information, so Defense Industrial Base organizations can build their CUI boundary on evidence. Remediation runs only on actions you approve, and every action is documented. - [Platform](https://teramis.us/platform?hsLang=en-us) - [How Teramis Works](https://teramis.us/company/how-teramis-works) - [CUI Discovery](https://teramis.us/platform/cui-discovery?hsLang=en-us) - [Remediation](https://teramis.us/platform/remediation?hsLang=en-us) - [Evidence & Validation](https://teramis.us/platform/evidence-validation?hsLang=en-us) - [Ongoing Monitoring](https://teramis.us/platform/ongoing-cui-monitoring?hsLang=en-us) - [Deployment & Data Sources](https://teramis.us/platform/deployment-and-data-sources?hsLang=en-us) - [Who We Help](https://teramis.us/who-we-help?hsLang=en-us) - [Enterprise](https://teramis.us/solutions/by-organization/enterprise?hsLang=en-us) - [Government](https://teramis.us/solutions/government-agencies?hsLang=en-us) - [Compliance Advisors](https://teramis.us/solutions/by-organization/compliance-advisors?hsLang=en-us) - [Small Business](https://teramis.us/solutions/by-organization/small-business?hsLang=en-us) - [CUI Solutions](https://teramis.us/solutions?hsLang=en-us) - [Boundary Validation](https://teramis.us/solutions/cui-boundary-validation?hsLang=en-us) - [Spillage Monitoring](https://teramis.us/solutions/cui-remediation-spillage-monitoring?hsLang=en-us) - [CUI Scoping](https://teramis.us/solutions/cmmc-scoping?hsLang=en-us) - [Partners](https://teramis.us/partners?hsLang=en-us) - [Partner Resources](https://teramis.us/partners/partner-resources?hsLang=en-us) - [Our Partners](https://teramis.us/partners/who-we-partner-with?hsLang=en-us) - [Become a Partner](https://teramis.us/partners/become-a-partner?hsLang=en-us) - [Resources](https://teramis.us/resources?hsLang=en-us) - [FAQ](https://teramis.us/resources/faqs?hsLang=en-us) - [Video Media](https://teramis.us/resources/videos-webinars?hsLang=en-us) - [Blog](https://teramis.us/teramis-blog?hsLang=en-us) - [Company](https://teramis.us/company?hsLang=en-us) - [About Us](https://teramis.us/company/about?hsLang=en-us) - [Careers](https://teramis.us/company/careers?hsLang=en-us) - [Contact](https://teramis.us/contact-us?hsLang=en-us) ![teramis footer image](https://teramis.us/hs-fs/hubfs/teramis%20footer%20image.png?width=800&height=320&name=teramis%20footer%20image.png "teramis footer image") Ready to find your CUI? See how Teramis helps your organization identify CUI, validate the boundary, and monitor what changes over time. [Talk to Us About CUI](https://teramis.us/talk-to-us-about-cui?hsLang=en-us) --- [Privacy Policy](https://teramis.us/privacy-policy?hsLang=en-us) · [EULA](https://teramis.us/eula?hsLang=en-us) · © 2026. All rights reserved. Cookie Settings