---
title: "Example: CUI Classification Scan Playbook"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/example-cui-classification-scan-playbook"
language: "en"
last_updated: "2026-06-27T00:12:32.438Z"
---

# Example: CUI Classification Scan Playbook

This article provides an example of a CUI Classification scan playbook with a multi-stage automated workflow designed to handle Controlled Unclassified Information (CUI) and standard PII based on where the data is discovered.

![Example CUI Classification playbook](https://cdn-assets.productfruits.com/4695d17a-dba2-4fae-811e-38dd450d9eb4)

The above screenshot is an example of a **CUI Classification** playbook. This is a multi-stage automated workflow designed to handle Controlled Unclassified Information (CUI) and standard PII based on where the data is discovered.

## 1\. Initial Detection Logic

-   The playbook starts with a decision point: **"Find CUI data?"**  
      
    ![](https://cdn-assets.productfruits.com/9165936e-d3c1-4739-a4e0-37e30d3e5aa1)
-   The logic of this decision point asks whether the scanned data contains the Regular Expression "CUI - Banner Marking: Specified Authorities."
-   -   "CUI - Banner Marking: Specified Authorities" is a **custom data type** defined in Spirion Sensitive Data Platform as a Regular Expression (RegEx). See the screenshot below.  
          
        ![](https://cdn-assets.productfruits.com/424a9612-e8cf-4d38-b1e0-1bfd969a3c45)
-   **If YES (CUI Path)**:
-   -   **Classification**: Spirion automatically adds the **"CUI"** classification label to the file and its metadata.  
          
        ![](https://cdn-assets.productfruits.com/e50feaa0-281f-4c1c-823a-6586bf6dd42d)
    -   -   The **CUI** classification label is defined under Settings > Global Classifications.  
              
            ![](https://cdn-assets.productfruits.com/ab0da4e0-e637-4c2b-bb0e-dcbe716f771e)
    -   **Notification**: Spirion automatically sends an email using the **"Sensitive Data Discovered"** template to the local Data Administrator (`dataadmin@company.cxm`) and Administrator (`admin@company.cxm`). It also notifies any user who is a member of the **Admin** and **Data Privacy Admin** roles (defined under Settings>User Management>Users & Roles).
    -   **Location Check ("Found in eMail?")**:  
          
        ![](https://cdn-assets.productfruits.com/74186e44-033d-4eea-9dd5-4f4fe22b3a5a)
    -   -   **If YES**: The file is **Shredded** (permanently deleted).
        -   **If NO**: The finding is **Assigned** to the **Data Privacy Admin** for manual review.
-   **If NO (Standard PII Path)**:
-   -   **Classification**: Spirion automatically adds the **"PII - Standard"** classification label to the file.  
          
        ![](https://cdn-assets.productfruits.com/e3c948b8-bc63-4bdc-b30b-4c69ee9b6d1b)
    -   -   The classification label **PII - Standard** is defined under Settings > Global Classifications.  
              
            ![](https://cdn-assets.productfruits.com/20abaf5e-a97e-4ce5-b060-0ae4c3dfd498)
    -   **Location Check ("Found on FileServer1?")**:  
          
        ![](https://cdn-assets.productfruits.com/529a5c5e-57a1-4bff-a31d-a0d943809bfa)
    -   -   **If YES**: The finding is **Assigned** to members of the user role **Data Privacy Admin**.
        -   **If NO**: A notification is automatically sent to [`dataadmin@company.cxm`](mailto:dataadmin@company.cxm), and any users who are members of the **Data Privacy Admin** role, using the template **"Sensitive Data Discovered"**.  
              
            ![](https://cdn-assets.productfruits.com/9b80cf70-7b10-4b56-97d1-48bd92c161a0)

## 2\. Data Types & Target Scope

![](https://cdn-assets.productfruits.com/4918f0b5-89aa-4b13-9827-4e1ea4b5a897)

While the specific SDDs (Sensitive Data Definitions) are encapsulated in the decision diamonds "Find CUI data?" and "Found on FileServer1?", the playbook logic also does the following:

-   **Data Types**: Differentiates between **CUI** (Controlled Unclassified Information) and **Standard PII** data types.
-   **Location Target Scope**: Specifically monitors personally identifiable information (PII) in **Email** systems and CUI on **File servers** (FileServer1).

## 3\. Remediation Actions Defined

The playbook utilizes 4 distinct types of remediation:

1.  **Classification**: Applying "CUI" or "PII - Standard" labels.
2.  **Notification**: Alerting administrators and privacy roles via email.
3.  **Assignment**: Routing findings to the "Data Privacy Admin" for human intervention.
4.  **Shredding**: Automatically deleting CUI data if it is found within an email environment.

## Summary of Workflow

This playbook follows a "Zero Tolerance" policy for Controlled Unclassified Information (CUI) in email (Shred), while providing a structured classification and notification path for **standard PII** and **CUI** found on authorized file servers.

![Example CUI Classification playbook](https://cdn-assets.productfruits.com/153a939e-0971-437d-82cd-43fe383adce9)