Scoping comes before anything you buy

// 01 · THE FLOW

Map the data's life

Trace it through 5 stages, with the people who touch it rather than from the org chart:

• Arrive: the prime's portal, email, a file transfer
• Rest: file shares, project folders, the ERP, SharePoint, a desktop
• Work: engineering workstations, CAM stations, the estimator's laptop
• Leave: to your own subs, back to the prime
• Echo: backups, sync clients, archived mailboxes, the cloud recycle bin

The official process says drawings live on the project share. The engineer has a copy in Downloads, a marked-up one in email, and a photo on a phone from the shop floor. Map the real one; the assessor will find it either way.

// 02 · CATEGORIES

What's in scope

Systems that store, process, or transmit Specified Information are in, full stop. Systems that protect them (the domain controller, the firewall, the backup server, the endpoint console) ride along inside the boundary. Systems kept away from the data by real technical separation can sit outside, and the word doing the work is real: a VLAN with an any-to-any rule between segments is a diagram, not a separation. PSPC publishes a Level 1 scoping guide, and these categories follow it and the practice the 800-171 family has used for years.

// 03 · SHRINKING IT

Shrink the footprint

1. Consolidate storage onto one project share or enclave server.
2. Contain email with a managed transfer tool or a dedicated project mailbox, and give people an easy alternative to emailing drawings, because rules without one lose to deadlines.
3. Separate the enclave with its own segment, firewalled at the edge, its own workstations or virtual desktops, and its own backup job.
4. Purge the echoes, after checking the contract's records retention clause; data that must be kept gets archived into the enclave instead of deleted.