Identify the information, trace its movement, and resolve classification questions with the appropriate contract or information owner. File type, company size, and a confidentiality label alone do not determine the CMMC scope.
Bring one real workflow into the room
Choose a representative contract workflow, such as receiving a work package, preparing a deliverable, and returning it to the customer. Invite an operations owner, an IT representative, and someone responsible for the contract. A small working group that understands actual behavior is more useful than a diagram built from guesses.
FCI broadly concerns nonpublic information provided by or generated for the government under a contract, with exclusions such as public information and simple payment transactions. CUI has a separate government safeguarding basis. Do not classify an entire environment by guessing from a document's filename.
A 60-minute workshop agenda
- First 10 minutes: identify the contract, workflow, data owner, and questions about the information.
- Next 15 minutes: draw where information enters, is opened, is edited, and leaves.
- Next 15 minutes: add email, local downloads, shared folders, mobile access, printers, backups, and outside support.
- Next 10 minutes: mark uncertain classifications and undocumented handoffs.
- Final 10 minutes: assign owners and dates for resolving each uncertainty.
Use a decision log alongside the diagram
For every information flow, record its business purpose, source, destination, users, system owner, information classification, and basis for the classification. Use “unresolved” when evidence is missing. It is better to preserve a question than to turn an unsupported guess into a scope decision.
Illustrative example: a public solicitation is downloaded into a research folder, while a nonpublic performance file arrives in a separate working mailbox. Those two items should not automatically receive the same treatment simply because both relate to the same contract. Resolve the applicable obligations for each flow and each system.
Look for the handoffs people forget
- Files forwarded to personal accounts to finish work after hours.
- Attachments copied into a ticketing system for technical support.
- Document previews and synchronized folders on additional devices.
- Administrative access used by a managed service provider.
- Subcontractor exchanges that differ from the prime contractor's documented process.
These prompts are a discovery exercise, not a finding that every named system is automatically in scope. Apply the level-specific scoping rules, including the relevant asset categories and service-provider requirements.
Turn the discussion into three deliverables
Finish with a draft data-flow map, an asset-and-owner list, and a decision log. Give each a version date and an accountable owner. Revisit them when an application, service provider, location, or contract workflow changes. A diagram is useful when it drives a maintained decision record.
Use the resulting map to frame a scope discussion with Federal Bid Partners (FBP). If you explore CMMC Pulsar, assess how the workspace fits the workflow your team actually uses. Do not mistake an AI-generated diagram for a verified description of your environment.
Common questions
Does every business-confidential file count as CUI?
No. Business confidentiality by itself does not establish the government safeguarding basis for CUI. Resolve uncertain cases with the appropriate information or contract owner.
Can a diagram determine scope by itself?
No. The diagram should record decisions supported by the applicable rules, contract information, and verified system behavior.
Sources and further reading
Check the current source, applicable contract, and official process before relying on a requirement. Suggested workflows are practical working methods and do not replace official instructions.