If your managed services infrastructure interacts with Controlled Unclassified Information (CUI), you're classified as an External Service Provider under the Cybersecurity Maturity Model Certification (CMMC). This classification typically requires compliance at Level 2. The key is not just compliance, but efficiently scoping your boundary to avoid securing unnecessary systems.
This checklist guides you through the scoping decisions that affect your compliance burden. Each item is a crucial step: complete it before moving forward to ensure a stable foundation for your program.
Prerequisites
Before starting, confirm:
- Your systems process, store, or transmit CUI. If your hardware holds it, you own the risk.
- You have executive approval to pursue CMMC compliance. The alternative is exiting Department of Defense (DoD) contracts.
- You've assembled a cross-functional team including IT, operations, HR, and legal. Scoping isn't just a technical task.
Scoping Checklist
Strategic Decisions
1. Determine your CMMC level requirement
Review 32 CFR 170.19 to classify the information your systems handle. If you process Federal Contract Information but not CUI, you're Level 1 (17 controls, self-attestation). If you handle CUI, you're Level 2 (110 controls, third-party assessment).
Good looks like: A documented determination with specific information classifications mapped to contract requirements, reviewed by legal counsel familiar with DoD terminology.
2. Choose your compliance strategy: full-organization or enclave
Decide whether to secure your entire infrastructure to CMMC standards or isolate CUI-handling systems in a bounded enclave. Full-organization means every endpoint, cloud service, and user account meets CMMC controls. Enclave means building separation barriers around the systems that touch CUI.
Good looks like: A written strategy document that quantifies the cost difference between approaches, identifies which client contracts require CUI access, and explains how you'll maintain separation if you choose an enclave.
Boundary Definition
3. Map all data flows involving CUI
Trace every path CUI takes through your environment. Start where it enters and follow it to storage, processing systems, backup locations, and any system that could access it. Include temporary locations like staging servers or employee workstations used for troubleshooting.
Good looks like: A data flow diagram showing CUI movement with directional arrows, annotated with the systems that touch each path. If you can't explain how CUI gets from client to your infrastructure and back, you're not ready to scope.
4. Build your in-scope asset inventory
Document every hardware device within your CMMC boundary: servers hosting CUI, employee PCs with access to those servers, mobile devices with VPN access, and network equipment that routes CUI traffic. Include make, model, serial number, physical location, and primary function.
Good looks like: A spreadsheet or asset management database with unique identifiers for each device, ownership assignment, and a field indicating whether the asset directly handles CUI or sits within the boundary for network connectivity reasons.
5. Inventory your digital assets
List user accounts, cloud service subscriptions, software applications, and APIs that interact with CUI or with systems that handle CUI. This includes identity providers, logging services, and monitoring tools that could access CUI-handling systems.
Good looks like: Each digital asset tagged with access level (admin, read-only, no access to CUI), linked to responsible personnel, and classified by whether it's critical to CUI operations or supporting infrastructure.
6. Define and justify your out-of-scope boundary
If using an enclave strategy, document which systems are explicitly excluded and why. The separation must be defensible: firewalls with access control lists, VLANs preventing cross-talk, physical barriers like separate server rooms, and operational controls like role-based access.
Good looks like: A network diagram showing your enclave with labeled separation mechanisms, plus a written justification for each out-of-scope system explaining why it cannot access CUI.
Documentation and Validation
7. Establish an asset library maintenance process
Create a procedure for updating your asset inventory when devices are added, decommissioned, or repurposed. Assign ownership for keeping the library current, typically IT operations or asset management.
Good looks like: A documented workflow that triggers inventory updates when purchase orders are approved, when devices are retired, or when employees join or leave. Include a monthly reconciliation comparing your inventory to active network connections.
8. Validate your scope with cross-functional review
Bring your scoping documentation to representatives from IT, operations, HR, legal, and finance. Ask each department to identify systems or processes you missed. HR should flag employee devices with remote access. Finance should identify payment processing systems if you handle billing for DoD clients. Legal should verify contract language about where CUI can reside.
Good looks like: Sign-off from each department head confirming they've reviewed the scope and identified any gaps. Document their feedback and how you addressed it.
Common Mistakes
Treating scoping as a one-time exercise. Your environment changes daily. New cloud services get adopted, employees bring personal devices, and clients send CUI through unexpected channels. If your asset library is older than 30 days without updates, it's already stale.
Assuming "we don't access it" means "we don't secure it." If your storage infrastructure holds CUI, you're responsible for securing it even if you never open the files. The hardware ownership creates the obligation.
Letting IT own the entire scoping process. CMMC includes operational controls, personnel controls, and physical controls. IT can't scope those alone.
Under-documenting your separation justifications. When a C3PAO asks why a system is out of scope, "it doesn't touch CUI" isn't enough. You need to show the technical and procedural barriers that prevent it from touching CUI, even accidentally.
Next Steps
Once you've completed this checklist:
- Map your scoping results to the 110 CMMC Level 2 controls to identify which apply to your environment.
- Prioritize controls based on current gaps, starting with access control and audit logging.
- Establish a timeline for remediation, keeping in mind that C3PAO assessments require evidence of operational effectiveness over time.
- Schedule quarterly scope reviews to catch environment changes before they create compliance gaps.
Your scoping decisions directly determine your compliance cost. A tightly defined enclave with clear boundaries costs less to secure and assess than a sprawling full-organization approach. But an enclave with weak separation creates audit findings and potential data exposure. Get the boundary right first, then build your controls around it.
