What Defines the Scope of a CMMC Assessment?

By Shaheer Malik · Updated Oct 28, 2026

You define the scope of a CMMC assessment yourself, before the assessment, following 32 CFR 170.19. At Level 2 the scope is documented in your System Security Plan (SSP), together with an asset inventory and a network diagram; DoD’s CMMC scoping guides add detail.^[1]

What the scope is

The rule defines the CMMC Assessment Scope as “the set of all assets in the OSA’s environment that will be assessed against CMMC security requirements,” and requires it to be specified before the assessment.^[1] The SSP is “the formal document” describing the system components, the environment and how each security requirement is implemented.^[1]

Level 2 asset categories

Category	What it is	How it is treated
CUI assets	Assets that process, store or transmit CUI	In the inventory, SSP and diagram; assessed against all Level 2 requirements
Security Protection Assets	Assets that provide security functions to the scope	Documented; assessed against the requirements relevant to what they do
Contractor Risk Managed Assets	Assets that can, but are not intended to, handle CUI because of policy and procedure	Documented; reviewed in the SSP, not separately assessed if sufficiently documented
Specialized Assets	IoT, OT, government-furnished equipment, test equipment that can’t be fully secured	Documented and managed by your risk-based policies; SSP reviewed, not assessed against other requirements
Out-of-scope assets	Assets that cannot process, store or transmit CUI and don’t protect CUI assets	Be ready to justify why they can’t handle CUI

Summarized from Table 3 to 32 CFR 170.19(c)(1).^[1]

Level 1 scope

At Level 1 the scope is the assets that process, store or transmit FCI. Specialized Assets are outside the Level 1 scope, and an endpoint running only a VDI client that can’t process, store or transmit FCI is out of scope.^[1]

Service providers

Cloud and managed service providers that handle your CUI or security data are part of the picture. A cloud provider storing CUI must meet the FedRAMP Moderate requirements in DFARS 252.204-7012; a non-cloud provider handling CUI is assessed as part of your assessment.^[1]^[2] See CMMC for MSPs.

Why scope matters

Everything in scope is assessed, so a tight, well-documented scope is the biggest lever on cost and time. Many companies put CUI in a separate enclave so the rest of the business stays out of scope.

Compare CMMC consultants (RPOs) and C3PAOs by state, or describe your project once and we send it to up to 3 matching firms.

FAQ

What document defines the scope of a CMMC assessment?

Your System Security Plan, with its asset inventory and network diagram. You specify the CMMC Assessment Scope before the assessment, following 32 CFR 170.19 and DoD’s scoping guidance.

Who decides the CMMC assessment scope?

The organization being assessed specifies the scope beforehand. The assessor then checks that assets are categorized and documented correctly.

Are cloud services in scope for CMMC?

Yes, if they handle your CUI or security protection data. A cloud provider holding CUI must meet FedRAMP Moderate or equivalent under DFARS 252.204-7012.

Sources

32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (checked Oct 28, 2026)

Get quotes from matching firms

Describe what you need once. It goes to up to 3 matching firms, never published or sold.

Request quotes

Independent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.