What CUI scope creep costs you
Under 32 CFR Part 170, an asset is out of scope only when it cannot process, store, or transmit Controlled Unclassified Information because it is physically or logically separated from the systems that do. That definition is the whole game. The moment CUI lands on a system outside your boundary, that system is in scope, whatever the network diagram says.
And in scope is not a label; it is a workload. Every additional system inside the boundary carries its share of implementing, documenting, and evidencing the 110 NIST SP 800-171 requirements: its baseline, its logging, its access reviews, its place in the system security plan. A CUI repository quietly syncing to an unscoped file server has not leaked data yet. It has already leaked scope, and the bill for that shows up at assessment time as either an expanded boundary or a finding.
The operational lesson: scope is a control you operate, not a line you drew once. Controlled interfaces, endpoint restrictions, and user training exist to keep CUI inside the boundary, and the boundary is only as real as those controls. Re-map when contracts change, because the footprint that justified the boundary in year one may not describe the business in year three.
This week’s post covers the decision that sets the boundary in the first place: enclave, or full government cloud.
