Phase 1: Scoping

Goal: Before configuration, you must understand where your Controlled Unclassified Information (CUI) lives, who interacts with it, and which third parties are responsible for its protection.