Defining Your CMMC Assessment Scope: Reduce Risk

Quick Answer: Defining your CMMC Assessment Scope correctly determines which assets undergo assessment. By accurately identifying CUI Assets and applying network segmentation, organizations can limit the number of systems assessed, reducing documentation burden and assessment complexity under 32 CFR § 170.19(c).

Organizations pursuing CMMC Level 2 certification often assume every system touching their network falls under assessment. That assumption inflates cost, extends timelines, and creates unnecessary audit exposure. The reality is more precise: the CMMC Assessment Scope defines exactly which assets are assessed, and that scope is something organizations actively shape through accurate asset categorization and deliberate network segmentation.

Before any assessment begins, the Organization Seeking Assessment (OSA) must specify its CMMC Assessment Scope, as required under 32 CFR § 170.19(c). This scoping exercise determines which systems, data flows, and personnel fall within the assessment boundary. Get it wrong, and you either expose systems that didn't need scrutiny or fail to account for assets that genuinely require it.

This article explains how to identify CUI Assets correctly, how the five asset categories defined by the DoD CIO function, and how network segmentation helps organizations limit their CMMC Assessment Scope without compromising compliance.

What Counts as a CUI Asset Under CMMC?

A CUI Asset is any system that processes, stores, or transmits Controlled Unclassified Information. According to the DoD CIO CMMC Scoping Guide – Level 2, v2.13, September 2024, "process" means CUI is used by the asset — accessed, entered, edited, generated, manipulated, or printed. "Store" means CUI is at rest, whether on electronic media, in memory, or on paper. "Transmit" means CUI is transferred between assets.

CUI Assets are assessed against every Level 2 security requirement. Organizations must list these assets in their asset inventory, document their treatment in the System Security Plan (SSP), and show them in the network diagram. There's no requirement to embed each individual asset within the SSP narrative, but the asset must be accounted for in all three documentation layers.

Notably, classified assets sit outside CMMC program scope entirely, even when they contain CUI. That distinction matters for organizations handling both classified and unclassified controlled information, since classified systems follow separate security frameworks.

Which Other Asset Categories Fall Inside the CMMC Assessment Scope?

CUI Assets aren't the only category that matters. The DoD CIO Scoping Guide defines five total asset categories under 32 CFR § 170.19(c)(1), Table 3, and four of them sit inside Level 2 scope.

Security Protection Assets (SPAs)

SPAs provide security functions or capabilities to the assessment scope itself. Examples include SIEM platforms, cloud-based security solutions, hosted VPNs, managed service provider (MSP) personnel, consultants, enterprise network administrators, security operations centers (SOCs), and co-located data centers.

SPAs are assessed against the Level 2 requirements relevant to the specific capabilities they provide, not the full requirement set. Security Protection Data — configuration data, log files, vulnerability status data, and passwords granting access to the in-scope environment — falls under this category as well.

Contractor Risk Managed Assets (CRMAs)

CRMAs can technically process, store, or transmit CUI, but security policies, procedures, and practices are designed to prevent that from happening. CRMAs don't need to be physically or logically separated from CUI Assets.

An assessor reviews the SSP for these assets. If the documentation is sufficiently detailed, the assessor doesn't assess CRMAs against other requirements. If documentation gaps or findings raise questions, the assessor may conduct a limited check — one that, per the Scoping Guide, "shall not materially increase assessment duration or cost."

Specialized Assets

Specialized Assets can process, store, or transmit CUI but can't be fully secured using standard controls. This category includes IoT and IIoT devices, Operational Technology (SCADA, ICS, building management systems, physical access control), Government Furnished Equipment, Restricted Information Systems, and Test Equipment.

Like CRMAs, Specialized Assets are reviewed through the SSP rather than assessed against the full requirement set. They must still appear in the asset inventory, SSP, and network diagram, and they're managed through risk-based policies. Some Specialized Assets may qualify for an Enduring Exception.

Out-of-Scope Assets

Out-of-Scope Assets cannot process, store, or transmit CUI and provide no security protection function for CUI Assets. They must be physically or logically separated from CUI Assets to earn this designation.

This is the category where segmentation does the heavy lifting. If an asset falls into any of the other four categories, it cannot be classified as Out-of-Scope, regardless of how well-isolated it appears. The OSA must also be prepared to justify why the asset is genuinely incapable of storing, processing, or transmitting CUI. One example from the Scoping Guide: an endpoint hosting a VDI client configured to prevent any CUI processing, storage, or transmission beyond keyboard, video, and mouse functions qualifies as Out-of-Scope.

Out-of-Scope Assets carry no documentation requirement and aren't assessed. That's precisely why accurate categorization matters — moving an asset into this bucket removes it from the assessment entirely.

How Does Network Segmentation Reduce CMMC Assessment Scope?

