Overstatement
Assuming CUI Was Present When It Was Not
This can trigger notifications, customer escalations, contractual disclosures, and remediation work that the facts would not have required.
POST-INCIDENT CUI SCOPING
Answer One Question Factually: Was CUI in the Affected Systems?
Determine Whether CUI Was Present After an Incident
After a security incident, the response team, counsel, and leadership need to know what data was in the environment that was touched. For organizations handling Controlled Unclassified Information, that question carries contractual and regulatory weight.
Teramis examines approved portions of affected systems and repositories to help determine whether CUI may have been present, and produces a factual record of what was found.
Teramis supports factual discovery. Your counsel and response team make the determinations.
The cost of an assumption
Why Accurate CUI Discovery Matters After a Security Incident
When an organization cannot establish what data lived in an affected system, it is forced to reason from assumption. Both directions carry consequences.
Understatement
Assuming CUI Was Not Present When It Was
This can leave obligations unmet and create more serious exposure later, particularly if the facts surface during a subsequent review.
Factual data-location evidence narrows the range the response team is reasoning within.
A narrow, defined role
Data-Location Evidence for the People Making the Decisions
Working within the systems and repositories your organization and counsel authorize for examination, Teramis can help establish the relevant facts about the affected environment.
01
Whether candidate CUI was present in the affected environment
02
Which repositories and locations contained it
03
File-level detail on what was found
04
Whether findings extend beyond the initially suspected scope
05
What the environment looks like after response activity
Teramis provides a factual input to an incident process led by others. It does not perform an incident investigation.
Sequence and authorization
Discovery Follows Containment and Legal Direction
1
Containment and Forensics Lead
Your incident response team and forensic providers handle containment, root cause, and evidence preservation. Teramis does not participate in that work.
2
Counsel Defines the Scope of Examination
Legal counsel and your organization determine which systems and repositories may be examined and under what conditions.
3
Discovery Runs Against the Authorized Scope
Teramis examines only what has been authorized.
4
Findings Go to the Decision-Makers
Results are provided to the teams responsible for determining impact, obligations, and reporting.
5
Post-Response Verification
After remediation activity, re-scanning can confirm the current state of the environment.
A factual record
Documentation Your Counsel and Response Team Can Work From
Provide the people responsible for legal, contractual, and response decisions with a clearer record of the examined environment.
CUI inventory information for the examined scope
File and repository detail
Findings inside and outside the initially suspected environment
Validation and sampling output
Comparison against prior scans, where a baseline exists
Post-remediation verification
Organizations with an existing Teramis baseline are in a materially better position. The affected environment can be compared against a known prior state rather than assessed cold.
Sequence and authorization
Discovery Follows Containment and Legal Direction
1
Containment and Forensics Lead
Your incident response team and forensic providers handle containment, root cause, and evidence preservation. Teramis does not participate in that work.
2
Counsel Defines the Scope of Examination
Legal counsel and your organization determine which systems and repositories may be examined and under what conditions.
3
Discovery Runs Against the Authorized Scope
Teramis examines only what has been authorized.
4
Findings Go to the Decision-Makers
Results are provided to the teams responsible for determining impact, obligations, and reporting.
5
Post-Response Verification
After remediation activity, re-scanning can confirm the current state of the environment.
A factual record
Documentation Your Counsel and Response Team Can Work From
Provide the people responsible for legal, contractual, and response decisions with a clearer record of the examined environment.
CUI inventory information for the examined scope
File and repository detail
Findings inside and outside the initially suspected environment
Validation and sampling output
Comparison against prior scans, where a baseline exists
Post-remediation verification
Organizations with an existing Teramis baseline are in a materially better position. The affected environment can be compared against a known prior state rather than assessed cold.
Discovery Evidence, Not Incident Determinations
Teramis does not:
- Perform incident response, containment, or digital forensics
- Determine whether a breach or reportable event occurred
- Make legal, regulatory, reporting, or notification determinations
- Establish whether data was accessed, exfiltrated, or viewed
- Attribute activity to any actor
- Serve as a substitute for counsel, forensic providers, or insurers
- Guarantee that all affected data was identified
Teramis reports what it finds in the scope it is authorized to examine. Your legal counsel, incident response team, and leadership retain responsibility for every determination that follows.
START FROM WHAT IS ACTUALLY THERE
Give Your Response Team Facts About the Data
Talk with Teramis about the affected environment, the scope your counsel has authorized, and the timeline you are working within.