--- title: CUI Discovery Software | Teramis description: Find CUI, ITAR, and other covered defense information across Microsoft 365, file shares, endpoints, engineering files, scans, and archives. --- [Skip to content](https://teramis.us/platform/cui-discovery#main-content) [![Teramis Logo](https://teramis.us/hs-fs/hubfs/Untitled%20design%20-%202026-07-20T135654.427.png?width=3000&height=2000&name=Untitled%20design%20-%202026-07-20T135654.427.png)Homepage](https://teramis.us?hsLang=en-us) - [Home](https://teramis.us?hsLang=en-us) - [Platform](https://teramis.us/platform?hsLang=en-us) - [How Teramis Works](https://teramis.us/company/how-teramis-works?hsLang=en-us) - [CUI Discovery](https://teramis.us/platform/cui-discovery) - [Evidence & Validation](https://teramis.us/platform/evidence-validation?hsLang=en-us) - [Ongoing Monitoring](https://teramis.us/platform/ongoing-cui-monitoring?hsLang=en-us) - [Remediation](https://teramis.us/platform/remediation?hsLang=en-us) - [Deployment & Data Sources](https://teramis.us/platform/deployment-and-data-sources?hsLang=en-us) - [Who We Help](https://teramis.us/who-we-help?hsLang=en-us) - [Solutions](https://teramis.us/solutions?hsLang=en-us) - By Decision - [CUI Scoping](https://teramis.us/solutions/cmmc-scoping?hsLang=en-us) - [CUI Boundary Validation](https://teramis.us/solutions/cui-boundary-validation?hsLang=en-us) - [CUI Remediation & Spillage Monitoring](https://teramis.us/solutions/cui-remediation-spillage-monitoring?hsLang=en-us) - [Migration Support](https://teramis.us/solutions/migration-support?hsLang=en-us) - [Post-Incident CUI Scoping](https://teramis.us/solutions/post-incident-cui-scoping-and-discovery-teramis?hsLang=en-us) - [Supply Chain and M&A](https://teramis.us/solutions/supply-chain-ma?hsLang=en-us) - By Organization - [Small Business](https://teramis.us/solutions/by-organization/small-business?hsLang=en-us) - [Enterprise](https://teramis.us/solutions/by-organization/enterprise?hsLang=en-us) - [Government](https://teramis.us/solutions/government-agencies?hsLang=en-us) - [Compliance Advisors](https://teramis.us/solutions/by-organization/compliance-advisors?hsLang=en-us) - [Partners](https://teramis.us/partners?hsLang=en-us) - [Partner Program](https://teramis.us/partners/partner-program?hsLang=en-us) - [Partner Resources](https://teramis.us/partners/partner-resources?hsLang=en-us) - [Who We Partner With](https://teramis.us/partners/who-we-partner-with?hsLang=en-us) - [Partner MSPs & MSSPs](https://teramis.us/partners/who-we-partner-with?hsLang=en-us#MSPs-MSSPs) - [Compliance Advisors & Consultants](https://teramis.us/partners/who-we-partner-with?hsLang=en-us#CMMCAdvisoryandRPOs) - [GRC and Enclave Providers](https://teramis.us/partners/who-we-partner-with?hsLang=en-us#GRC-EnclaveProviders) - [Technology Partners](https://teramis.us/partners/who-we-partner-with?hsLang=en-us#TechnologyPartners) - [Become a Partner](https://teramis.us/partners/become-a-partner?hsLang=en-us) - [Resources](https://teramis.us/resources?hsLang=en-us) - [FAQ](https://teramis.us/resources/faqs?hsLang=en-us) - [Videos & Webinars](https://teramis.us/resources/videos-webinars?hsLang=en-us) - [Resource Library & Downloads](https://teramis.us/resources/library?hsLang=en-us) - [Blog](https://teramis.us/teramis-blog?hsLang=en-us) - [Company](https://teramis.us/company?hsLang=en-us) - [About Us](https://teramis.us/company/about?hsLang=en-us) - [Use Cases](https://teramis.us/use-cases?hsLang=en-us) - [FAQ](https://teramis.us/resources/faqs?hsLang=en-us) - [Careers](https://teramis.us/company/careers?hsLang=en-us) - [Contact](https://teramis.us/contact-us?hsLang=en-us) [Request Demo](https://teramis.us/request-a-demo?hsLang=en-us) - [Home](https://teramis.us?hsLang=en-us) - [Platform](https://teramis.us/platform?hsLang=en-us) - [How Teramis Works](https://teramis.us/company/how-teramis-works?hsLang=en-us) - [CUI Discovery](https://teramis.us/platform/cui-discovery) - [Evidence & Validation](https://teramis.us/platform/evidence-validation?hsLang=en-us) - [Ongoing Monitoring](https://teramis.us/platform/ongoing-cui-monitoring?hsLang=en-us) - [Remediation](https://teramis.us/platform/remediation?hsLang=en-us) - [Deployment & Data Sources](https://teramis.us/platform/deployment-and-data-sources?hsLang=en-us) - [Who We Help](https://teramis.us/who-we-help?hsLang=en-us) - [Solutions](https://teramis.us/solutions?hsLang=en-us) - By Decision - [CUI Scoping](https://teramis.us/solutions/cmmc-scoping?hsLang=en-us) - [CUI Boundary Validation](https://teramis.us/solutions/cui-boundary-validation?hsLang=en-us) - [CUI Remediation & Spillage Monitoring](https://teramis.us/solutions/cui-remediation-spillage-monitoring?hsLang=en-us) - [Migration Support](https://teramis.us/solutions/migration-support?hsLang=en-us) - [Post-Incident CUI Scoping](https://teramis.us/solutions/post-incident-cui-scoping-and-discovery-teramis?hsLang=en-us) - [Supply Chain and M&A](https://teramis.us/solutions/supply-chain-ma?hsLang=en-us) - By Organization - [Small Business](https://teramis.us/solutions/by-organization/small-business?hsLang=en-us) - [Enterprise](https://teramis.us/solutions/by-organization/enterprise?hsLang=en-us) - [Government](https://teramis.us/solutions/government-agencies?hsLang=en-us) - [Compliance Advisors](https://teramis.us/solutions/by-organization/compliance-advisors?hsLang=en-us) - [Partners](https://teramis.us/partners?hsLang=en-us) - [Partner Program](https://teramis.us/partners/partner-program?hsLang=en-us) - [Partner Resources](https://teramis.us/partners/partner-resources?hsLang=en-us) - [Who We Partner With](https://teramis.us/partners/who-we-partner-with?hsLang=en-us) - [Partner MSPs & MSSPs](https://teramis.us/partners/who-we-partner-with?hsLang=en-us#MSPs-MSSPs) - [Compliance Advisors & Consultants](https://teramis.us/partners/who-we-partner-with?hsLang=en-us#CMMCAdvisoryandRPOs) - [GRC and Enclave Providers](https://teramis.us/partners/who-we-partner-with?hsLang=en-us#GRC-EnclaveProviders) - [Technology Partners](https://teramis.us/partners/who-we-partner-with?hsLang=en-us#TechnologyPartners) - [Become a Partner](https://teramis.us/partners/become-a-partner?hsLang=en-us) - [Resources](https://teramis.us/resources?hsLang=en-us) - [FAQ](https://teramis.us/resources/faqs?hsLang=en-us) - [Videos & Webinars](https://teramis.us/resources/videos-webinars?hsLang=en-us) - [Resource Library & Downloads](https://teramis.us/resources/library?hsLang=en-us) - [Blog](https://teramis.us/teramis-blog?hsLang=en-us) - [Company](https://teramis.us/company?hsLang=en-us) - [About Us](https://teramis.us/company/about?hsLang=en-us) - [Use Cases](https://teramis.us/use-cases?hsLang=en-us) - [FAQ](https://teramis.us/resources/faqs?hsLang=en-us) - [Careers](https://teramis.us/company/careers?hsLang=en-us) - [Contact](https://teramis.us/contact-us?hsLang=en-us) [Request Demo](https://teramis.us/request-a-demo?hsLang=en-us) ACCURATE CUI DISCOVERY # Find the CUI You Actually Have ## Teramis discovers CUI, ITAR, and other covered defense information, wherever it lives. Controlled Unclassified Information can exist far beyond the systems and folders where teams expect to find it. Teramis examines supported data sources to identify where CUI, ITAR, and other covered defense information exists, surface unexpected locations, and provide a stronger technical foundation for scoping, boundary, and remediation decisions.    [Start a CUI Discovery Assessment](https://teramis.us/cui-discovery-readiness-assessment-teramis?hsLang=en-us) [Request demo](https://teramis.us/request-a-demo?hsLang=en-us) [See How Teramis Works](https://teramis.us/company/how-teramis-works?hsLang=en-us) Purpose-built CUI discovery with scanning and analysis performed within the customer environment.  