Quick answer: CUI data discovery for CMMC compliance is the process of finding, classifying, and mapping every location where Controlled Unclassified Information is stored, processed, or transmitted. It defines the assessment scope for CMMC Level 2, because every system that touches CUI must meet the 110 security requirements of NIST SP 800-171. Accurate discovery keeps that scope as small and defensible as possible.
For MSPs and MSSPs supporting defense contractors, scoping is where most CMMC projects succeed or stall. Many contractors assume CUI lives only in a dedicated enclave, then discover drawings in personal OneDrive folders, export-controlled specs in email, and contract data on shop-floor workstations.
This guide explains what CUI is, how CUI identification works, how to map and scope it for CMMC readiness, and what to look for in CUI data discovery tools.
What is Controlled Unclassified Information (CUI)?
Controlled Unclassified Information is government-created or government-owned information that requires safeguarding under law, regulation, or policy, but is not classified. The CUI program is defined by Executive Order 13556 and 32 CFR Part 2002, and the National Archives (NARA) maintains the official CUI Registry of categories.
For defense contractors, common CUI types include:
- Controlled Technical Information (CTI): engineering drawings, specifications, CAD files, technical data packages
- Export-controlled data: information regulated under ITAR or EAR
- Contract and program information: statements of work, performance data, and pricing marked as CUI
- Critical infrastructure and operations security information tied to defense programs
- Legacy-marked data: documents still labelled FOUO or similar, which may now be treated as CUI
CUI is different from Federal Contract Information (FCI). FCI is basic, non-public contract information and falls under CMMC Level 1. CUI requires the stronger Level 2 protections.
Where does CUI hide?
CUI rarely stays where policy says it should. MSPs commonly find it in engineering workstations, shared network drives, email attachments, Microsoft 365 or Google Workspace tenants, ERP and quoting systems, removable media, and backups. Every one of these locations affects CMMC scope.
Why does CUI data discovery matter for CMMC compliance?
CUI data discovery matters because CMMC scope follows the data. The CMMC rule (32 CFR Part 170) classifies assets by their relationship to CUI, and every in-scope asset must be documented in the System Security Plan and assessed against NIST SP 800-171.
The five CMMC asset categories are:
- CUI Assets: process, store, or transmit CUI, and are assessed against all applicable requirements.
- Security Protection Assets: provide security functions for the CUI environment, and are assessed for the relevant requirements.
- Contractor Risk Managed Assets: can handle CUI but are not intended to, and are documented and reviewed in the SSP.
- Specialized Assets: IoT, OT, test equipment, and government property, which are documented in the SSP.
- Out-of-Scope Assets: cannot handle CUI and are isolated from it, so they are not assessed.
Without accurate CUI identification, contractors either under-scope, which risks a failed assessment or a false compliance claim, or over-scope, which drives up cost by bringing unnecessary systems into the enclave.
Where CMMC stands in late 2026
CMMC Phase 1 began on November 10, 2025, and requires Level 1 and Level 2 self-assessments where contracts call for them. Phase 2, which would have made third-party C3PAO certification the default for CUI contracts from November 10, 2026, was suspended by the Department of War on July 13, 2026, pending a CMMC Reform Task Force review (WilmerHale). A September 3 class deviation made that pause binding on contracting officers (Nextgov/FCW).
The suspension removed a date, not the obligation. DFARS 252.204-7012, NIST SP 800-171, SPRS scores, and annual affirmations still apply, and inaccurate self-assessments carry False Claims Act risk. Accurate CUI scoping is just as important for an honest self-assessment as for a third-party one. Check the DoD CIO CMMC page for the latest status.
How to identify, map, and scope CUI for CMMC readiness
MSPs can use this three-stage process to move a client from "we think CUI is in the enclave" to a documented, defensible scope.
Stage 1: Identify CUI
- Review contracts and flow-downs. Check DFARS clauses, DD Form 254s, and CUI markings to learn which CUI categories the client actually receives.
- Interview data owners. Engineering, contracts, quality, and purchasing teams know which files arrive from the government or primes.
- Scan for CUI at scale. Search file contents across endpoints, servers, and cloud tenants for CUI banner markings, legacy markings, export-control notices, drawing numbers, and contract identifiers.
Stage 2: Map CUI
- Build a CUI data map. Record every location where CUI was found, how much, who owns it, and who can access it.
- Trace data flows. Document how CUI enters, moves through, and leaves the environment, including email, file transfer, and partner portals. This compliance data mapping feeds directly into the SSP and network diagrams.
Stage 3: Scope and reduce
- Categorize assets. Assign every system to a CMMC asset category based on the data map.
- Consolidate and clean up. Move stray CUI into the protected enclave, delete unnecessary copies, and tighten permissions. Every removed copy can shrink the assessment scope.
- Monitor continuously. CUI spreads as people work. Recurring discovery scans catch new CUI outside the boundary before an assessor or an incident does.
What should MSPs look for in CUI data discovery tools?
The right CUI data discovery tools make scoping faster, more accurate, and repeatable across many defense clients. Key capabilities to evaluate:
- Custom classification rules: CUI does not follow a universal pattern like a credit card number, so tools must support custom markings, drawing-number formats, and keyword dictionaries.
- Broad coverage: scanning of endpoints, file servers, Microsoft 365, and cloud storage, including GCC High tenants where relevant.
- Continuous discovery: scheduled or ongoing scans rather than a single point-in-time snapshot.
- Access and exposure context: visibility into who can reach each CUI file and whether the host has known vulnerabilities.
- Asset-level mapping: findings tied to specific assets so they can be categorized for CMMC scope.
- Evidence-ready reporting: exports that support the SSP, POA&M, and assessor questions.
- Multi-tenant management: one console to run and compare discovery across all client environments.
A tool alone does not determine scope. MSPs should combine automated discovery results with contract review and data-owner input before finalizing the CMMC boundary.
Frequently asked questions
Is CMMC still required after the Phase 2 suspension?
Yes, in part. Phase 1 self-assessment requirements remain in effect where contracts include them, and DFARS 252.204-7012 still requires NIST SP 800-171 protections for CUI. Only the planned expansion of mandatory third-party assessments is paused.
What is the difference between CUI and FCI?
Federal Contract Information is non-public information provided by or generated for the government under a contract, and it falls under CMMC Level 1. CUI is a narrower, more sensitive set of information defined in the CUI Registry, and it requires CMMC Level 2 protections.
How do you identify CUI if documents are not marked?
Start with the contract and its DFARS clauses, then ask the government customer or prime contractor for guidance. Discovery scans can also flag likely CUI by content, such as technical drawings, export-control language, or program identifiers, for human review.
Can MSPs be in scope for a client's CMMC assessment?
Yes. If an MSP's tools or staff can access the client's CUI environment, those services are typically treated as security protection assets or external service providers, and they must be documented in the client's SSP.
How often should CUI discovery be repeated?
Continuously or on a recurring schedule. CUI moves every time someone saves, emails, or syncs a file, so a one-time scan quickly becomes outdated.
Key takeaway
CMMC scope follows the data. Whatever the final Phase 2 timeline turns out to be, MSPs that identify, map, and continuously monitor CUI give defense clients a smaller, defensible scope, more accurate SPRS scores, and a faster path to certification when third-party assessments resume.
