CMMC scoping guide and worksheet
Before a Level 2 assessment, the rule wants every asset in your shop sorted into one of five categories, and each category carries its own paperwork. List the people, systems, machines, rooms and providers below, pick a category for each, and the worksheet draws the boundary and spells out what 32 CFR 170.19 asks of every line. Rule text read on 2026-10-22.
The tool: CMMC scoping guide and worksheet
CMMC scoping worksheet: Level 2 asset inventory
cuideck.com/tools/cmmc-scoping-worksheet, sorted by 32 CFR 170.19(c)(1), rule read 2026-10-22
One line per asset: people, systems, devices, facilities and service providers. Pick a category and the rule for it appears under the line. Pre-filled with a 22-person machine shop. Example only
So far12 in scope, 4 outEvery line sorted- 01
In scope. Everything that touches CUI. All 110 requirements apply to it.
- 02
In scope. Everything that touches CUI. All 110 requirements apply to it.
- 03
In scope. Everything that touches CUI. All 110 requirements apply to it.
- 04
In scope. Everything that touches CUI. All 110 requirements apply to it.
NoteA cloud provider holding CUI must meet the FedRAMP requirements of DFARS 252.204-7012. A provider that is not a cloud is assessed inside your assessment. 32 CFR 170.19(c)(2)(i) table 4
NotePut the provider, its services and its responsibility matrix in your SSP. 32 CFR 170.19(c)(2)(ii)
- 05
In scope. Everything that touches CUI. All 110 requirements apply to it.
- 06
In scope. What protects the CUI: firewall, identity, logging, backups, the MSP that runs them.
- 07
In scope. What protects the CUI: firewall, identity, logging, backups, the MSP that runs them.
- 08
In scope. What protects the CUI: firewall, identity, logging, backups, the MSP that runs them.
NoteA provider that holds only Security Protection Data is assessed as a Security Protection Asset. 32 CFR 170.19(c)(2)(i) table 4
NotePut the provider, its services and its responsibility matrix in your SSP. 32 CFR 170.19(c)(2)(ii)
- 09
In scope. What protects the CUI: firewall, identity, logging, backups, the MSP that runs them.
- 10
In scope. Could reach CUI, but your written policy keeps CUI off it. The SSP carries the weight.
- 11
In scope. CNC controllers, CMMs, test rigs, government kit: listed and managed, not hardened to all 110.
- 12
In scope. CNC controllers, CMMs, test rigs, government kit: listed and managed, not hardened to all 110.
- 13
Out of scope. Cannot reach CUI and protects nothing that does. You still need the reason in writing.
- 14
Out of scope. Cannot reach CUI and protects nothing that does. You still need the reason in writing.
- 15
Out of scope. Cannot reach CUI and protects nothing that does. You still need the reason in writing.
- 16
Out of scope. Cannot reach CUI and protects nothing that does. You still need the reason in writing.
| # | Asset | Type | Category | Where CUI goes, or why it cannot |
|---|---|---|---|---|
| 01 | Programmers and quality lead (4 people) | People | Controlled Unclassified Information (CUI) Assets | Open the customer drawings and write CAM programs from them |
| 02 | Engineering laptops (4) | Device or machine | Controlled Unclassified Information (CUI) Assets | Drawings opened and marked up here |
| 03 | File server with the drawings share | System or software | Controlled Unclassified Information (CUI) Assets | Stores every customer drawing and CAM program |
| 04 | Government cloud tenant for email and files | Service provider (ESP) | Controlled Unclassified Information (CUI) Assets | Receives drawings from the prime by email |
| 05 | Shop-floor printer | Device or machine | Controlled Unclassified Information (CUI) Assets | Prints travellers with the part drawing attached |
| 06 | Firewall and VPN | Device or machine | Security Protection Assets | Only route in and out of the shop network |
| 07 | Sign-in and MFA service | System or software | Security Protection Assets | Holds the accounts and passwords for every in-scope system |
| 08 | MSP running backups and the endpoint agent | Service provider (ESP) | Security Protection Assets | Sees logs and configuration data, never a drawing |
| 09 | Badge reader on the engineering office door | Facility | Security Protection Assets | Keeps visitors out of the room where CUI is printed and stored |
| 10 | Front-office PCs (estimating and shipping) | Device or machine | Contractor Risk Managed Assets | Same network as the share; written policy and share permissions keep drawings off them |
| 11 | CNC mills and lathes (6 controllers) | Device or machine | Specialized Assets | Load programs made from CUI drawings; vendor controllers cannot take an agent |
| 12 | Coordinate measuring machine | Device or machine | Specialized Assets | Test equipment; holds inspection programs built from the drawings |
| 13 | Owner's home laptop on the remote desktop | Device or machine | Out-of-Scope Assets | Remote desktop allows keyboard, video and mouse only: no copy, paste, print or download |
| 14 | Accounting and payroll service | System or software | Out-of-Scope Assets | Separate cloud account; invoices and payroll only, no drawings or logs |
