Terms / Scope and assets
Out-of-scope asset
An asset that cannot handle CUI and protects nothing that does. It is not assessed, and you must be ready to justify the claim.
Also called out-of-scope assets, OOS asset.
Official Source Material
Out-of-Scope Assets means assets that cannot process, store, or transmit CUI because they are physically or logically separated from information systems that do process, store, or transmit CUI, or are inherently unable to do so; except for assets that provide security protection for a CUI asset (see the definition for Security Protection Assets).
Source: 32 CFR 170.4, eCFR text current as of September 17, 2026
Practitioner Guidance
What it means in practice
Cannot is a strong word, and the assessor will hold you to it.
The definition does not say unlikely to, not supposed to, or prevented from. It says cannot, and the reason must be physical or logical separation, or an inherent inability. This is the most contested word in scoping. Before you claim it, ask whether someone determined to move controlled information onto the asset could do so. If the answer is yes, the claim is weak.
A control that stops information flowing is not the same as an inability to carry it.
A print server reachable from your assessed environment, with a tool configured to block controlled documents, can still carry them if the tool is misconfigured or bypassed. That makes it a contractor risk managed asset, not an out-of-scope asset. The distinction decides whether you defend a claim or simply document a practice.
An asset that fits any in-scope category cannot be out of scope.
Table 3 to 170.19(c)(1) says this plainly. If the asset provides a security function for the environment, it is a security protection asset regardless of whether it touches the information. If it is on the specialized list, it is a specialized asset. Test the in-scope categories first, then consider this one.
The cheaper posture is to accept a lesser category and write the narrative.
An out-of-scope claim that fails at assessment is expensive, because the asset then enters the scope without the documentation an in-scope asset needs. Accepting the contractor risk managed category costs you a paragraph in the plan and no separation. Reserve the out-of-scope claim for assets where the separation is genuinely enforced and you can show it, which means the rules SC.L2-3.13.1 covers.
What falls short
- An out-of-scope claim supported by a network diagram alone. The separation is enforced by rules, and the rules are the evidence.
- A guest network called out of scope while a firewall rule allows it to reach the assessed environment. A reachable asset is not separated.
- A claim with no justification prepared. Table 3 asks you to be ready to justify the inability, so the reasoning belongs in the plan.
Edge cases
- An endpoint runs a virtual desktop client configured to pass only keyboard, video, and mouse. Table 3 names this as an out-of-scope asset, which is why the pattern is common.
- An asset is separated today and a network change reconnects it. The claim fails from that moment, and the change is the kind that reopens your scope.
- A personal phone with no work account on it. That is ordinarily out of scope, and adding the work mailbox makes it a CUI asset.
Over-engineering
- Physically separate cabling for assets that are already logically separated. The definition accepts either.
- An out-of-scope justification written for every asset in the company. Justify the assets a reader would reasonably question, not the coffee machine.