Controlled Unclassified Information behaves like glitter. It arrives in one email attachment, and six months later it is on four laptops, two phones, a vendor portal, and a channel in your chat tool nobody remembers creating. Every place it lands is in scope. Everything in scope must meet the controls. Let it wander and your whole company becomes the assessment.
Scope is the biggest cost lever you have
Every NIST 800-171 control applies to systems inside the boundary. Twenty in-scope machines versus two hundred is the difference between a manageable program and a second full-time job. Before you buy a single tool, decide where CUI is allowed to exist. That decision, made early, is worth more than most of your security budget.
Building the enclave
Containment means a defined environment where CUI lives and rules for how it enters and leaves. For lean shops that is usually a compliant cloud tenant, a restricted file structure with real access controls, and a short list of named machines. The rules are unglamorous: CUI arrives through this mailbox, gets stored here, is never forwarded outside the enclave, and flows to subcontractors only through the approved channel. Write the data flow down with arrows. Assessors ask for the diagram, but you need it more than they do.
The spread you have to hunt
Drawing the boundary is half the job; the other half is finding where CUI already leaked past it. Search mailboxes, downloads folders, sync clients, and the personal drive someone used that one urgent weekend. Every discovery is either a migration into the enclave or a documented deletion. Painful once, then maintained cheaply.
Do it before the data decides for you
A boundary drawn early is architecture. A boundary drawn after the data has wandered is archaeology, and archaeology bills by the hour. If you touch DoD contracts, scope this quarter, not the quarter before the assessment.
Drawing your CUI boundary before the assessor does
A tight CUI boundary is the difference between a manageable program and a second full-time job. The control text lives in NIST SP 800-171; the containment architecture — enclave, entry rules, honest diagrams, and the hunt for data that already wandered — is what our compliance practice builds with contractors every month.
Scope this quarter. Archaeology bills by the hour.
