Terms / Scope and assets
Contractor risk managed asset
An asset that could handle CUI but is not intended to, kept away by written policy. It gets a plan review rather than a full assessment.
Also called CRMA, contractor risk managed assets.
Official Source Material
Assets that can, but are not intended to, process, store, or transmit CUI because of security policy, procedures, and practices in place
Source: 32 CFR 170.19(c)(1), table 3, eCFR text current as of September 17, 2026
Practitioner Guidance
What it means in practice
This category rewards good documentation, and it punishes the absence of it.
A contractor risk managed asset is assessed by reviewing your system security plan rather than by testing the asset against every requirement. That is a real saving. It depends entirely on the plan describing risk-based policies, procedures, and practices that explain why controlled information does not reach the asset in practice.
A weak plan invites a limited check, and the assessor decides.
Table 3 to 170.19(c)(1) allows an assessor to run limited checks when the documentation or other findings raise questions about these assets. Those checks are assessed against the requirements. The rule says they must not materially increase the assessment duration or cost, which is a limit on scale, not a promise they will not happen. Write the narrative properly and the question does not arise.
These assets are not required to be separated, which is what makes the category useful.
Unlike an out-of-scope asset, a contractor risk managed asset does not need physical or logical separation from your CUI assets. It sits on the same network. Policy and practice keep the information off it, and CM.L2-3.4.1 still asks you to inventory it. For a small company with a flat network, this is often the honest and cheaper answer.
Do not use this category as a place to put assets you would rather not assess.
The category is for assets that theoretically could handle the information but do not, because you manage them that way. It is not a label that removes an asset from consideration. An asset that actually handles controlled information is a CUI asset whatever you call it, and an assessor who finds the information there will treat it accordingly.
What falls short
- A plan that names the category without describing the policies that keep information off the asset. The description is the whole basis of the treatment.
- A written policy nobody follows. Practices are part of the test, and an assessor asks people how they actually work.
- Assets placed here because assessing them looked expensive. That is the misuse the limited check exists to catch.
Edge cases
- You intend to pursue Level 3 later. These assets are treated as CUI assets in the Level 3 scope, so a cheap decision now becomes an expensive one later.
- A control prevents controlled information from reaching an asset that could otherwise carry it. Preventing a flow is not the same as being unable to carry it, so the asset belongs here rather than out of scope.
- A shared workstation is used for both kinds of work. If controlled work happens on it, it is a CUI asset, and no policy changes that.
Over-engineering
- Separating these assets anyway to be safe. The category explicitly does not require it, and the separation costs money and convenience.
- A risk assessment document per asset. One clear narrative covering how the class of assets is managed is what the plan needs.