Terms / Certification
Data flow diagram
A drawing of how CUI moves through your organization. It is the artifact that makes a scoping decision defensible, and it is usually done first.
Also called data flow diagrams, CUI data flow.
Practitioner Guidance
What it means in practice
A data flow diagram follows the information, not the equipment.
It shows where controlled information enters, who handles it, what systems it passes through, where it rests, and where it leaves. A network diagram shows the environment. This one shows the reason the environment is in scope. The two answer different questions and an assessment goes better with both.
Map the flow first, because it decides the scope.
Almost every scoping mistake comes from an unmapped flow: a mailbox nobody counted, a supplier portal, a personal phone, a printer, a quoting system that receives the drawing. Start with the contract and ask who sends what, who opens it, and what happens next. The answers reliably surprise the owner.
The flow shows you where to cut, which is where the savings are.
Once you can see the path, you can shorten it. Route arrivals into one place, stop the copy that lands in a second system, take one team out of the path entirely. Each removal takes assets out of scope. This is the work that makes an enclave small enough to be worth building.
Include the end of the flow, because retention extends your scope in time.
Where the information goes at the end of a contract matters. Archives, backups, and old project folders all hold it, and the systems holding them are in scope while they do. Decide what you keep and for how long, and write it down. MP.L2-3.8.3 asks you to sanitize media before you dispose of it.
What falls short
- A flow diagram that starts at your firewall. The flow starts where the information enters the company, which is often a mailbox.
- A diagram of intended flows rather than actual ones. Ask the people doing the work how it really moves.
- A flow that ignores paper. Printing is processing, and a printed drawing is stored somewhere.
Edge cases
- The information never arrives digitally. The flow is still worth drawing, and the systems in scope may be a locked room and a log.
- You generate the controlled information yourself rather than receiving it. The flow starts at the system that creates it.
- A provider sits in the middle of the flow. That is an external service provider, and the flow shows exactly what it handles.
Over-engineering
- A formal modeling notation. Boxes, arrows, and labels that name the information are enough.
- A diagram per document type. One flow per contract or program is the useful unit.