From Millions of False Positives to 99%+ Accuracy: How Johnson Controls Solved Its CUI Discovery Challenge

One of the biggest misconceptions surrounding CMMC compliance is that identifying Controlled Unclassified Information (CUI) is simply a matter of running a scan. For organizations with years of engineering data, contracts, email, SharePoint sites, network file shares, and cloud repositories, the challenge isn't finding information, it's accurately identifying which information is actually CUI.

During a recent episode of Cape Endeavors' Bytes & Brew podcast, Steve Hicks, Senior Director of Government Accounts at Johnson Controls, shared how one of the world's largest organizations tackled that challenge. His experience highlights a problem many defense contractors encounter as they prepare for CMMC: finding CUI isn't difficult, but finding it accurately is.

https://video.wixstatic.com/video/c6bc0f_2a8c016ef9df4ba8b729cb0b6c928215/720p/mp4/file.mp4

The False Positive Problem

Like many defense contractors, Johnson Controls evaluated multiple approaches to identifying CUI, including internally developed solutions and commercially available discovery tools. While these tools generated plenty of results, they also produced millions of potential matches.

That quickly became the real problem. Every file identified as potential CUI had to be reviewed to determine whether it actually contained controlled information. At enterprise scale, that creates an enormous manual effort that can consume significant time and resources.

As Hicks explained:

"We had millions of documents, and then what are we going to do with those millions of documents to verify? That's going to take a huge labor force to sit down and go through all these documents and understand what is actually CUI and what's not."

For organizations managing hundreds of millions of files, even a relatively small false-positive rate can translate into months, or even years, of manual review.

Accuracy Changes Everything

Johnson Controls ultimately adopted Teramis to improve the precision of its CUI discovery process, and the results were dramatic.

According to Hicks:

"We use Teramis and that increased our accuracy to over 99%."

No discovery solution completely eliminates the need for human validation. However, when false positives are dramatically reduced, manual review becomes practical instead of overwhelming.

As Hicks noted:

"Even then having that 1% to review, it's manageable now though as opposed to the previous situation."

Why Precision Matters for CMMC

Accurate CUI discovery is about much more than preparing for an assessment. It serves as the foundation for nearly every aspect of a successful CMMC program. Organizations need confidence that they know where CUI resides so they can define an accurate assessment boundary, reduce unnecessary compliance scope, protect sensitive information appropriately, respond effectively during cyber incidents, and support ongoing compliance activities, including annual affirmations.

When discovery tools overwhelm security teams with false positives, every one of those downstream activities becomes more expensive, more time-consuming, and more difficult to defend.

Generic Discovery Tools Weren't Built for CUI Discovery

Many traditional data discovery and DLP solutions were designed to detect structured data such as Social Security numbers, credit card information, or other personally identifiable information. CUI presents a fundamentally different challenge.

It often resides in engineering drawings, CAD files, technical manuals, scanned PDFs, images, manufacturing specifications, and decades of contract documentation. Much of it is inconsistently marked, or not marked at all, making it difficult for generic tools to distinguish meaningful CUI from ordinary business data.

The result is often a difficult tradeoff: either miss legitimate CUI or generate millions of false positives that require manual validation. Neither approach is practical for organizations preparing for CMMC.

Precision Creates Confidence

Johnson Controls' experience demonstrates that success in CUI discovery isn't measured by how many files a tool flags, it's measured by how accurately it identifies the files that actually matter.

Reducing false positives doesn't simply save time. It gives organizations confidence that they understand their CUI boundary, helps them focus their compliance efforts where they matter most, and provides a stronger foundation for achieving and maintaining CMMC compliance.

Want to see how Teramis delivers precision CUI discovery with up to 99.95% accuracy? Schedule a demo and discover what's really in your environment.