Practical checklist
Controlled-data program discovery guide
Before choosing a platform, organize the contract obligations, data flows, people and suppliers that shape the program. Start with broad business information; share controlled data and sensitive records only through an agreed secure channel.
The challenge
Start by understanding the information you handle.
CUI, CDI or ITAR-related information does not answer every contract or access question. Identify the actual obligation, where the data moves and who may operate the systems before selecting the design.
Work through these checks
- Identify the contract owner and actual clauses/flow-downs.
- Distinguish FCI, CUI/CDI categories and export-controlled data.
- Confirm the required framework revision and assessment route.
- Map the data boundary, devices, identities and providers.
- Identify support tooling, ticket/log content and backup locations.
- Determine authorized personnel, regions and transfer permissions.
- Name program, system, reporting and risk-acceptance owners.
- Inventory policies, SSP/control records and available evidence.
- Track gaps with owners and realistic remediation dates.
- Agree recurring checks, assessment preparation and incident rehearsal.
Questions to bring to discovery
- Who decides classification and export permissions?
- Which supplier or support queue can touch restricted data?
- Who signs an affirmation or submits an official report?
The intended result
Organize the obligations before choosing the platform.
Use the guide to identify your contract contact, the types of information involved and the systems that handle them. Share sensitive records only through the secure channel agreed with your team.
Build the program from its actual obligations.
Bring your completed questions to a conversation about the requirements, responsibilities and next steps for your organization.