CMMCpedia
Work with me

Terms / Scope and assets

Scope

The set of assets that will be assessed. Scope is the single decision that drives your cost, your evidence burden, and your assessment length.

Also called CMMC Assessment Scope, assessment scope, scoping.

Official Source Material

CMMC Assessment Scope means the set of all assets in the OSA's environment that will be assessed against CMMC security requirements.

Source: 32 CFR 170.4, eCFR text current as of September 17, 2026

Practitioner Guidance

What it means in practice

Scope is the decision that sets your cost, and you make it before you buy anything.

Every asset you bring inside the line must be documented, secured, and defended against 110 requirements. Every asset you keep outside must be justified. A company that scopes the whole business into the assessment pays for the whole business. A company that scopes one enclave pays for one enclave. Section 170.19 of 32 CFR Part 170 governs this, and reading it is worth more than any product demonstration.

Every asset lands in exactly one of five categories, and the category sets the testing.

Table 3 to 170.19(c)(1) names them. A CUI asset is assessed against all Level 2 requirements. A security protection asset is assessed against the requirements relevant to what it protects. A contractor risk managed asset gets a plan review. A specialized asset gets a plan review. An out-of-scope asset is not assessed at all. Sort your inventory into those five buckets and you have most of a scoping decision.

Two artifacts define the scope, and an assessment does not start without them.

The first is an asset inventory that lists every in-scope asset with its category. The second is a network diagram of the assessment scope, showing the assets, the boundary between them, and the flows of Controlled Unclassified Information between them. CA.L2-3.12.4 is the requirement that asks you to describe the system and its boundary. Table 3 requires both for four of the five categories. Build them early, because building them reveals scoping mistakes while they are still cheap to fix.

Map where your information actually flows before you draw any line.

Draw a data flow diagram and start with the data, not the network. Ask who sends you controlled information, what arrives, who opens it, where it is saved, who it goes to next, and what happens to it at the end. The answers usually surprise the owner. A mailbox, a phone, a home laptop, and a printer show up in that list far more often than a server room does.

Scope is not permanent, and a material change reopens it.

Adding a cloud service, opening a location that handles controlled information, or introducing a service provider with broad administrative reach can change the assessment scope. Your affirming official, the senior person who signs your annual compliance statement, owns that call. Write down what you decided and why, so the next change starts from a record rather than a memory.

What falls short

  • An asset inventory that lists categories of equipment rather than assets. The assessor works from the actual list, and a summary is not one.
  • A network diagram drawn for the whole company. The required diagram covers the assessment scope, including where your information enters it and leaves it.
  • A scope decided by which systems the IT provider manages. The information decides the scope, not the support contract.

Edge cases

  • Controlled information reaches you only on paper. Paper is still storage, so the rooms, cabinets, and people involved are in scope and the digital environment may not be.
  • One team performs the defense work and the rest of the company does not. That is the ordinary case for an enclave, and it is usually the cheapest defensible answer.
  • You are heading for Level 3. Contractor risk managed assets are treated as CUI assets in the Level 3 scope, so a scoping shortcut at Level 2 becomes expensive later.

Over-engineering

  • Scoping the whole enterprise to keep the mental model simple. It is simpler, and you will pay for it in every requirement, every year.
  • A network access control deployment bought before the data flow is mapped. The map often removes the systems the product was meant to protect.