Skip to content
Request Demo

 EVIDENCE-BASED CUI SCOPING 

Define Your CUI Boundary From the CUI You Actually Have

CUI scoping should begin with evidence of where Controlled Unclassified Information enters, resides, moves, and appears across the environment. 

Find the data before you define the boundary. 

Request demoSee How Teramis Works

THE FOUNDATION OF DEFENSIBLE CUI SCOPING

Your CUI Boundary Is Only as Accurate as the Data Behind It

Most organizations begin CUI planning with interviews, asset inventories, documentation, and assumptions about where CUI should be located. Those sources are useful, but they do not prove where CUI actually exists.

CUI may be scattered across Microsoft 365, file shares, email, endpoints, CAD repositories, scanned documents, archives, engineering folders, and legacy systems.

Over-scoping increases licensing, infrastructure, assessment, consulting, and security-control costs. Under-scoping creates security gaps, assessment surprises, rework, and risk tied to inaccurate compliance representations.

Before you build the boundary, buy the technology, or prepare for assessment, find the CUI you actually have.

Trusted by leading companies

START WITH THE ACTUAL DATA ENVIRONMENT 

Do Not Build a CUI Program Around Assumptions 

Why CUI Scoping Comes First

Many organizations begin NIST SP 800-171 work by selecting a secure platform, purchasing licenses, drafting an SSP, implementing controls, or designing an enclave. 

Those decisions may be premature if the organization has not established where CUI actually exists.

Interviews, questionnaires, policies, diagrams, and asset inventories can describe the intended environment. They may not reveal CUI that has been copied into local folders, sent through email, stored in unexpected SharePoint sites, downloaded to endpoints, included in engineering repositories, embedded in PDFs or scanned documents, retained in archives, shared through unexpected workflows, or stored in legacy and distributed systems.

Teramis is built around a simple principle: CUI scope should reflect the actual data environment, not only documentation or institutional memory. 

Over-Scoping and Under-Scoping Create Different Risks

An Inaccurate Boundary Can Increase Cost or Leave Important Gaps

Scope decisions shape licensing, infrastructure, controls, documentation, assessment preparation, and ongoing monitoring. The goal is not simply to make the boundary smaller. It is to make the boundary more accurate.

Scope Risk 01

Over-Scoped Environment

An organization may include more systems, users, devices, applications, and repositories than necessary because it does not know where CUI actually resides.

  • • Secure-platform licensing
  • • Infrastructure requirements
  • • Control implementation
  • • Documentation work
  • • Evidence collection
  • • Consulting effort
  • • Internal administration
  • • Future assessment complexity

Scope Risk 02

Under-Scoped Environment

An organization may exclude systems or repositories that contain CUI because those locations were not identified during planning.

  • • Incomplete asset inventories
  • • Unsupported SSP assumptions
  • • CUI outside the documented boundary
  • • Missed data flows
  • • Self-attestation gaps
  • • Rework after later discovery
  • • Uncertainty around self-assessment conclusions
  • • Greater risk when customers or government reviewers request evidence

Evidence-Based Scope

Better-Scoped Environment

A better-scoped environment is based on evidence showing where CUI is present, where it is not, and where the current boundary needs further review.

  • • Which systems belong inside the boundary
  • • Which users require access
  • • Which repositories must be protected
  • • Which assets require further analysis
  • • Where an enclave may be appropriate
  • • Which systems may remain outside the CUI environment
  • • Where documentation needs to be updated
  • • What should be monitored over time

QUESTIONS CUI SCOPING SHOULD ANSWER -- DEFINE THE REAL CUI FOOTPRINT

Can Your Organization Answer These Questions With Evidence?

Before finalizing scope, teams should be able to answer:

  • What CUI does the organization actually possess?
  • Where is CUI processed, stored, and transmitted?
  • Which users interact with it?
  • Which Microsoft 365 repositories contain it?
  • Which file shares and endpoints contain it?
  • Is CUI present in engineering or technical repositories?
  • Is CUI located outside expected systems?
  • Which systems support or protect the CUI environment?
  • Which external providers interact with the environment?
  • Which data flows cross the proposed boundary?
  • Which repositories should be included in recurring monitoring?
  • Does the current SSP reflect the discovered environment?
  • What evidence supports the final scoping decision?

Without reliable answers, scope can become a collection of assumptions rather than a supportable description of the operating environment.

FROM ASSUMPTIONS TO A REVIEWABLE BOUNDARY

A Practical Workflow for Evidence-Based Scope Decisions

01

Define the Discovery Objective

Establish what the organization needs to learn before making scoping decisions. This may include determining whether CUI exists, reviewing an existing boundary, evaluating an enclave approach, reducing over-scoping, or investigating suspected CUI outside approved locations.

02

Identify Data Sources for Review

Determine which systems, repositories, business units, users, and environments are authorized for discovery.

03

Discover Candidate CUI

Teramis examines supported data sources to identify potential CUI and reveal locations that may not have been included in the organization's original understanding.

04

Validate the Findings

Review and validation workflows help distinguish meaningful findings from irrelevant results and provide stronger technical evidence for scoping decisions.

05

Compare Findings With the Proposed Boundary

Compare discovery findings with the SSP, network and data-flow diagrams, asset inventories, approved CUI repositories, access records, enclave plans, and existing scoping assumptions.