| 15 | Guest Wi-Fi and staff phones | Device or machine | Out-of-Scope Assets | Own network with no route to the shop network; phones never get company email |
| 16 | Marketing website | System or software | Out-of-Scope Assets | Public pages hosted elsewhere; no logins into the shop |
- inside the boundary
- 12
- outside it
- 4
- open checks
- 0
- Programmers and quality lead (4 people)
- Engineering laptops (4)
- File server with the drawings share
- Government cloud tenant for email and files
- Shop-floor printer
- Firewall and VPN
- Sign-in and MFA service
- MSP running backups and the endpoint agent
- Badge reader on the engineering office door
- Front-office PCs (estimating and shipping)
- CNC mills and lathes (6 controllers)
- Coordinate measuring machine
Outside the line (4)
- Owner's home laptop on the remote desktop
- Accounting and payroll service
- Guest Wi-Fi and staff phones
- Marketing website
What the rule asks of each category on your list
| Category | What you must show | How it is assessed |
|---|---|---|
| Controlled Unclassified Information (CUI) Assets5 assets | Asset inventorySSPNetwork diagramPrepare to be assessed against CMMC Level 2 security requirements. | Assess against all Level 2 security requirements. |
| Security Protection Assets4 assets | Asset inventorySSPNetwork diagramPrepare to be assessed against CMMC Level 2 security requirements. | Assess against Level 2 security requirements that are relevant to the capabilities provided. |
| Contractor Risk Managed Assets1 asset | Asset inventorySSPNetwork diagramPrepare to be assessed against CMMC Level 2 security requirements. | Review the SSP. If sufficiently documented, do not assess against other CMMC security requirements; if the documentation raises questions, the assessor can conduct a limited check. |
| Specialized Assets2 assets | Asset inventorySSPNetwork diagramShow these assets are managed using the contractor's risk-based security policies, procedures, and practices. | Review the SSP. Do not assess against other CMMC security requirements. |
| Out-of-Scope Assets4 assets | Prepare to justify the inability of an Out-of-Scope Asset to process, store, or transmit CUI. | None. |
Rule text: 32 CFR 170.19(c)(1), table 3. Chips: document the asset in each.
Check before you write the SSP
- NoteContractor Risk Managed Assets stand or fall on the SSP. If the assessor doubts it, expect a limited check. 32 CFR 170.19(c)(1) table 3
Scoping is the same whoever assesses you. What is in force while the third-party requirement is suspended:
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
What CMMC scoping is
Scoping is deciding, in writing, which of your assets an assessment will look at. The rule is blunt about the order: “The CMMC Assessment Scope must be specified prior to assessment,” and the scope is “the set of all assets in the OSA's environment that will be assessed against CMMC security requirements.” A Level 2 self-assessment is run against exactly that set, so the line you draw here decides how much of the shop the 110 requirements land on.
“Asset” is wider than IT. Part 170's definition names hardware and software, and also humans and services, and its scoping section tells you to consider people, technology, facilities and External Service Providers. That is why the worksheet has a type for people and one for the building. Decide what you hold first: the FCI vs CUI comparison sorts the paperwork, and what counts as CUI covers the markings.
How to use the worksheet
- 1List everything that could touch a drawingWalk the CUI from the moment it arrives (an email from the prime, a portal download) to the moment it leaves (a shipped part, a deleted file). Every person, laptop, share, printer, machine and service it passes is a line.
- 2Add what protects those thingsThe firewall, the sign-in and MFA service, the log console, the backup system and whoever runs them. These are Security Protection Assets even if no drawing ever lands on them.
- 3Pick one category per lineThe rule for the category appears under the line. If you hesitate, the sorter further down asks four questions and gives the category.
- 4Write the reason on every line you keep outOut-of-scope and Contractor Risk Managed lines show an Ask until they carry a reason. Those reasons are what an assessor reads first.
- 5Export and carry it into the SSPDownload the CSV for the asset inventory, print the sheet for the network-diagram session, and paste the copy into the system security plan.
The inventory is not optional paperwork. Without an up-to-date SSP (CA.L2-3.12.4) at the time of assessment, the assessment cannot be completed, and every in-scope category on this page has to appear in that SSP. The SSP template starts from the boundary you draw here.
The two sentences that move assets out
Most of what scoping saves you sits in the out-of-scope column, and two lines of table 3 decide what can go there.
The same table says Contractor Risk Managed Assets “are not required to be physically or logically separated from CUI assets.” That is the trade: separate an asset and it leaves the scope; leave it on the same network and it stays in, carried by your written policy. An enclave is the separation done on purpose, and the CMMC enclave comparison sets out the five ways small shops build one.