Why CUI Discovery Comes First ## Your CUI Boundary Is Only as Accurate as the Data Behind It Asset inventories, architecture diagrams, policies, and employee interviews can describe where CUI is supposed to be. They do not necessarily show where it actually exists. Files get copied, forwarded, downloaded, archived, renamed, scanned, and stored in unexpected places. When those locations are missed, the documented boundary can drift from the actual data environment. Over-Scoped ### Protecting More Than the Evidence Requires Systems that do not need to be included may add unnecessary licensing, security, assessment, and support requirements. Under-Scoped ### CUI Exists Outside the Documented Boundary CUI may remain outside the documented boundary, creating gaps that require investigation and correction. Evidence before assumptions. WHERE IS THE CUI? # CUI Discovery Starts With the Data Environment Controlled Unclassified Information does not always live in the folder someone designated for it. It can appear in technical documents, engineering files, PDFs, email attachments, images, scans, compressed archives, project folders, and repositories that have grown over years. Teramis is built for the messy reality of defense data. It helps organizations examine approved environments and supported file types so CUI discovery is not limited to obvious labels, expected folders, or simple keyword searches. **Find the data first. Then draw the boundary.** Trusted by leading companies ![](https://7528302.fs1.hubspotusercontent-na1.net/hubfs/7528302/raw_assets/public/mV0_d-cms-elevate-theme_hubspot/elevate/images/hexagontalxio-dark.png) ![](https://7528304.fs1.hubspotusercontent-na1.net/hubfs/7528304/raw_assets/public/mV0_d-cms-elevate-theme_hubspot/elevate/images/reviluxify-dark.png) ![](https://7528315.fs1.hubspotusercontent-na1.net/hubfs/7528315/raw_assets/public/mV0_d-cms-elevate-theme_hubspot/elevate/images/zyntellix-dark.png) ![](https://7528302.fs1.hubspotusercontent-na1.net/hubfs/7528302/raw_assets/public/mV0_d-cms-elevate-theme_hubspot/elevate/images/crypturon-dark.png) ![](https://7528311.fs1.hubspotusercontent-na1.net/hubfs/7528311/raw_assets/public/mV0_d-cms-elevate-theme_hubspot/elevate/images/spectroxium-dark.png) ![](https://7528309.fs1.hubspotusercontent-na1.net/hubfs/7528309/raw_assets/public/mV0_d-cms-elevate-theme_hubspot/elevate/images/lyraxionics-dark.png) HOW CUI DISCOVERY WORKS ## Find Candidate CUI Across Approved Data Sources Teramis examines the systems, repositories, and data sources approved for review to identify candidate CUI and establish a clearer, evidence-backed picture of the data environment. Teams can use those findings to investigate the CUI footprint before scoping, boundary validation, migration planning, or assessment preparation. ### Find Discover CUI across approved Microsoft 365 environments, file systems, email, endpoints, CAD files, PDFs, scanned documents, archives, engineering repositories, and other supported sources.  [Explore CUI Discovery](https://www.teramis.us/?hsLang=en-us) ### Prove Validate findings and produce evidence that helps executives, advisors, compliance teams, and government or prime-contractor reviewers understand whether the documented boundary matches the actual environment. [Explore Evidence and Validation](https://www.teramis.us/?hsLang=en-us) ### Monitor Run recurring scans to identify new CUI, movement, spillage, and boundary drift before the next assessment, annual affirmation, prime contractor request, or internal review.  [Explore Continuous Monitoring](https://www.teramis.us/?hsLang=en-us) From Discovery to Reviewable Findings ## Turn an Unknown Data Estate Into a Clearer CUI Footprint Move from an approved discovery scope to organized, reviewable findings that help teams understand where potential CUI exists and what requires further validation. 01 ### Define the Scope Select the systems, repositories, projects, and data sources approved for examination. 02 ### Discover Teramis scans supported content within the approved scope for potential CUI. 03 ### Organize Findings provide file and location information so teams can understand where CUI may exist and where exceptions require attention. 