Terms / Certification
Network diagram
The drawing of your assessment scope. Table 3 requires one for every in-scope asset category, and an assessment starts from it.
Also called network diagrams, scope diagram.
Practitioner Guidance
What it means in practice
The rule asks for a diagram of the assessment scope, not of your company.
Table 3 to 32 CFR 170.19(c)(1) requires in-scope assets to be documented in the network diagram of the CMMC Assessment Scope. That is a specific drawing: what is inside your boundary, what category each asset falls into, and how they connect. A general corporate network drawing does not answer the question being asked.
Show the categories, because the categories are what the assessor tests.
Mark the CUI assets, the security protection assets, the contractor risk managed assets, and the specialized assets. Show where the boundary sits and what crosses it. A diagram that shows subnets but not categories forces the assessor to reconstruct your scoping from conversation, which takes time you pay for.
The diagram and your plan must agree, and they drift apart quietly.
Your system security plan describes the same environment in words, which is what CA.L2-3.12.4 asks for. When the two disagree, the assessor tests both and finds the gap. Update them together. A diagram is easier to forget because it lives in a different file and a different tool.
Draw it early, because drawing it finds scoping mistakes.
The act of drawing the boundary reveals the connection nobody accounted for, the service that sits on both sides, and the device that turns out to be in scope. Doing this before you buy anything is the cheapest scoping review available.
What falls short
- A diagram with no asset categories marked. The categories are the substance of the scoping decision.
- A drawing that stops at your firewall. Cloud services and providers holding your information are part of the scope.
- A diagram dated two years ago. The environment moved and the assessment tests what exists.
Edge cases
- Your environment is entirely in a cloud tenant. Draw the tenant, the services in use, the identities, and the paths in and out.
- Controlled information moves on paper as well. Show the physical handling, because the assessment covers it.
- An external service provider administers part of the environment. Show the management path, because it crosses your boundary.
Over-engineering
- A diagramming platform bought for one drawing. Any tool that produces a clear, dated, editable diagram is enough.
- A separate diagram per requirement family. One accurate diagram of the scope is what the rule asks for.