Scoping Your CUI Boundary: Discovery Methods, Remediation Paths, and the Numbers That Decide

Why scope is the most expensive decision you'll make

In a CMMC Level 2 program, teams obsess over tools. But the decision that dominates cost — one-time and for years after — is how big you draw your CUI boundary.

Scope drives three expensive things at once: how many users need compliant (often premium) licenses like Microsoft 365 GCC High; how large and costly your C3PAO assessment is; and how much CUI you must protect, monitor, and answer for. Every asset inside the boundary has to meet all 110 NIST SP 800-171 controls.

Step one: find where CUI actually lives

You cannot scope a boundary around data you cannot locate. There are three ways to find CUI, and most programs need more than one.

The traceability cascade (contract → data)

The top-down method. Start from the contracts that carry CUI and DFARS 7012, then trace down the chain:

1. Contract — which awards actually carry CUI obligations?
2. Personnel — who works those contracts?
3. User accounts — which accounts do those people use?
4. Systems — which systems do those accounts touch?
5. Data locations — where does the data land?
6. Data — what CUI is actually there?

Strengths: it's defensible, ties every in-scope asset to a contractual obligation, and produces exactly the documentation an SSP and an assessor want. Weakness: it maps where CUI is *supposed* to be — it misses the shadow copies: the email attachment, the desktop download, the personal cloud drive, the file share nobody remembers.

Interview-only

Ask people where the CUI is. Cheap and fast — but self-reported scope is almost always *under*-inclusive. Staff genuinely don't know everywhere CUI has traveled, and there's a quiet incentive to keep scope (and cost) small.

Digital discovery (a CUI tool such as Teramis)

Purpose-built CUI digital discovery tools such as Teramis scan endpoints, file shares, email, and cloud repositories for CUI — by controlled markings, keywords, and sensitive-data patterns — and report where it actually is. They turn “we think” into “here it is, on 214 endpoints and 9 shares.”

Strengths: ground truth. It finds the shadow copies the cascade and interviews miss, produces defensible evidence, and — crucially — enables *surgical* remediation because you now have a file-level map. Weaknesses: tool and analysis cost, tuning to control false positives, and it's a point-in-time snapshot unless you keep it running.

What discovery tells you: the five asset categories

Once you know where CUI lives, CMMC's Level 2 scoping guidance sorts everything into five categories. This is the language your assessor uses, and it's how you translate “where the data is” into “what I have to protect.”

Your scoping strategy is, in effect, a campaign to move as much as *safely* possible out of the CUI-Asset column — because that column is where the cost is. That is exactly what enclaves and segmentation do.

Step two: fix it — four remediation and architecture paths

Discovery tells you the size and shape of the problem. Now you choose how to solve it — four paths, roughly in order of cost and blast radius.

1. Surgical file-based remediation

Using the file-level map from digital discovery, review each CUI location and eliminate, consolidate, quarantine, or correctly relabel it — pulling CUI out of places it never should have been and shrinking the footprint *before* you architect anything. Best when CUI is incidental and consolidatable: a modest number of files that drifted into the wrong places. Its hard limit: it's point-in-time and doesn't stop new CUI from being generated tomorrow, so it's almost always a precursor to an enclave, not a replacement for one.

2. User-account enclave (account-level migration)

Stand up a separate, hardened environment (commonly Microsoft 365 GCC High or equivalent) and migrate only the *users who handle CUI*, plus their data, into it. Everyone else stays in your existing commercial environment. The enclave becomes your assessment boundary. Best when CUI work is concentrated in a subset of staff — and it's the single most effective lever on recurring cost, because you license only enclave users for the premium environment.

3. Program / data-level segmentation

A variant of the enclave organized around *programs* or *data sets* rather than named users. When one or two contracts carry the CUI, you build the boundary around that program's data and the people and systems that touch it. Same cost logic as the enclave; the organizing principle is the contract/program instead of the individual.