04 ### Validate Discovery findings can move into the Teramis validation process to build greater confidence in the resulting CUI inventory. [Explore Evidence and Validation →](https://teramis.us/platform/evidence-validation?hsLang=en-us) ## **What CUI Discovery Gives You** ### **Better Information for the Decisions That Follow** Teramis discovery can provide: - A clearer view of the CUI footprint - File and repository-level findings - Visibility into unexpected CUI locations - Input for CUI boundary decisions - Findings requiring further review - A baseline for future monitoring Teramis reports what it finds. Authorized teams approve the response, and Remedius can carry it out with a documented record. BEYOND KEYWORD SEARCH ## CUI Is Rarely Neat, Consistent, or Confined to One Repository Controlled Unclassified Information does not always live in the folder someone designated for it. It can appear in technical documents, engineering files, PDFs, email attachments, images, scans, compressed archives, project folders, and repositories that have grown over years. Teramis is built for the messy reality of defense data. It helps organizations examine approved environments and supported file types so CUI discovery is not limited to obvious labels, expected folders, or simple keyword searches. ### Teramis supports discovery across supported sources that may include: ### Microsoft 365 - SharePoint - OneDrive - Exchange - Supported Microsoft 365 repositories ### File Systems & Endpoints - Network file shares - Local and distributed endpoints - Legacy repositories - Project and engineering folders ### Complex Content - CAD and engineering files PDFs - Images and scanned documents - Email and attachments - Archives - Structured and unstructured files [Explore Deployment and Data Sources](https://teramis.us/platform/deployment-and-data-sources?hsLang=en-us) BETTER TOGETHER WITH YOUR EXISTING STACK  # Teramis Provides the CUI Ground Truth Other Tools Can Act On Teramis is not another platform war. It complements the systems, tools, advisors, and workflows organizations already use by helping identify where CUI actually exists. ### Microsoft Purview Use labels and compliance workflows with stronger CUI discovery evidence.  ### Varonis Support access governance with clearer visibility into where CUI exists.  ### Forcepoint and DLP Tools Strengthen enforcement strategies by starting with better CUI ground truth. ### GRC & Evidence Binders Connect documentation, control evidence, and boundary decisions to the actual CUI footprint. CUI DISCOVERY FOR HIGH-STAKES DECISIONS ## One Evidence Layer. Multiple CMMC and Risk Use Cases. ### CUI Scoping Identify where CUI actually exists before defining the systems, users, repositories, and controls that belong inside the boundary that must meet NIST SP 800-171. ### CUI Boundary Validation Compare the documented boundary with the actual data environment and identify exceptions that require review or customer action. ### CUI Migration Support Identify and report the files, locations, and findings administrators need when planning customer-led movement into approved environments. ### Ongoing CUI Spillage Management Run recurring scans to identify CUI that appears outside approved locations as people, files, systems, and business processes change. ### Post-Breach CUI Impact Assessment Examine affected systems and repositories to help determine whether CUI may have existed within the impacted environment. ### Supply Chain and M&A Risk Review Evaluate whether the actual CUI footprint supports representations made during vendor reviews, acquisitions, integrations, and supply-chain due diligence. ## **Purpose-Built for the CUI Problem** ### **Go Beyond Basic Keyword and Pattern Matching** Common sensitive-data searches often focus on predictable identifiers such as payment card or Social Security number patterns. CUI is different. It may be inconsistently marked, embedded in technical content, stored in images or scans, mixed with ordinary project information, or located in repositories no one expected to contain controlled data. Teramis is purpose-built to help organizations find CUI across the complex data environments common to the Defense Industrial Base. Partner With Teramis ## Make Compliance Guidance Provable, Scalable, and Defensible Teramis gives compliance advisors, MSPs, MSSPs, vCISOs, GRC providers, enclave partners, and other organizations serving the Defense Industrial Base the technical evidence needed to guide clients with greater confidence. Use Teramis to reduce scoping uncertainty, identify late-stage CUI surprises, strengthen client recommendations, and create