CMMC scoping means deciding which assets, people and providers fall inside your assessment boundary, based on where Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) are handled. A tight, documented boundary lowers cost and risk. A vague one makes every system in the company a candidate for assessment.
Which level and which data?
The program has three levels. Level 1 uses 15 practices drawn from the FAR safeguarding clause for FCI. Level 2 requirements are identical to NIST SP 800-171 Revision 2, for CUI. Level 3 adds 24 selected requirements from NIST SP 800-172. Your contract states the level, and your data decides the rest. If you only touch FCI, Level 1 is your world. If CUI flows to you, Level 2 scoping is the work this post covers.
How does 32 CFR 170.19 sort assets?
The scoping rule, found in 32 CFR 170.19, sorts assets into categories, and your documentation should use the same words.
- CUI Assets process, store or transmit CUI. They must appear in the asset inventory, the system security plan and the network diagram, and they are assessed against all Level 2 requirements.
- Security Protection Assets provide security functions to the scope, such as identity, logging or endpoint tools. Assessors check the requirements relevant to what they provide.
- Contractor Risk Managed Assets could handle CUI but are not meant to, based on your policies. They need not be separated from CUI assets, but you must document them, and the assessor reviews your plan.
- Specialized Assets include IoT, operational technology and government furnished equipment. They are documented and managed under risk based policy.
- Out of scope assets cannot handle CUI and do not protect CUI assets, and you must be ready to justify that claim.
What about cloud and outside providers?
External service providers that handle CUI or security protection data are in the picture. Under the rule's tables, a cloud provider handling CUI must meet the FedRAMP requirements referenced in DFARS 252.204-7012, while a non cloud provider handling CUI is assessed as part of your assessment. Document each relationship in the system security plan along with the provider's service description and customer responsibility matrix. Note that the regulation text refers to "FedRAMP requirements" and your contracting officer or C3PAO can confirm what that means for a given provider.
How do you draw the boundary?
The cheapest boundary is a small one. Many contractors create a dedicated enclave for CUI: a separate tenant or set of systems with its own identity controls, so that the rest of the company stays out of scope. A virtual desktop endpoint that only passes keyboard, video and mouse data can be out of scope under the rule, which is why enclaves often use one.
Be careful with shortcuts. Any asset that falls into an in scope category cannot be called out of scope. Email, shared drives, ticketing systems and developer tools are common leaks of CUI into the wider network.
What evidence does scoping produce?
Keep four artifacts: a data flow diagram showing where CUI enters, moves and leaves; an asset inventory tagged by category; a network diagram with the boundary drawn; and a scoping narrative that explains each decision. Assessors will test your claims against these, so every asset in the inventory should be traceable to a category.
What to do
- Read the contract clause and confirm the level and the data types you will handle.
- Trace CUI from first receipt to final disposal, including email and file transfers.
- List every asset that touches that path and tag it with a 170.19 category.
- Decide whether to build an enclave, and record the cost against the size of the current network.
- List external service providers, get their service descriptions and responsibility matrices, and file them with the system security plan.
- Draw the network and data flow diagrams and write the scoping narrative.
- Have someone outside the project challenge the out of scope list.
- Freeze the boundary version and date it, then change it only through change control.
Quick check
Can I leave a system out because it only sometimes sees CUI?
No. If it can process, store or transmit CUI, it is in scope, or it must be documented as a Contractor Risk Managed Asset with a basis for that claim.
Does an enclave remove all other systems from CMMC?
It can remove them from the CUI scope, but Level 1 obligations for FCI still apply wherever FCI is handled.
How Safeguard helps automate this
A boundary holds up when you can show it stays true. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence comes from connected systems and code instead of screenshots, and monitoring continues between assessments, which gives your team time for other work. Technical evidence comes from your real code and dependencies through scans, SBOMs and reachability. If you want fixes handled, the agent can open tested pull requests for vulnerable dependencies, but it is off by default and every category starts on Manual. Safeguard helps prepare and keep evidence ready; an authorized or accredited assessor performs the assessment. Book a call.
Open the framework mapping demo
Sources
Last reviewed: 18 October 2026.