4. Enterprise migration

Move the *entire* organization into the compliant environment. Everyone gets a premium license; there is no commercial-side boundary to police because there is no commercial side. Best when CUI is genuinely pervasive — so many users and systems touch it that carving an enclave would be more expensive and more fragile than moving everyone. Highest recurring cost, lowest boundary-management complexity, and the lowest residual risk of CUI escaping the boundary (there's nowhere outside it to escape to).

The numbers: the ratios that should decide it

Preference and vendor pitches shouldn't decide this — two ratios and a time horizon should.

The master lever: your in-scope user ratio

Recurring cost is dominated by how many people you license for the premium environment. Compliance-grade government-cloud seats run materially higher than commercial — illustratively on the order of ~$40–$70+ per user per month for the compliance SKUs, versus a fraction of that commercially. So the ratio that moves the most money is CUI users ÷ total users.

Rule of thumb: if your CUI-user ratio is under ~30%, an enclave or segmentation almost always wins on total cost. Above ~60–70%, enterprise migration is often *simpler and comparable*, because the enclave you'd build would license most of the company anyway while adding boundary-management overhead.

The second lever: CUI density and sprawl

Two measures from digital discovery: how *many* files and locations hold CUI, and how *concentrated* they are. Low density and few locations favor surgical remediation plus a small enclave. High sprawl across most of the org tips toward enterprise migration, because the labor to chase and contain sprawl can exceed the cost of just moving everyone.

The time horizon: recurring beats one-time

Compliance TCO is dominated by *recurring* license and management cost, not the one-time build. Look at a 3-year TCO, not the invoice in front of you. A cheaper migration that over-provisions premium seats can cost far more over three years than a pricier enclave that licenses a quarter of the staff.

The crossover point shifts with your user ratio and sprawl — but notice what's driving the gap: three years of premium licensing, not the build. That's why the user ratio is the master lever.

The asymmetric downside: the cost of getting scope wrong

This is the ratio nobody wants to model, and everybody should. Cheap, interview-only scoping that undersizes the boundary risks a failed or delayed C3PAO assessment (re-work, re-assessment fees, a slipped or lost award), or an unprotected-CUI breach carrying DFARS 7012 72-hour reporting, remediation, and potential False Claims Act exposure for having attested to a score you didn't actually meet. Against those six- and seven-figure downsides, $20–$75k for digital discovery is cheap insurance — and it usually *saves* money by right-sizing scope, not just de-risking it.

Risk: level and mitigation in each scenario

Cost is only half the decision. Each path carries a different residual risk and demands different guardrails.

How to actually decide

1. Discover for real. Run the cascade for defensibility and digital discovery for ground truth. Treat interviews as hypotheses only.
2. Measure the two ratios. CUI users ÷ total users, and CUI density / sprawl.
3. Remediate the incidental first. Use surgical remediation to pull CUI out of places it never belonged — this can shrink scope *before* you architect and lowers every downstream cost.
4. Pick the architecture by the ratios, not the pitch. Under ~30% CUI users → enclave / segmentation. Over ~60–70% or pervasive sprawl → consider enterprise migration. Program-concentrated CUI → segmentation.
5. Model 3-year TCO — including the guardrails, and the downside of getting scope wrong.
6. Manage scope as ongoing. It drifts. Re-scan, recertify access, and keep the SSP and asset inventory current.

Key takeaways

• Scope size is the master cost driver — it sets your licensing, your assessment size, and your liability. Draw it exactly, and prove it.
• Interview-only scoping is the most common way to undersize a boundary. Layer a traceability cascade (defensible) with digital discovery (ground truth).
• Discovery sorts assets into five CMMC categories; good scoping moves as much as safely possible *out* of the CUI-Asset column.
• Four fixes — surgical remediation, user enclave, program segmentation, enterprise migration — chosen mainly by two ratios: CUI-user share and CUI sprawl.
• The in-scope user ratio is the biggest lever on recurring cost: under ~30% favors an enclave; over ~60–70% favors migration.
• Model 3-year TCO, not the invoice — recurring licensing dominates.
• The cheapest-looking scoping carries the most expensive downside. Digital discovery is cheap insurance that usually pays for itself by right-sizing scope.