CMMC scoping at Level 2 sorts every asset into one of five categories: CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets and Out-of-Scope Assets. The category controls how much of the assessment the asset faces. A smaller, well documented scope is the main way to keep cost down.
The five categories
Per 32 CFR 170.19:
CUI Assets process, store or transmit CUI. They go in the asset inventory, the system security plan (SSP) and the network diagram. They face every Level 2 requirement.
Security Protection Assets provide security functions to the scope, whether or not they touch CUI. They get the same documentation. At Level 2 they are assessed against the requirements relevant to what they do.
Contractor Risk Managed Assets could handle CUI but are not meant to, because your policies and practices prevent it. They need not be separated from CUI Assets but must be documented. With a well written SSP, the assessor does not assess them further, though a limited check is allowed if something raises concern. At Level 3 they are treated as CUI Assets.
Specialized Assets can handle CUI but cannot be fully secured. The rule lists IoT and IIoT devices, operational technology, government furnished equipment, restricted information systems and test equipment. You document them and show risk based management. At Level 2 assessors review the SSP.
Out-of-Scope Assets cannot process, store or transmit CUI and do not protect CUI Assets. They must be separated from CUI Assets, and you must be ready to justify the call. The rule gives a virtual desktop endpoint that passes only keyboard, video and mouse signals as an example.
How to scope in practice
- Find where CUI enters, moves and rests.
- List every asset that touches that path.
- List every asset that secures them, such as identity, logging and endpoint management.
- Decide what is risk managed, specialized or out of scope, and write the reasoning.
- Draw it on the network diagram.
An asset that fits an in-scope category cannot be called out of scope.
Common scoping errors
Leaving identity providers and log stores out of the inventory. They are Security Protection Assets.
Calling a laptop out of scope because it only "views" CUI. If it processes, stores or transmits CUI, it is a CUI Asset.
Writing a thin SSP. Contractor Risk Managed status depends on documentation quality.
Where Safeguard fits
Asset discovery and SBOM and dependency scanning in Safeguard help you build and keep current the inventory this exercise needs. The categorization remains your call and your assessor's.
Quick check
Do Contractor Risk Managed Assets need documentation?
Yes. They must appear in the inventory, SSP and network diagram.
Are Security Protection Assets in scope if they never touch CUI?
Yes. They are in scope because they provide security functions to the assessment scope.
Sources
Last reviewed: 19 October 2026.
