Your CMMC Level 2 scope is the set of assets an assessor will examine. Those are the systems, people, facilities and outside service providers that handle Controlled Unclassified Information (CUI), plus the tools that protect them. It is not your whole company, unless you let it become your whole company.
That last part matters. Scope is the biggest cost lever in the whole process. Get it right and you protect a handful of systems. Get it wrong and you try to secure every laptop, printer and file share you own.
Here is how scoping works, what the rules actually say, and how a small business can draw a sensible boundary.
TL;DR
- Your Level 2 scope is every asset that processes, stores or transmits CUI, plus the assets that protect them. Everything else can be kept out if you separate and document it.
- Under 32 CFR 170.19, assets fall into CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets and Out-of-Scope Assets.
- The scope must be defined before the assessment, not during it.
- Phase II of CMMC was suspended in July 2026, but Phase I obligations, including NIST SP 800-171 and annual affirmations, continue.
- A smaller, cleaner boundary is usually the cheapest path to compliance.
Table of Contents
- Where scoping fits right now
- What “scope” actually means
- The asset categories, in plain English
- Why a smaller boundary wins
- How to set your scope: six steps
- Don’t forget outside providers
- Perspective: what we see with small contractors
- After scope: assessment, validity and upkeep
- What about cost?
- Where we can help
- FAQ
- Sources
Where scoping fits right now
First, the news. On July 13, 2026, the Department of War issued memoranda suspending Phase II of CMMC. A Holland & Knight summary says Phase I stays in full effect: self-assessment requirements, DFARS 252.204-7012, NIST SP 800-171 Rev 2 compliance, SPRS score postings and annual affirmations continue.
So should you wait on scoping? No.
The security requirements did not go away. Scoping is also the first step of any honest self-assessment. If you post a score to SPRS, that score describes a boundary. If the boundary is fuzzy, the score is fuzzy. We cover the broader picture in our posts on the CMMC pause and on why your responsibilities remain.
Rules can change again. Check the current status before you commit budget.
What “scope” actually means
The regulation is direct. Section 170.19 requires the CMMC Assessment Scope to be specified before the assessment. It is the set of assets in your environment that will be assessed against the requirements.
Level 2 is built on NIST SP 800-171 Rev 2, so the scope answers one question: where do those controls have to be true?
The answer is a boundary. Inside it, controls apply. Outside it, they don’t, as long as you can show the outside cannot touch the inside in a way that matters.
Who needs a Level 2 scope at all
If your contracts involve CUI, Level 2 is your territory. If they involve only Federal Contract Information, you are looking at Level 1. Our guide to the three CMMC levels walks through which one applies to you.
Not sure whether you handle CUI? Ask your contracting officer or prime. Look at how your contract documents and data are marked. Don’t guess.
The asset categories, in plain English
The rule sorts everything into categories. Here is how each one works for a small business, based on 32 CFR 170.19.
| Category | What it is | How it is treated at Level 2 |
|---|---|---|
| CUI Assets | Assets that process, store or transmit CUI | Fully assessed against the Level 2 requirements |
| Security Protection Assets | Assets that provide security functions for your scope, such as firewalls, identity systems and logging tools | Assessed against the requirements relevant to their security role |
| Contractor Risk Managed Assets | Assets that could handle CUI but are not intended to | Documented in your SSP and inventory, with a limited check |
| Specialized Assets | Things like operational technology, IoT devices and government property | Documented, and managed under risk-based policies |
| Out-of-Scope Assets | Assets that neither handle CUI nor protect assets that do | Not assessed |
The last row is where small businesses save money.
CUI Assets: the core
These are the laptops, servers, cloud tenants, file shares and email systems where CUI actually lives or moves. They get the full treatment. People and facilities that touch CUI come into the picture too.
Your first job is to find them. That means following the data. Where does a controlled drawing arrive? Who saves it? Who forwards it? Which backup copies it?
Security Protection Assets: the guards
A firewall does not hold CUI. But it protects the systems that do. So it is in scope.
The same goes for identity providers, endpoint protection, log collectors and vulnerability scanners that serve the boundary. Small businesses often miss this one, especially when security tools are run by an outside provider.
Contractor Risk Managed Assets: the gray zone
These could touch CUI but aren’t meant to. Think of a general office PC that sits near the enclave. You document them in the System Security Plan (SSP) and asset inventory. Per the C3PAO accreditation requirements, they are not fully assessed against every requirement unless a limited check raises questions.
That only works if you have actual guardrails in place: policy, training, technical blocks. “We told people not to” is thin.
Specialized Assets
The category covers equipment that is hard to secure the usual way. DoD’s Level 2 scoping guide lists government property and Internet of Things devices among its examples. You still document them and manage them under risk-based policies. You do not assess them against every control.
Out-of-Scope Assets
If an asset does not process CUI and does not provide security protection to assets that do, it is out. Payroll, marketing, a guest Wi-Fi network: all candidates, if they are truly separated.
Why a smaller boundary wins
The DoD built scoping to be risk-based. Separating CUI assets from the rest of the business lets you put your security spend where the sensitive data actually is. For a small company, that is often the most practical route.
Many organizations assume everything must be assessed. It does not have to be. Out-of-scope and specialized categories can remove assets from the assessment when they are properly documented and separated. That can cut assessment time and cost.
Let’s make that concrete. Picture a 40-person machine shop with one engineering team that receives CUI drawings.
- Everything in scope: All 40 users, every device, the shared drive, email, the ERP. Every control applies to all of it.
