Start with a representative business process
Choose a real contract workflow and describe it without exposing controlled information. A useful example might begin with an authorized project document arriving from a prime contractor and end when the record reaches its approved retention or disposal point. Identify the information category using contract instructions, markings, and appropriate clarification. The National Archives CUI Registry helps identify categories and their authorities; it does not make every file in a defense contractor folder CUI. Keep unresolved classification questions visible so the map does not turn an unverified assumption into a system design decision.
Map the full information journey
For each stage, record the source, destination, user or process, transfer method, and storage location. Include working copies, cached files, temporary exports, collaboration links, mobile access, paper output, removable media, and backups when they occur. Ask whether a preview or synchronization function creates another copy. A high-level arrow from customer to company hides the steps where information can enter an unexpected service. This mapping method is practical preparation guidance. Its value is making processing, storage, and transmission visible enough to support the formal scoping analysis required by 32 CFR 170.19.
Separate logical flow from the network picture
A network diagram explains assets and connections. A data flow map explains what information moves through them and why. The views should agree, but they answer different questions. Two applications can share a network connection while only one approved workflow transfers CUI. Conversely, a manual download and later upload can move a file without an obvious direct system integration. Use common identifiers and a short narrative to connect the views. Record whether a flow is intended, technically possible, observed in practice, or prohibited, because those states can lead to different remediation and scoping questions.
Identify people and provider handoffs
Show where employees, subcontractors, managed services, cloud services, and customers enter the process. Determine whether support personnel can access content or security protection data and which service actually performs the relevant function. Apply the provider and cloud requirements to the particular offering and its configuration. The provider name alone does not establish the handling conditions. Capture responsibilities for approving transfers, correcting an accidental disclosure, removing access, and retaining records. These handoffs are often the points where a technically sound internal process becomes inconsistent because the receiving party follows different assumptions.
Test the proposed boundary with exceptions
Walk through an urgent change request, an absent employee, an external reviewer, and a restore from backup. Ask whether people would use personal email, a general file-sharing service, or an unmanaged workstation to keep work moving. These are illustrative tests, not allegations about any company. If the approved route cannot support ordinary work, address the operating problem before relying on a written prohibition. NIST SP 800-171 Revision 2 requirement 3.1.3 addresses controlling CUI flow under approved authorizations. The map should help the team identify where such authorizations and their enforcement belong.
Turn findings into an actionable record
Assign an owner to each uncertain or unacceptable flow and record what would demonstrate correction. Update the inventory, network diagram, SSP, and provider responsibility records after decisions are made. CMMC Pulsar describes connecting assets, CUI or FCI data flows, diagrams, and documentation; evaluate that workflow using a sanitized process before adopting it for your environment. A readiness adviser can help structure the review, but staff who know the contracts and systems must confirm the facts. Revisit the map whenever a service, information category, subcontractor relationship, or business process changes materially.