From “where is our CUI?” to ready for the assessor.
Dozens of applications and more than two hundred stakeholders, with no map of where controlled unclassified information went. A year later, a smaller boundary and a clean pre-assessment.
The brief
Defense contracts that mattered to revenue now required CMMC Level 2. No one could say with certainty which systems handled controlled unclassified information.
The difficulty
Over the years CUI had drifted into email, file shares and engineering tools. More than two hundred people touched it. Scoping everything would have made the assessment vast; scoping too little would have failed it.
What we did
- Trace
Application by application
CUI flows mapped from each system’s architecture, not from surveys.
- Enclose
A defensible boundary
The smallest enclave that honestly held every CUI flow.
- Assess
Against NIST SP 800-171
Every in-scope system, control by control, with evidence.
- Prove
SSP, POA&M, rehearsal
The documents assessors read, then a pre-assessment that rehearsed the real one.
The result
- Dozens
- Of applications brought into a smaller boundary
- 200+
- Stakeholders aligned on one plan
- ~1 year
- From first trace to assessor-ready
- Green
- Light for the formal assessment
The lesson
Your boundary sets your cost. Every system you can honestly take out of scope is one you never have to defend.