Worked example: a 22-person machine shop
The worksheet opens on a job shop that machines brackets and housings to a prime's drawings marked Distribution Statement D. Sixteen lines come out as 12 inside the boundary and 4 outside it. Eleven of the sixteen calls are obvious. These five are where shops lose an afternoon with their assessor:
| Asset | Category | Why |
|---|---|---|
| Shop-floor printer | CUI AssetsIn scope | It prints travellers with the drawing on them, and printing is processing under the rule's own definition. A printer that never gets a CUI job can go elsewhere. |
| CNC controllers and the CMM | Specialized AssetsIn scope, SSP review | Controllers are operational technology and the CMM is test equipment. They hold programs built from CUI drawings but cannot take an endpoint agent, so they are listed, managed by policy and shown on the diagram. |
| Badge reader on the engineering door | Security Protection AssetsIn scope, judgment call | Part 170 lists physical access control as an example of operational technology, so some shops log it as Specialized. It also protects the room where CUI is printed. We list it where it protects; write your reasoning in the SSP. |
| Front-office PCs | Contractor Risk Managed AssetsIn scope, SSP review | They sit on the same network as the drawings share. Share permissions and a written rule keep CUI off them. Separate them and they could leave the scope instead. |
| Owner's home laptop | Out-of-Scope AssetsOut of scope | It reaches CUI only through a remote desktop that passes keyboard, video and mouse. Allow copy, paste, print or download and it is back in. |
Notice what the example does not do: it does not shrink the boundary by renaming things. The firewall, the sign-in service and the MSP stay inside the line because they protect what is inside it, and no category lets them out.
Not sure where an asset goes?
Four questions, in the order the rule reads them. Run one asset through at a time and copy the category back into the worksheet.
Does CUI ever get opened, saved, printed or sent on it?
Process, store or transmit, in the rule's words. Paper counts: a printed drawing on a desk is stored.
Cloud services and MSPs: table 4
Outside providers are sorted by two questions: is it a cloud service provider, and does it hold CUI, Security Protection Data, or neither? Security Protection Data is the configuration data, logs, vulnerability status and passwords for your in-scope systems, which is why an MSP that never sees a drawing still lands inside the line. A cloud password manager that holds those passwords is sorted the same way; four of them are read against this table in password managers for CMMC.
| The ESP holds | A cloud service provider | Not a cloud service provider |
|---|---|---|
| CUI (with or without SPD) | The CSP shall meet the FedRAMP requirements in 48 CFR 252.204-7012. | The services provided by the ESP are in the OSA's assessment scope and shall be assessed as part of the OSA's assessment. |
| SPD (without CUI) | The services provided by the CSP are in the OSA's assessment scope and shall be assessed as Security Protection Assets. | The services provided by the ESP are in the OSA's assessment scope and shall be assessed as Security Protection Assets. |
| Neither CUI nor SPD | A service provider that does not process CUI or SPD does not meet the CMMC definition of an ESP. | A service provider that does not process CUI or SPD does not meet the CMMC definition of an ESP. |
32 CFR 170.19(c)(2)(i), read 2026-10-22
In practice: a cloud that holds CUI must be FedRAMP Authorized at Moderate or higher in the FedRAMP Marketplace, or meet equivalent requirements, and its Customer Responsibility Matrix goes in your SSP. Your own equipment that connects to it stays in your scope. The CMMC vs FedRAMP comparison explains the difference, and the GCC High alternatives page reads the Marketplace for the usual email and file choices.
For an MSP the paperwork is the same either way: the use of the provider, its relationship to you and its services go in your SSP and in its service description and responsibility matrix. The CMMC MSP comparison shows how providers split that work with a shop.
Questions shops ask about scoping
Are our CNC machines in scope?
If a program built from a CUI drawing is loaded on them, yes, as Specialized Assets: listed in the inventory, treated in the SSP, shown on the network diagram and managed under your own risk-based policies. The assessor reviews the SSP for them and does not test them against the other Level 2 requirements.
Do people really go on an asset inventory?
Part 170 defines an asset to include humans, and its scoping section tells you to consider people alongside technology, facilities and service providers. In practice a role line (“programmers, 4 people”) is enough; the names live in your access lists.
Is a badge reader a Security Protection Asset or a Specialized Asset?
Part 170 lists physical access control mechanisms as an example of operational technology, and operational technology is a Specialized Asset type. A badge reader that guards the CUI room also provides a security function to the scope. The rule does not settle the overlap; pick one, say why in the SSP, and keep it consistent.
Does scoping work the same way at Level 1?
It is simpler. Systems that process, store or transmit FCI are in scope; everything else is out, with no documentation required for the out-of-scope ones, and Specialized Assets are not part of the Level 1 scope at all. The Level 1 checklist covers the 15 requirements that apply.
Does the Phase 2 suspension change scoping?
No. Part 170 has not been amended since it took effect on 2024-12-16, and the scoping section is part of it. The suspension changes who assesses, not what is assessed: a Level 2 (Self) assessment runs on the scope you draw here. The status box above shows what applies today.
Can our MSP get certified so we do not have to assess it?
The rule lets a provider “voluntarily undergo a CMMC certification assessment to reduce the ESP's effort required during the OSA's assessment.” Its services still sit in your scope and in your SSP; a certification reduces the work, it does not move the line.
Is this worksheet an assessment?
No. It sorts and documents; it does not test anything, and nothing you type leaves your browser. Score the requirements with the NIST SP 800-171 checklist and the SPRS score calculator.