POST-INCIDENT CUI SCOPING

Answer One Question Factually: Was CUI in the Affected Systems?

After a security incident, the response team, counsel, and leadership need to know what data was in the environment that was touched. For organizations handling Controlled Unclassified Information, that question carries contractual and regulatory weight.

Teramis examines approved portions of affected systems and repositories to help determine whether CUI may have been present, and produces a factual record of what was found.

Teramis supports factual discovery. Your counsel and response team make the determinations.

THE COST OF AN ASSUMPTION

Overstating and Understating Both Create Real Problems

When an organization cannot establish what data lived in an affected system, it is forced to reason from assumption. Both directions carry consequences.

Assuming CUI was present when it was not can trigger notifications, customer escalations, contractual disclosures, and remediation work that the facts would not have required.

Assuming CUI was not present when it was can leave obligations unmet and create far more serious exposure later, particularly if the facts surface during a subsequent review.

Factual data-location evidence narrows the range the response team is reasoning within.

A NARROW, DEFINED ROLE

Data-Location Evidence for the People Making the Decisions

Working within the systems and repositories your organization and counsel authorize for examination, Teramis can help establish:

Whether candidate CUI was present in the affected environment
Which repositories and locations contained it
File-level detail on what was found
Whether findings extend beyond the initially suspected scope
What the environment looks like after response activity

This is a factual input to an incident process led by others. It is not an incident investigation.

SEQUENCE AND AUTHORIZATION

Discovery Follows Containment and Legal Direction

1. Containment and forensics lead. Your incident response team and forensic providers handle containment, root cause, and evidence preservation. Teramis does not participate in that work.
2. Counsel defines the scope of examination. Legal counsel and your organization determine which systems and repositories may be examined and under what conditions.
3. Discovery runs against the authorized scope. Teramis examines only what has been authorized.
4. Findings go to the decision-makers. Results are provided to the teams responsible for determining impact, obligations, and reporting.
5. Post-response verification. After remediation activity, re-scanning can confirm the current state of the environment.

A FACTUAL RECORD

Documentation Your Counsel and Response Team Can Work From

CUI inventory information for the examined scope
File and repository detail
Findings inside and outside the initially suspected environment
Validation and sampling output
Comparison against prior scans, where a baseline exists
Post-remediation verification

Organizations with an existing Teramis baseline are in a materially better position here, because the environment can be compared against a known prior state rather than assessed cold.

Explore Spillage Monitoring

IMPORTANT LIMITS

Discovery Evidence, Not Incident Determinations

Teramis does not:

Perform incident response, containment, or digital forensics
Determine whether a breach or reportable event occurred
Make legal, regulatory, reporting, or notification determinations
Establish whether data was accessed, exfiltrated, or viewed
Attribute activity to any actor
Serve as a substitute for counsel, forensic providers, or insurers
Guarantee that all affected data was identified

Teramis reports what it finds in the scope it is authorized to examine. Your legal counsel, incident response team, and leadership retain responsibility for every determination that follows.