You control CUI flow so it doesn’t leak to unauthorized systems, users, or locations. This isn’t just about locking down a folder. It’s about closing every path the data could take to escape your boundary.
What the assessor is actually evaluating
Data movement paths. The assessor wants to see you’ve identified every way CUI could move through your environment: email, cloud storage, removable media, print, inter-system transfers, even copy-paste. Then you’ve blocked the ones you don’t want.
Your CUI boundary. CUI flow control enforces the boundary you drew in SC.L2-3.13.1. The assessor checks that CUI can’t drift outside that boundary through careless user actions or misconfigured permissions.
Technical controls in place. DLP rules, email encryption, sensitivity labels, conditional access policies, AppLocker, or USB device restrictions. The control must be active and logged, not just a policy someone wrote.
What users actually do. The assessor will ask what happens when someone tries to forward a CUI email to their personal Gmail, save a labeled file to OneDrive, or copy sensitive data to a USB drive. Your controls should stop it or alert you.
SSP language that works
All CUI is classified with a sensitivity label that triggers data loss prevention rules. Users cannot email CUI outside the organization, print CUI, or save labeled files to personal cloud accounts (OneDrive, Dropbox, Google Drive). Conditional Access policies require multi-factor authentication for any system access and block sign-in from unmanaged devices. USB and removable media are disabled for all users handling CUI. We audit CUI flow at least quarterly through DLP reports and maintain a log of blocked and quarantined transfers. Any attempt to move CUI outside the boundary is logged and reviewed by the information security officer.
Why this matters for your assessment
Small contractors often think “we keep CUI in a secure shared folder” and stop there. But the assessor won’t. They’ll ask: Can someone email a file out? Can they copy it to their personal OneDrive? Can they save it to a USB drive or cloud sync? If any of those are yes, you’re not controlling flow.
For most small contractors, the practical implementation is USB read/write blocking (via Intune or Group Policy) and personal cloud storage blocking (usually through DNS filtering or web content filtering that blocks Dropbox, personal Google Drive, personal OneDrive, etc.). As long as those controls are defined in your SSP and actually enforced, that’s sufficient. You don’t need a full Microsoft Purview DLP deployment if simpler controls close the same paths.
GCC High and commercial split. If CUI lives in GCC High and you also have a commercial tenant, the assessor needs to see that CUI can’t flow between them. This means separate accounts for the GCC High tenant (not the same credentials as commercial), and policies preventing autoforwarding from GCC High accounts to commercial accounts. Separate endpoints is ideal but not always required. The key is account separation and policy enforcement that prevents CUI from drifting to the commercial side.
How to present your evidence
Walk the assessor through a real CUI file. Show the sensitivity label. Explain the DLP rules tied to it. Demo what happens when someone tries to email it or copy it somewhere unauthorized. Show the audit logs of attempted and blocked transfers. Pull up your conditional access policies showing what environments CUI users can access. Have your email encryption settings ready.
The assessor wants to see you know your own data movement. Not just the policy. The working implementation.
Common failures
Failure. You have a DLP policy written in your SSP but it's not actually enabled in Microsoft Purview. The assessor checks the tenant and finds no active rules. You lose this control.
Failure. CUI lives in a secure SharePoint folder with proper permissions, but any user with access can forward it to their personal email. No email rules block it. The boundary isn't enforced.
Failure. You claim users can't print CUI but Group Policy settings aren't applied to all devices. Some machines still allow printing. Enforcement is inconsistent.
Success. You show an active Purview DLP policy blocking external email for files tagged "CUI." You pull up the policy wizard, show the rule conditions, and point to the block action. You then pull up the DLP reports showing dozens of blocked emails in the last 90 days with quarantine records.
Success. You explain that CUI users can only access systems within your GCC High tenant. Conditional Access policies block sign-in to the commercial tenant entirely. You show the policy applied to the CUI user group.
Q&A: What the assessor asks and what good answers sound like
Keep answers short. Show the evidence, don't describe it. Let the assessor drive. For more on how to present in the assessment room, see How to Present Evidence in the Assessment Room.
If you use an MSP or MSSP
Clarify in your SSP who owns CUI flow controls. If your MSP manages your Microsoft 365 tenant, they should manage DLP policies and conditional access. Get a signed statement from them confirming:
- What DLP policies they’ve enabled for your organization
- What conditional access policies are in place
- What they log and monitor for CUI transfers
- How often they review DLP reports
- What you’re responsible for (end-user training, internal procedures) and what they’re responsible for (technical controls, audits)
You’re still accountable for the control. Make sure you get copies of the audit logs and reports.
This page reflects NIST SP 800-171 Rev 2 requirement 3.1.3 and CMMC Level 2 expectations. Assessment outcomes depend on your specific environment, tools, and implementation details. Always verify your controls work before your assessment.