CMMC Scoping Guide: FCI, CUI, and Security Protection Assets

Start With Information Types

Asset Categories (Practical)

• CUI assets — systems that process, store, or transmit CUI
• Security protection assets — identity, SIEM, firewalls, EDR that protect CUI assets (often in scope even without storing CUI)
• Contractor Risk Managed / specialized — limited-function assets handled per official scoping guidance; document carefully
• Out of scope — no CUI/FCI and no security protection role for the in-scope enclave

Scoping Methods That Work

1. Inventory contracts and CUI markings / DD254 / distribution statements.
2. Trace people, apps, shares, email, and vendors that touch that data.
3. Decide enclave vs enterprise-wide scope (smaller enclaves reduce assessment cost but need hard boundaries).
4. Document ESPs in a responsibility matrix (MSP guide).
5. Freeze the boundary in the SSP before scoring SPRS.

How CyberSilo Helps

• CSA stores asset-to-requirement mappings and evidence owners
• ThreatHawk clarifies which log sources are in the protection fabric
• Scoping workshops before gap remediation spend

Frequently Asked Questions

Can I scope only one enclave for Level 2?

Yes if CUI is truly contained and security protection assets for that enclave are included. Soft boundaries (shared identity without controls) usually fail.

Are laptops that never store CUI out of scope?

Not if they can access CUI systems or act as security protection endpoints. Access paths matter.

Does Level 1 use the same scoping ideas?

Yes at a lighter depth — bound the systems that process, store, or transmit FCI against the 15 FAR requirements.

Related CMMC Resources

CMMC hub · SSP template · Checklist · Cost drivers · Assessment process