CUI-related RegEx: How do I Reduce False Positives?
Because terms like "Legal," "Financial," or "ID" are common in everyday business, you need to tell Spirion to care about them only when they appear in a CUI context.
Here are the 4 most effective strategies to increase accuracy:
1. Use Sensitive Data Definitions (SDDs) with Proximity
Instead of just searching for the regex, create an SDD that requires the regex to be near a "CUI Anchor." This is the single most effective way to eliminate noise.
- The Logic:
[Regex: CUI Categories] NEAR WITH DISTANCE (50) [Keyword: "CUI"] - Why it works: This ensures that the word "Financial" is only flagged if the acronym "CUI" appears within 50 characters of it. This ignores general financial spreadsheets while catching official CUI markings.
2. Use "Negative Lookaheads" in your Regex
If you find that a specific common word is triggering false positives (for example, the word "Circuit" triggering on the "CUI" regular expression), you can modify the regular expression to ignore it.
- Example:
(?-i)\bCUI\b(?!\s+Circuit) - What it does: This tells Spirion to match "CUI" unless it is immediately followed by the word "Circuit."
3. Leverage "Validation Requirements" (Case Sensitivity)
CUI markings are almost always uppercase. If your regex is case-insensitive, you will get thousands of false positives for words like "tax" or "legal."
- The Fix: Ensure your RegEx starts with the characters:
(?-i). - Why it works: This forces Spirion to match only "TAX" and ignore "tax." Official government markings are strictly formatted in uppercase, so this simple change can reduce false positives by up to 90%.
4. Apply "Location Filtering" (Targeted Scanning)
Don't scan your entire enterprise with broad CUI category terms. Use Targeted Scans based on the department's function.
- Strategy: Create a specific Search Profile for the Engineering or Legal departments that includes these CUI regexes.
- Strategy: For the rest of the company (Marketing, HR, etc.), use a more restrictive profile that only looks for formal markings like
CUI//SP-.
5. Use "File Property" Filters
CUI is often found in specific file types (PDFs, Word Docs, CAD files). You can reduce noise by excluding file types that are unlikely to contain regulated data but might contain matching strings (like .log files or .system files).
- Action: In your Search Profile, go to File Filters and exclude system directories or temporary folders where automated logs might trigger matches on words like "Investigation" or "Security."
Summary Recommendations
The "Gold Standard" for Spirion CUI discovery is to use a Sensitive Data Definition (SDD) that combines:
- Case-Sensitive Regex (to catch the category)
- Proximity (within 50-100 characters)
- Anchor Keyword (the word "CUI" or "Controlled")
This ensures that you are finding regulated data, not just common words.