Segmentation is the practical mechanism organizations use to isolate CUI Assets and limit which systems require Out-of-Scope justification. Effective separation — physical or logical — is required only for Out-of-Scope Assets, and the Scoping Guide draws directly on NIST SP 800-171 Rev 2 guidance here: organizations that designate specific system components for CUI may limit scope by isolating those components in a separate CUI security domain.

This is typically achieved using subnetworks protected by firewalls or other boundary protection devices, combined with information flow control mechanisms. Separation can be physical, logical, or a combination of both.

• Logical separation prevents data transfer between physically connected assets through non-physical means — firewalls, routers, VPNs, or VLANs.
• Physical separation means no connection exists at all, wired or wireless. Data moves between separated environments only manually, such as by USB drive.

Choose logical separation if your organization needs operational flexibility and shared infrastructure across segmented environments. Choose physical separation if your organization handles highly sensitive CUI and wants to eliminate network-based attack paths entirely, accepting the operational overhead of manual data transfer.

Either approach, applied correctly, reduces the number of assets that must be assessed, which in turn reduces the volume of documentation — inventory entries, SSP narratives, and network diagram components — tied to the assessment. The Scoping Guide doesn't frame segmentation as an automatic cost-reduction tool; the benefit comes from fewer assets requiring the full scrutiny of CUI Asset or SPA-level assessment.

What About External Service Providers and Enclaves?

Two additional scenarios frequently affect CMMC Assessment Scope.

External Service Providers (ESPs) fall into scope if they meet the CUI Asset or SPA criteria — specifically, if CUI or Security Protection Data resides on their assets. Organizations must document ESP use in the SSP, including the ESP's service description and a customer responsibility matrix (CRM). Cloud Service Providers storing, processing, or transmitting CUI must meet FedRAMP requirements under DFARS 252.204-7012. ESPs that don't handle CUI don't require their own CMMC assessment, but the services they provide to the OSA still fall within the OSA's scope. Notably, HR and accounting SaaS platforms typically don't qualify as ESPs, and staff augmentation arrangements — where the OSA supplies all processes, technology, and facilities — don't trigger CMMC assessment requirements either.

Enclaves allow organizations to meet CMMC requirements using enterprise-wide people, processes, and technology without bringing the entire enterprise into scope. For example, a centrally managed anti-malware tool, its administrators, and its management server could fall into scope while the rest of enterprise IT remains outside it. Within an enclave, every applicable requirement must be fully met — inherited requirements from enterprise tools or processes can't be treated as automatically satisfied. The Scoping Guide notes there's no established metric for inheritance, so each enclave boundary requires careful justification.

Getting Your CMMC Assessment Scope Right From the Start

Accurate scoping isn't a one-time exercise you complete and forget. According to the DoD CIO Scoping Guide, a new assessment becomes necessary when significant architectural or boundary changes occur — network expansions, mergers, or acquisitions. Operational changes that stay within the existing scope, such as adding or removing resources consistent with the current SSP, don't require a new assessment and are instead covered by annual affirmations.

The organizations that manage CMMC most efficiently treat scoping as an ongoing discipline: maintaining accurate asset inventories, revisiting segmentation as infrastructure evolves, and documenting the rationale behind every Out-of-Scope designation. Given the complexity of the five asset categories and the documentation requirements attached to each, many organizations work with a Registered Practitioner or C3PAO early in the process to validate their scoping decisions before committing to a formal assessment path.

This article provides general information based on the DoD CIO CMMC Scoping Guide – Level 2, v2.13, and shouldn't be treated as legal or assessment advice specific to your organization's environment.

Frequently Asked Questions

What is a CMMC Assessment Scope?

The CMMC Assessment Scope is the defined boundary of assets — systems, personnel, and data flows — that an assessor evaluates during a CMMC assessment. It's established by the Organization Seeking Assessment before the assessment begins, per 32 CFR § 170.19(c).

How many asset categories exist under CMMC Level 2?

Five: CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets, and Out-of-Scope Assets. The first four sit inside the Level 2 assessment scope; Out-of-Scope Assets are excluded entirely.

Does network segmentation guarantee a smaller assessment scope?

No. Segmentation is a necessary tool, but Out-of-Scope status also requires the organization to justify that the asset cannot process, store, or transmit CUI. An asset that falls into any other category cannot be reclassified as Out-of-Scope simply because it's segmented.

Do external service providers need their own CMMC assessment?

Only if they meet the CUI Asset or Security Protection Asset criteria — meaning CUI or Security Protection Data resides on their systems. ESPs that don't handle CUI don't need a separate assessment, but the services they provide still fall within the OSA's assessment scope.

When does a CMMC assessment need to be redone?

A new assessment is required after significant architectural or boundary changes, such as network expansions, mergers, or acquisitions. Routine operational changes within the existing SSP are instead handled through annual affirmations.