CMMC scope decision guide

Proximity is not a scope decision.

An asset beside, connected to, administered with, or used by the same people as a CUI asset is not automatically in or out of CMMC scope because of proximity. The organization needs to understand what the asset can process, store, transmit, protect, administer, connect to, or affect, then document the appropriate asset category and treatment.

The safe answer comes from the architecture and operating facts, not a diagram label or a network boundary drawn without evidence.

Discuss your CMMC requirement

Five questions to classify the asset

Can it process, store, or transmit CUI?

If an asset handles CUI, it is a CUI Asset. That conclusion should be supported by the actual information flow, configuration, user activity, and system behavior, not a statement that CUI is not supposed to be there.

Does it provide a security function?

An asset that provides security functions or capabilities within the CMMC Assessment Scope can be a Security Protection Asset. Its logical or physical placement does not eliminate the need to assess its relevant capabilities.

Can it affect the assessed environment?

Review administrative access, shared identity services, monitoring, logging, configuration management, network paths, integrations, backup and recovery, remote management, support workflows, and provider services. The question is how an asset can influence the environment, not merely whether it has a similar name or location.

Is it a Contractor Risk Managed Asset or a Specialized Asset?

The current Level 2 guide identifies additional categories with their own documentation and assessment implications. An organization should use the facts, documented policies, procedures, practices, and applicable guidance to determine the appropriate treatment.

Is it truly out of scope?

Out-of-Scope Assets must be unable to process, store, or transmit CUI and be physically or logically separated from CUI Assets under current guidance. A declaration that an asset is “adjacent only” does not establish those conditions.

Make the scope explainable

For each questionable asset, record its function, owner, data and connectivity paths, relevant security contribution, category rationale, documented treatment, evidence, limitations, and next review. The asset inventory, System Security Plan, and network diagram should be consistent enough for the organization to explain the decision without relying on memory.

eTrepid's role

Within an agreed scope, eTrepid can help organize scoping questions, map dependencies, clarify responsibility boundaries, support evidence collection, and prepare a practical next-step plan. The client retains responsibility for its facts, architecture, asset inventory, scope decisions, representations, risk acceptance, and performance. eTrepid does not make a final CMMC scope determination or issue certification through a website article.

Sources and limits

This candidate is based on the current DoD CMMC Level 2 Scoping Guide. It is general information, not an assessment conclusion, legal advice, certification advice, or a substitute for a fact-specific scope decision.