By inDirectIT, Inc. · Planning guidance from our engineering practice.
How CUI spreads the boundary
The CMMC boundary includes CUI assets and relevant security-protection assets and services. Other asset categories have their own scoping treatment; an asset is not out of scope merely because it never stores CUI. Document categorization, shared services, identity, endpoints, and data flows against the applicable assessment guidance.
The usual pattern: CUI arrives by email, gets saved to a share, is copied to a laptop and forwarded to a project channel, and three years later it's everywhere. If you can't show where CUI lives, the default is everything in scope.
Want your numbers first? The free CUI Scope Estimator takes three sliders and five minutes. Compare an illustrative boundary scenario, then come back here for the method.
Estimate My Scope →How Teramis discovery works
Find the data
Scan M365, file shares, endpoints, and repositories for regulated-data markers to find where CUI actually sits, whatever the policy says.
Separate CUI from noise
Distinguish true CUI from FCI and ordinary business data, so you're not building a SCIF around your lunch menus.
Trace how it moves
Map the real pathways, from contracts coming in to deliverables going out, so the boundary follows the data instead of the org chart.
Document the defensible boundary
Consolidate CUI where appropriate, account for shared services and security dependencies, and document each asset category with evidence.
An illustrative consolidation scenario
The numbers below are planning examples, not measured typical outcomes or a promised reduction. Actual categorization requires discovery and review.
| Unknown scope | After discovery | |
|---|---|---|
| Systems under full 800-171 control | Everything (say 40) | 8 to 15 |
| Users needing CUI controls & training | All 250 | 40 to 90 |
| Evidence to produce for a C3PAO | Whole environment | One enclave |
| Remediation spend | Spread thin everywhere | Concentrated where it counts |
Scope planning and SPRS scoring answer different questions. Discovery may reduce implementation work, but it does not change the 110-point assessment scale or award points for removing users. Use the CMMC Calculator to assess implemented requirements against evidence, and validate any service-package scenario separately.
Run it in this order
- Before the gap assessment. Assessing an over-scoped environment wastes the assessment.
- Before the enclave build. Discovery tells you what the enclave must hold and what can stay out.
- Before you buy tooling. License counts follow scope. Confirm recurring costs against the verified boundary and operating requirements.
Typical engagement: from $4,500/yr for organizations under 100 employees; savings depend on the verified boundary and actual implementation costs.
Make the boundary explicit.
Start with the CUI scope estimator, then use our Federal CUI and NIST SP 800-171 service to turn discovery into a documented boundary and implementation plan.
Find out what you don't have to secure.
Tell us roughly what your environment looks like and we'll come back with a discovery plan and a scope-reduction estimate. Or email rj@indirectit.com directly.