CUI rarely lives in one tidy, well-labeled location. It arrives through email attachments and government portals, spreads into working files and backups, and travels to subcontractors. Most organizations that map their CUI flows for the first time are surprised by where it turns up.

Proper scoping turns "we handle CUI" into a precise, documented boundary: which contracts bring CUI in, which systems and people touch it, and where it flows from arrival to destruction. Every downstream investment depends on this scoping foundation: your security controls, your System Security Plan, and the self-assessment score you submit to SPRS.

This section covers two essential questions: first, how to know whether you handle CUI based on your contracts and the information you receive. And second, how to scope your environment by mapping how CUI actually flows. You'll also learn how to deliberately limit your CUI footprint to reduce cybersecurity costs and narrow your compliance obligations.