06

Identify Exceptions and Open Questions

Document findings outside expected locations so authorized teams can determine the appropriate next step.

07

Support the Final Scoping Decision

Authorized customer personnel, advisors, and service providers use the resulting evidence to determine which systems, users, assets, repositories, and providers belong inside the documented scope.

08

Establish a Monitoring Baseline

Use the validated CUI footprint as a baseline for identifying future movement, new findings, possible spillage, and boundary drift.

TECHNICAL INPUT FOR BETTER BOUNDARY DECISIONS

Turn Discovery Results Into Usable Scoping Evidence

 Teramis can help provide the technical findings and records teams need to support clearer CUI scoping and self-assessment discussions.

CUI inventory information

File-level findings

Repository and location details

Findings outside expected locations

Boundary exceptions for review

CUI validation output

Change reporting between scans

Monitoring history

Evidence supporting scoping and self-attestation discussions

This gives compliance, security, IT, legal, leadership, and advisory teams a shared technical record of the findings that matter.

CUI SCOPE EXTENDS BEYOND ONE FOLDER OR APPLICATION

Examine the Environment Around the Data

Scoping decisions may need to consider more than the repository where a document is stored. The systems, services, users, and supporting infrastructure around CUI can also affect how the environment is evaluated.

CUI Repositories

User Devices

Identity and Access Systems

Security Protection Assets

Administrative Systems

Backups and Archives

Cloud and Collaboration Services

External Service Providers

Teramis does not make the final regulatory classification of each asset. It provides data-location evidence that helps the organization and its advisors evaluate those decisions.

START WHERE YOUR ORGANIZATION IS TODAY

Whether You Are Defining Scope or Testing It, Start With the Data

Starting Point 01

We Have Not Defined the Boundary Yet

Teramis can help establish the initial CUI footprint before the organization selects an enclave, purchases licenses, finalizes the SSP, categorizes assets, implements broad technical changes, completes a self-assessment, or develops a longer-term compliance plan.

Starting Point 02

We Already Have a Documented Boundary

Teramis can help compare the current boundary with findings from the actual environment.

This may reveal CUI outside expected repositories, overlooked systems, incomplete data-flow assumptions, documentation that needs revision, or areas that should be monitored over time.

KEEP THE STACK. ADD CUI EVIDENCE.

Give Compliance Teams Better Data to Work From

Teramis does not replace compliance advisors, MSPs, MSSPs, GRC platforms, secure enclave providers, Microsoft security tools, DLP systems, legal counsel, or assessment professionals.

Teramis supplies specialized CUI discovery and validation information that these teams and systems can use.

Teramis Helps Establish

  • Where candidate CUI exists
  • Which repositories require review
  • Which findings fall outside expectations
  • What may affect the proposed boundary
  • Which assumptions require validation
  • What should be monitored after scoping

Authorized Teams Determine

  • Final CUI scope
  • Asset categorization
  • Enclave design
  • Control applicability
  • Documentation changes
  • Administrative action
  • Self-assessment conclusions
  • Future assessment strategy

Teramis provides the evidence. Existing tools and authorized professionals act on it.

A SHARED FOUNDATION FOR CUI DECISIONS

Support the People Responsible for Scope, Security, and Evidence

Defense Contractors

Gain clearer evidence before making infrastructure, licensing, documentation, enclave, and self-attestation decisions. .

Executives and Owners

Improve confidence that compliance investments, boundary decisions, and organizational representations are based on the actual environment.

Security and IT Teams

Understand which repositories, systems, users, and data locations may require additional review or protection.

Compliance and GRC Teams

Compare technical findings with the SSP, asset inventory, self-assessment records, and documented CUI boundary.

Compliance Advisors

Support scoping recommendations with technical CUI evidence rather than relying only on interviews, spreadsheets, inventories, and assumptions.

MSPs and MSSPs

Establish a clearer starting point for enclave, managed-security, monitoring, remediation-support, and compliance engagements. 

A PRECISE ROLE IN CUI SCOPING

Discovery Evidence, Not Final Determinations

What Teramis Does

  • Discover candidate CUI
  • Identify where findings are located
  • Categorize and catalog findings
  • Validate discovery results
  • Identify unexpected repositories
  • Produce CUI inventory information
  • Document boundary exceptions
  • Establish a monitoring baseline
  • Support evidence-based scoping discussions

What Teramis Does Not Do

  • Approve the final CUI scope
  • Perform a formal assessment
  • Complete the organization's self-assessment
  • Guarantee compliance or assessment results
  • Make legal determinations
  • Decide which contracts apply
  • Guarantee that a customer, prime contractor, or government reviewer will accept a boundary

Authorized customer personnel, advisors, legal counsel, and assessment professionals retain responsibility for their respective decisions.

Teramis identifies, validates, reports, and monitors CUI. It does not independently make the final compliance, legal, or assessment determination.

START WITH THE ACTUAL CUI FOOTPRINT

Build Your Build Your CUI Scope on Evidence, Not Assumptions

 See how Teramis can help identify where CUI resides, reveal unexpected locations, and provide a stronger technical foundation for boundary, enclave, self-assessment, monitoring, and compliance decisions.

Start with a discussion about your current CUI assumptions, data sources, environment, and scoping objectives.

 

Request a Demotart a CUI Discovery Assessment