Scoping
CUI Scoping: What Belongs in the CMMC Assessment Boundary?
A practical method to scope systems that process, store, transmit, or protect CUI without turning the entire company network into the assessment boundary.
Read guide →Scoping
CMMC & CUI scoping guides
Boundary and scoping questions: what's in scope, what's out, enclaves, VDI, and the assets that most often get scoped wrong.
Scoping
CMMC Enclave for Small Business: When Narrowing Scope Helps
How a CUI enclave can reduce assessment complexity, what it does not solve, and which hidden dependencies often pull systems back into scope.
Read guide →
Scoping
Remote Workers and CMMC: Laptops, Home Offices, and CUI
What remote work changes in a CMMC environment: endpoints, local storage, printing, networking, support, physical exposure, and evidence.
Read guide →
Scoping
BYOD and CMMC: Why Personal Devices Complicate Scope
Why bring-your-own-device access creates CUI scope and evidence problems, plus safer patterns for small contractors that need flexibility.
Read guide →
Scoping
Printers, Scanners, and MFDs in a CMMC Environment
How printers and multifunction devices can process or store CUI, plus the configuration and evidence questions teams often miss.
Read guide →
Scoping
Backups and CMMC: CUI Copies, Restoration, and Assessment Scope
Why backups can silently expand CUI scope and how to document storage, encryption, access, retention, restoration, and provider responsibilities.
Read guide →
Scoping
Security Protection Assets vs CUI Assets in CMMC Scoping
Separate the systems that hold CUI from the systems that protect them, with practical examples for identity, logging, EDR, firewalls, and management tools.
Read guide →
Scoping
CMMC Contractor Risk Managed Assets (CRMA): Scope, Documentation, and Limited Checks
A focused Level 2 guide to Contractor Risk Managed Assets: what qualifies, why CRMAs stay in scope, what belongs in the SSP and network diagram, and when assessors can perform limited checks.
Read guide →
Scoping
CMMC Specialized Assets: How to Handle OT, IoT, GFE, and Test Equipment at Level 2
How CMMC Level 2 treats Specialized Assets such as OT, IoT/IIoT, Government Furnished Equipment, restricted systems, and test equipment that can handle CUI but cannot be fully secured.
Read guide →
Scoping
CMMC Out-of-Scope Assets: Separation, VDI, and the Keyboard/Video/Mouse Boundary
How Level 2 out-of-scope treatment works, what separation must accomplish, why 'no CUI intended' is not enough, and how the VDI keyboard/video/mouse condition affects endpoint scoping.
Read guide →
Scoping
CMMC for Manufacturers: Shop-Floor Systems, PLCs, and OT in Scope
Manufacturers should include shop-floor PCs, HMIs, PLC engineering stations, transfer paths, quality systems, and specialized assets when they touch or protect CUI.
Read guide →
Scoping
CMMC and QuickBooks/ERP Systems: Where Financial Software Fits in the Assessment Boundary
QuickBooks or an ERP is not automatically in or out of CMMC scope; inspect its data, attachments, integrations, backups, users, and security role before deciding.
Read guide →
Scoping
CMMC for Engineering Firms: CAD Files, Technical Data Packages, and Export-Adjacent CUI
Engineering firms should trace CAD, technical data, PDM/PLM, collaboration, rendering, and export-controlled information across every storage and transfer path.
Read guide →