You can't implement CMMC until you know which areas of your organization are actually subject to its requirements. A network diagram of your architecture, paired with a data flow diagram for CUI, keeps you from pouring resources into the wrong places — or missing the right ones.

Building a Network Diagram

Your network diagram should include, at a minimum:

• User workstations
• Servers
• Virtual machines
• Networking equipment (switches, routers, wireless access points, and firewalls)
• Connections to Software as a Service (SaaS) or other external services

When building the network diagram, focus more on the architecture rather than the details. You don't need IP addresses, the port position of cables on switches (Ge 1/0/1), or the exact number of devices represented on the network diagram.

Additionally, you'll need to determine the types of remote and external connections that have access into the boundary. Remote connections include internal users located physically outside the boundary of the system, and external connections include external users or organizations who have access into the boundary of the system. VPNs are commonly found on both remote and external connections.

Building a Data Flow Diagram

When it comes to building your data flow diagram, it should clearly show how Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) move through your environment.

Here's a three-step process to constructing the diagram:

• Add the elements — represent users who handle CUI/FCI, endpoints, servers, applications, databases, cloud services, and external partners in your drawing program of choice
• Draw the boundaries — box these devices to represent physical sites, internal zones, enclaves, external networks, and so on
• Connect the flow — link these boxes with lines to show how and where data is moving

It's critical to lay the groundwork before you start implementing controls. Your asset inventory should document every system and network-connected device within scope and categorize each by type.

At a minimum, your asset inventory should contain:

• System Name
• Asset Type
• Description
• Operating System or Firmware Version
• Location
• Model Number
• Serial Number

You'll also need to conduct a CMMC Asset Categorization. To do so, identify which of the following categories each of your devices fall into:

• CUI Assets — assets that process, store, or transmit CUI
• Security Protection Assets (SPA) — assets that provide security functions or capabilities to the OSA's CMMC Assessment Scope
• Contractor Risk Managed Assets (CRMA) — assets that can, but are not intended to, process, store, or transmit CUI because of security policy, procedures, and practices in place; these assets are not required to be physically or logically separated from CUI assets
• Specialized Assets (SA) — assets that can process, store, or transmit CUI but are unable to be fully secured, including IoT, IIoT, Operational Technology (OT), Government Furnished Equipment (GFE), Restricted Information Systems, and Test Equipment

MFA is one of the highest-value controls because it significantly reduces risk across users, administrators, remote access, and cloud systems.

Follow these tips for successful MFA implementation:

• Prioritize privileged accounts first if implementation must be phased
• Simplify enforcement through centralized identity platforms such as Active Directory, Entra ID, and SSO
• Cover workstations, servers, SaaS, VPN/remote access, mobile devices, and administrative tools

Most organizations have MFA somewhere, but not everywhere it needs to be. Make sure to avoid these common gaps:

• Local administrator accounts are forgotten
• Break-glass accounts are not monitored or secured
• Service accounts are not reviewed or properly restricted
• Remote maintenance connections are not protected with MFA
• SaaS applications exist outside of SSO
• VPN access has MFA, but admin portals do not
• Mobile device access is not fully controlled
• Legacy systems cannot support MFA and need compensating controls

Baseline security configurations create a consistent standard for securing systems.

To ensure consistent enforcement, we recommend applying settings through centralized tools such as GPO, Intune, MDM, or configuration management platforms. Also be sure to use established standards like CIS Benchmarks or DISA STIGs instead of deciding individually which settings "seem important." These standards provide a tested, repeatable security baseline and reduce the risk of overlooking critical configurations.

When establishing baseline security configurations, avoid these common gaps:

• Not applying baselines across all Windows, Linux, macOS, servers, and workstations
• Overlooking critical security or auditing settings when configurations are based on personal preference