The Situation
In national security, protecting Controlled Unclassified Information (CUI) is critical. A leading Federally Funded Research and Development Center (FFRDC) in the Northeast, known for research and development in advanced technologies, faced challenges understanding how CUI worked across its operations. Edwards Performance Solutions conducted a complete Data Flow Diagramming exercise that uncovered layers of insight and strengthened the FFRDC’s cybersecurity.
The Challenge
At first, the FFRDC was confident it knew where its CUI was and what it included. But because the organization was so spread out, it didn’t yet have a full picture. Unclear system and data ownership, and unclear responsibility for security decisions, made things harder.
Bringing the Right People Together
The exercise brought together division IT managers, the central IT group, and, most importantly, representatives from the Director’s Office. This mix of people led to rich conversations that revealed where CUI lived, what it was, and how it moved. It also showed the need for clearly documented authority and responsibility for CUI across new and existing laboratory systems.
What We Uncovered
The biggest finding was that system ownership and management were spread out, and CUI was used in silos throughout the organization. That prompted important conversations about who is responsible for what, so every system would have a clear owner accountable for its security and data.
Our Approach
Edwards’ experts used targeted stakeholder interviews and advanced data flow diagramming to map data flows and system responsibilities. After each division’s diagrams were complete, they were combined in a central database that identified every CUI data flow and system across the enterprise.
Each division validated its own portion before the final CUI decisions were made. Even though some systems were used by dozens of divisions, this approach made it possible to categorize assets correctly at the enterprise level.
Looking Ahead
The project changed how the organization thinks about controlling information. With clear ownership and responsibility for system security, the FFRDC could look at its structure and how technology assets are managed across the enterprise.
The exercise and its deliverables laid a solid foundation for the FFRDC’s CMMC readiness. With scope defined and assets clearly labeled, the work has moved into Phases 2 and 3: a full gap assessment of the in-scope environment against NIST SP 800-171 and CMMC Level 2.
This progression shows why a well-defined scope and clear asset identification must come before any in-depth security assessment, and how a strategic partnership helps organizations reach and maintain the highest standards of data protection.
