Data flow mapping

One row per hop, pointing at real inventory rows.

Field names as they appear in the base. Blue fields are written by the scoping engine and overwritten on every run; hand edits do not survive.

Why it is shaped this way

• Hops, not flows. A flow with a multi-link to five systems loses the order, and the diagram generator needs edges. Rows sharing a Flow Name compose into a path by Step, numbered in tens so a forgotten hop slots in later.
• The regulation's own verbs. Action is Process / Store / Transmit, the wording the CMMC asset definitions use. The first draft used received / stored / processed / disseminated, and the engine could never have mapped those onto the categories cleanly.
• SPD is a data type. A service that only ever sees logs or configuration is still in scope as a Security Protection Asset. A CUI-only enum would have hidden it. None hops exist to help prove a system is separated.
• Source equals destination is allowed. A Store hop can point at one asset on both ends. "It comes to rest here" is a different fact from "it moved here".
• Outside parties are free text, not inventory. The prime or a subcontractor goes in External Endpoint with the link left empty. Anything named there is treated as not the client's, so parking an uninventoried system there would silently corrupt scope. csp_scope.py flags any endpoint receiving CUI or SPD, and any name that looks like a leveraged cloud (GCC High, GovCloud and similar), because a cloud the client controls belongs inside the boundary. A false positive costs a review; a false negative under-scopes.
• Inventory first. A hop can only link to an asset that exists, so the technology inventory (2b) is filled before flows (2c).

How the interview fills it

1. Name the flow by the business event, in the "Interview: CUI data flows" view (grouped by flow, ordered by step).
2. Walk it forward one hop at a time, setting data type, verb, source and destination on each row.
3. Log the boundary crossings explicitly: the first hop in and the last hop out.
4. Walk it backward. Backups, logging, monitoring and archives are the hops people forget, and they are the ones that change scope.

An example flow, as rows

Flow Name on every row: "Drawing package from prime to shop floor". Illustrative, not a client. The shaded rows came from the backward walk. Step 40 is CUI because the toolpath is built from the controlled drawing, the same call the synthetic run made.

Flows plus asset attributes in, one category and a written reason out.

The trigger

1. The consultant sets Run Action to "Recompute scoping" on any Client_Technologies row.
2. n8n (run_scoping_recompute_action) passes the row to the runner, which clears the field before the job runs and confirms the clear by reading it back. The sweep writes back to the same table, so every row it touches re-fires the hook; clearing first means those echoes arrive blank and stop at the guard. Measured: one flip, one recompute-scoping call.
3. The runner sweeps the whole inventory, not the one row. Flipping several rows still produces a single run.

Which input decides which category

The original plan was to derive every category from flows. Checking the definitions showed flows settle only two of the five, so the other inputs were added to Client_Technologies the same day (2026-07-20).

Precedence, as the engine runs it

1. Specialized Asset, and nothing else. It is tested first and never combines with another category. If the SSP relies on it for a security requirement, that is a design conflict and goes to Needs Review.
2. CUI Asset. An asset that handles CUI and also does a security job stays a CUI Asset, the heavier assessment. Its security role is kept in the separate Security Role field rather than lost (since 2026-09-27).
3. Security Protection Asset. Named in the SSP for at least one requirement. A product-category guess ("firewalls are security tools") only produces a "Likely" prompt, never the category.
4. Contractor Risk Managed Asset. Only with a linked policy. An unbacked "we don't put CUI there" is not accepted.
5. Out-of-Scope. The hardest to earn: every condition must be recorded affirmatively.
6. Needs Review. Everything else. The rationale names the missing input.

Scope reductions stay provisional

Contractor Risk Managed and Out-of-Scope both rest on a control actually working. The engine reads that control's status from the bound gap assessment and moves the asset accordingly.

The heavier categories are never reduced by this. Only confirmation or failure of a reducing claim moves a row.

What the output reads like

Every row gets a Scoping Rationale sentence. In the synthetic run the engine caught two classic self-reports, a CNC controller and an office multifunction printer, with:

marked 'capable but not intended', yet CUI actually flows to/from it.
If the flow is real it is a CUI Asset, not a Contractor Risk Managed Asset.

It also caught two of the operator's own entry errors: the file server and CAM workstation marked "Logically separated" while CUI flowed straight to them. The run settled at CUI Asset 5, Security Protection Asset 4, Specialized 1, Out-of-Scope 2, Needs Review 0.

The SSP's figures are built from the same rows, so they can't drift from them.

Three generators, one data pull

What flows_dot() emits for the example

// abridged; ids are row ids, fills are the generator's category colors
digraph flows {
  rankdir=LR; bgcolor="white";
  node [fontname="Helvetica", fontsize=10, shape=box];
  extPrimessupplierportal [label="Prime's supplier portal", style="dashed"];
  ct21 [label="Engineering workstation", style="filled,rounded", fillcolor="#f6d0d0"];
  ct22 [label="File server",             style="filled,rounded", fillcolor="#f6d0d0"];
  ct27 [label="Log monitoring (SIEM)",   style="filled,rounded", fillcolor="#cfe2f3"];
  extPrimessupplierportal -> ct21 [label="CUI Transmit", color="#b22222"];
  ct21 -> ct22 [label="CUI Store",    color="#b22222"];
  ct22 -> ct27 [label="SPD Transmit", color="#d2691e"];
  ...
}

From dot to Word

1. generate_ssp.py writes the SSP as Markdown, with each diagram as a fenced dot block.
2. export_ssp_docx.py finds each block, pipes it to dot -Tpng, and swaps in an image reference. If Graphviz is missing, the block is left as text rather than failing the export.
3. pandoc converts GitHub Markdown to .docx against the house reference document.
4. The file is attached to the Gap_Assessments row through the service account. Two jobs: export-ssp-client (clean) and export-ssp-working (adds proposed text for internal review).

The example, drawn

Redrawn in the Direction B palette for this page. The generator still uses its original colors.

The calls that shaped the build, and when they were made.

Known gaps

• Separation Claim reads the wrong way on a CUI asset. It means "separated from CUI assets", but on a segmented box "Logically separated" reads as true. The operator got it wrong twice in the synthetic run. Fix is wording and option labels, not logic.
• No field for "cannot be fully secured". A Specialized Asset Type alone triggers step 1 of the precedence.
• Hand entry. Phases 2b and 2c are consultant-typed. A client worksheet or portal surface is open, with provenance kept visible and scoping inputs left consultant-only.
• No staleness signal. Nothing detects an inventory that has stopped matching the client's environment.
• Generator colors predate Direction B and will move to the brand tokens when next edited.