- Enclave approach: The six engineers and their workstations, one controlled file repository, the identity and monitoring tools that protect them. The other 34 people work in a separate environment.
Same company, same contracts. The second path means fewer systems to harden, monitor and prove. This is an illustration, not a quote. Your numbers will differ.
How to set your scope: six steps
- Find your CUI. Review contracts, task orders and the data you receive. Identify exactly what is CUI and who sends it.
- Trace the flow. Follow each type of CUI from arrival to storage, sharing, backup and deletion. Write it down.
- Build the asset inventory. List every device, server, cloud service, person and location that touches that flow. Our six-step IT asset inventory guide shows one way to do it.
- Categorize each asset. Place each into the five categories above. Note your reasoning.
- Draw and enforce the boundary. Use network segmentation, separate accounts, access controls and a defined cloud tenant. A line on paper is not a boundary.
- Document it all. Your SSP, network diagram and inventory must agree with each other and with reality. Our post on updating your SSP, POA&M and SPRS score covers the paperwork.
One caution. Scoping errors usually show up late, when someone finds an unlisted system holding CUI. Do a second pass with someone who did not build the first one.
Don’t forget outside providers
Your boundary rarely stops at your own network. Cloud email, file storage, your managed IT provider and your security tooling vendor can all sit inside it.
The Level 2 assessment guidance speaks of external service providers as part of the scoping exercise. Know who they are. Know what they touch. Get their responsibilities in writing.
For technology vendors in particular, a short primer on FedRAMP and CMMC basics shows how risk-based CUI scoping connects to practical security planning.
Perspective: what we see with small contractors
Most scoping trouble we run into is not technical. It is a convenience problem. Someone emails a drawing to a personal inbox to finish it at home. Someone saves a controlled file to a shared drive “just for now.” The boundary dies a little each time.
So we tell clients the same thing. Scope small, then protect it hard. A tight enclave you can defend beats a sprawling environment you can only describe.
And write it down while it is fresh. A good SSP is a working document, not a binder you open the week before an assessment.
Our approach builds security into the managed service itself, with senior security professionals behind it, so the boundary you define is the boundary that gets monitored. Compliance readiness is part of the relationship, not an add-on.
— Alden
After scope: assessment, validity and upkeep
When CMMC assessments are required, Level 2 certification assessments are done by authorized CMMC Third-Party Assessment Organizations (C3PAOs). To get there, a C3PAO must pass a DIBCAC Level 2 assessment, hold ISO 17020 accreditation, and see that its assessment personnel pass a Tier 3 background investigation, per Cyber AB requirements.
The process is structured. Cyber AB’s process document describes four phases: pre-assessment, assessment of conformity, reporting results, and certificate issuance and closeout. The assessor works with you early to agree on the purview of the assessment, including the size of the organization and the system.
A Level 2 status, whether from a self-assessment or a C3PAO, is valid for three years if nothing changes in your compliance and an official submits an annual affirmation. Conditional statuses can run no longer than 180 days.
That last point is why scope needs maintenance. Add a new SaaS tool, open a new office, hire a subcontractor, and your boundary may have moved.
What about cost?
We won’t make up a number. Costs depend on how much you must secure, how mature your controls are, and whether you need help with tooling, documentation and monitoring.
What we can say is where the money goes:
- Hardening and monitoring every asset in scope
- Writing and maintaining documentation
- Remediating gaps found in your self-assessment
- The assessment itself, when one is required
Scope touches the first three directly. Fewer in-scope assets means less of each. Our CMMC levels and cost guide goes further on budgeting.
Where we can help
We are a veteran-owned managed IT and cybersecurity company. We help small and mid-sized businesses with compliance consulting, risk and vulnerability assessments, Microsoft 365 and cloud services, and 24/7 U.S.-based support. Our Policy Compliance service covers frameworks including NIST and CMMC, and our managed cybersecurity services keep the controls running day to day.
Pricing is not published, because it depends on your environment. Talk to us and we’ll scope it with you.
Ready to define your boundary? Talk to our team about your CMMC scope.
FAQ
Do all of my systems have to meet CMMC Level 2?
No. Only assets in your assessment scope do. Assets that do not handle CUI and do not protect assets that do can be Out-of-Scope, if they are properly separated and documented. Your SSP and asset inventory should show the reasoning.
Who sets the scope: me or the assessor?
You define it, and it must be set before the assessment. The assessor then works with you to confirm the purview and planning details. Expect them to test your boundary, not just accept it.
What are Contractor Risk Managed Assets?
They are assets that can, but are not intended to, handle CUI. You document them in your SSP and asset inventory. They get a limited check rather than a full assessment, unless something raises questions.
Does the CMMC pause change my scoping work?
Phase II is suspended, but Phase I requirements, including NIST SP 800-171 Rev 2 compliance, SPRS postings and annual affirmations, remain in effect. Scoping is still the foundation of an accurate self-assessment. Confirm current rules with your contracting officer.
Sources
- 32 CFR 170.19, CMMC scoping (eCFR)
- 32 CFR Part 170 Subpart D, Key Elements of the CMMC Program (eCFR)
- Holland & Knight, DOW Suspends CMMC Phase II Requirements
- DoD CIO, CMMC Assessment Scope Level 2
- Cyber AB, R2002 C3PAO Accreditation Requirements
- Cyber AB, CMMC Assessment Process v2.0
- DoD class deviation memo, DFARS 240