CMMC Level 2 scoping workbook
The scoping decisions your leadership will have to defend
Scope is where a CMMC Level 2 program is won or lost, and it is a leadership decision before it is an IT task. This workbook gives your team one structured place to make those decisions and to record why.
Which decisions does it capture?
Where does CUI actually flow?
Six discovery questions trace it from the point it enters to everything that touches it in passing. The last one is the architecture question: could CUI be confined to a smaller, purpose built environment that the rest of the business connects to without holding it?
What is each asset?
Every system, service, facility and person is placed in exactly one of the five categories defined in 32 CFR 170.19, through a five step decision sequence written into the workbook.
Which providers are external service providers?
Under 32 CFR 170.19(c)(2) a provider counts only if CUI or Security Protection Data resides on its assets. The workbook separates cloud from non cloud providers and records the relationship for each.
What is excluded, and on what basis?
An out of scope asset needs a documented physical or logical separation. The row is flagged until that reasoning is written down.
How does it feed the system security plan?
Every in scope category has to appear in the asset inventory, the system security plan and the network diagram. The workbook produces the inventory, the provider list and the separation reasoning, with live counts by category. It does not replace the plan or the diagram, and it is not legal advice.
If the discovery questions point toward an enclave, that is the conversation our CUI enclave design work starts from.
Download the workbook
Book a call
Ready to talk it through?
Pick a time for a 30 minute call with the practice.
Or call +1 571 410 3066 or email [email protected]