CUI Flow Mapping Template
Filled in by the people who handle each information type day to day, with IT recording the systems, this template traces one type of Controlled Unclassified Information (CUI) from the moment it arrives to the moment it is destroyed or returned. It produces one flow per information type: each stop, the system or location at that stop, who is responsible for it, what protects it there and whether it crosses out of the environment you intend to control. Those flows are what turn a list of information into a scope boundary.
- 01
Take one row from your CUI Identification Worksheet (CMMCg-R001). One information type per flow; do not merge them, because they rarely travel the same route.
- 02
Read the three example flows first. They show the shape of a real answer, and how many stops a "simple" flow actually has.
- 03
Walk the lifecycle in order, receipt, processing, storage, transmission, sharing, disposition, and write one row per stop. Ask the person at each stop what they actually do, including the workaround they use when the approved route is slow.
- 04
For every row, answer "Leaves boundary?" as yes, no or unknown. A yes is not wrong; it is a place where scope, a contract clause or a control has to be settled.
- 05
Repeat for each information type. When every flow is drawn, list the stops that appear on more than one flow; those systems are the core of your CUI environment and go straight into the Scoping Worksheet (CMMCg-R003).
4 working tables, 1 checklist, 1 set of fields, a findings section and recommended next steps. Every page carries the resource number, the version and the licence.
- Example flow A — Manufacturing
- Example flow B — Construction
- Example flow C — Consulting
- Your flow
- Flow map
- Before you call this flow complete
- List every system that appears on two or more flows; that shared set is the centre of your CUI environment.
- For each "Yes" under Leaves boundary?, decide whether the stop comes inside the boundary, is removed from the flow, or is covered by a contract clause with the outside party.
- Carry the systems, people, locations and external parties from every flow into the CMMC Scoping Worksheet (CMMCg-R003).
This resource is general guidance for organizations preparing for Cybersecurity Maturity Model Certification (CMMC). It is not legal advice, it does not constitute an assessment or a certification, and completing it does not by itself establish compliance with NIST SP 800-171 Rev 2, 32 CFR Part 170 or any contract clause. Determinations about what information constitutes Controlled Unclassified Information (CUI) rest with the designating agency and the terms of your contract. Confirm requirements against the current regulation and your contracting officer.
Filled it in and found gaps?
That is what it is for. The readiness call turns a completed worksheet into a scoped plan, and an engineer runs it.
- Your CUI boundary sketched on the call
- The requirements costing you the most points, named
- A written summary afterward, yours to keep
NDA signed before anything technical. No cost, no obligation.