repeatable CUI discovery and monitoring services. [Partner With Teramis →](https://teramis.us/partners?hsLang=en-us) [Explore the Partner Program →](https://teramis.us/partners/partner-program?hsLang=en-us) About Teramis ## Purpose-Built for Defensible CUI Discovery Teramis is a purpose-built forensic discovery, validation, remediation, and continuous monitoring platform for CUI, ITAR, and other covered defense information. The platform helps organizations understand where that data actually lives so they can make stronger decisions about scope, boundary validation, remediation, spillage monitoring, and self-assessment. [Learn More About Teramis →](https://teramis.us/company/about?hsLang=en-us) Make the Documented Boundary Match Reality ## Do You Know Where Your CUI Actually Lives? See how Teramis can help your organization or your clients identify CUI, validate the CMMC boundary, and monitor what changes over time. [Request A Demo →](https://teramis.us/request-a-demo?hsLang=en-us) [Start a CUI Discovery Assessment →](https://teramis.us/cui-discovery-readiness-assessment-teramis?hsLang=en-us) [![Teramis\_logo\_horiz\_white (1)](https://teramis.us/hubfs/Teramis_logo_horiz_white%20(1).avif "Teramis_logo_horiz_white (1)")](https://teramis.us?hsLang=en-us) ###### Teramis provides precision discovery, validation, remediation, and ongoing monitoring of CUI, ITAR, and other covered defense information, so Defense Industrial Base organizations can build their CUI boundary on evidence. Remediation runs only on actions you approve, and every action is documented. - [Platform](https://teramis.us/platform?hsLang=en-us) - [How Teramis Works](https://teramis.us/company/how-teramis-works?hsLang=en-us) - [CUI Discovery](https://teramis.us/platform/cui-discovery) - [Remediation](https://teramis.us/platform/remediation?hsLang=en-us) - [Evidence & Validation](https://teramis.us/platform/evidence-validation?hsLang=en-us) - [Ongoing Monitoring](https://teramis.us/platform/ongoing-cui-monitoring?hsLang=en-us) - [Deployment & Data Sources](https://teramis.us/platform/deployment-and-data-sources?hsLang=en-us) - [Who We Help](https://teramis.us/who-we-help?hsLang=en-us) - [Enterprise](https://teramis.us/solutions/by-organization/enterprise?hsLang=en-us) - [Government](https://teramis.us/solutions/government-agencies?hsLang=en-us) - [Compliance Advisors](https://teramis.us/solutions/by-organization/compliance-advisors?hsLang=en-us) - [Small Business](https://teramis.us/solutions/by-organization/small-business?hsLang=en-us) - [CUI Solutions](https://teramis.us/solutions?hsLang=en-us) - [Boundary Validation](https://teramis.us/solutions/cui-boundary-validation?hsLang=en-us) - [Spillage Monitoring](https://teramis.us/solutions/cui-remediation-spillage-monitoring?hsLang=en-us) - [CUI Scoping](https://teramis.us/solutions/cmmc-scoping?hsLang=en-us) - [Partners](https://teramis.us/partners?hsLang=en-us) - [Partner Resources](https://teramis.us/partners/partner-resources?hsLang=en-us) - [Our Partners](https://teramis.us/partners/who-we-partner-with?hsLang=en-us) - [Become a Partner](https://teramis.us/partners/become-a-partner?hsLang=en-us) - [Resources](https://teramis.us/resources?hsLang=en-us) - [FAQ](https://teramis.us/resources/faqs?hsLang=en-us) - [Video Media](https://teramis.us/resources/videos-webinars?hsLang=en-us) - [Blog](https://teramis.us/teramis-blog?hsLang=en-us) - [Company](https://teramis.us/company?hsLang=en-us) - [About Us](https://teramis.us/company/about?hsLang=en-us) - [Careers](https://teramis.us/company/careers?hsLang=en-us) - [Contact](https://teramis.us/contact-us?hsLang=en-us) ![teramis footer image](https://teramis.us/hs-fs/hubfs/teramis%20footer%20image.png?width=800&height=320&name=teramis%20footer%20image.png "teramis footer image") Ready to find your CUI? See how Teramis helps your organization identify CUI, validate the boundary, and monitor what changes over time. [Talk to Us About CUI](https://teramis.us/talk-to-us-about-cui?hsLang=en-us) --- [Privacy Policy](https://teramis.us/privacy-policy?hsLang=en-us) · [EULA](https://teramis.us/eula?hsLang=en-us) · © 2026. All rights reserved. Cookie Settings