The two are easy to mix up, but they answer different questions. A network diagram shows what you have and how it's connected. A data flow diagram shows where your sensitive information actually goes.

Your network diagram should include, at a minimum:

• User workstations
• Servers
• Virtual machines
• Networking equipment (switches, routers, wireless access points, and firewalls)
• Connections to Software as a Service (SaaS) applications and other external services

Focus on Architecture, Not Detail

The goal is to show how your environment is built, not to document every cable. You don't need IP addresses, the switch port each cable lands on (Ge 1/0/1), or an exact count of devices. Ten identical workstations can be one icon labeled "Engineering workstations." A diagram that's too detailed goes out of date quickly and buries the architecture an assessor actually needs to see.

Account for Remote and External Connections

Next, identify every type of connection that reaches into your boundary from outside it:

• Remote connections — your own users who are physically outside the system boundary, such as employees working from home or traveling
• External connections — users or organizations outside your company who have access into the boundary, such as an MSP, a vendor, or a prime contractor

VPNs are commonly found on both. Each of these connections is a path into your environment, so each one needs to be on the diagram and accounted for in your controls.

Your data flow diagram should clearly show how FCI and CUI move through your environment — where it comes in, where it's stored and processed, who touches it, and where it leaves. For a deeper dive, see our full guide to building CMMC data flow diagrams.

Here's a three-step process to constructing the diagram:

• Add the elements — in your drawing program of choice, place every user role that handles FCI or CUI, plus the endpoints, servers, applications, databases, cloud services, and external partners involved
• Draw the boundaries — box those elements to represent physical sites, internal zones, enclaves, external networks, and so on; the box around everything that stores, processes, or transmits CUI is your assessment boundary
• Connect the flow — link the boxes with lines and arrows to show how and where data moves, and label each line with how the data travels (email, SFTP, portal upload, removable media)

As you connect the flow, note the state of the data at each point — at rest, in transit, or in processing. That context determines how controls such as encryption and access control need to be applied.

Once you have both diagrams, lay the data flow over the network. Every system that stores, processes, or transmits CUI — plus the systems that protect them — falls inside your assessment boundary. Everything else can potentially be kept out of scope, as long as it's properly separated.

In this example, CUI enters by email, is worked on at engineering PCs and stored on a file share, and leaves only through an upload to a government portal. The corporate network never touches CUI, so it stays outside the boundary — which shrinks the number of systems the controls have to cover.

This is where many organizations find savings. Building a smaller CUI enclave, rather than bringing the whole company into scope, can dramatically reduce the cost and effort of compliance. But that only works if your diagrams prove CUI really stays inside the box.

• Keep it simple — if your team can't read the diagram in a minute, an assessor won't either; group like devices and cut detail that doesn't change scope
• Use consistent symbols — pick one icon for each kind of process, data store, and flow, use it everywhere, and add a legend
• Don't forget the human paths — printed drawings, USB drives, and phone photos of CUI are data flows too; if it happens, it goes on the diagram
• Include SaaS and cloud — email, file sharing, and collaboration platforms are some of the most common places CUI ends up, and some of the most commonly missed
• Annotate your controls — mark where encryption, MFA, firewalls, and other protections apply along each flow to show the assessor how your controls map to real data
• Involve the people who do the work — IT knows the network; contracts, engineering, and finance know where the data actually goes
• Keep them current — update both diagrams whenever you add systems, vendors, or workflows; a significant change to your scope or boundary may require another third-party assessment