CMMC scope decision guide

A Security Protection Asset may matter even if it does not process CUI.

In CMMC Level 2 scoping, a Security Protection Asset, often shortened to SPA, provides a security function or capability within the organization seeking assessment's CMMC Assessment Scope. It may be relevant even if it does not process CUI, because the service it provides can help protect the assessed environment.

The key is to document what the asset does, what it protects, who operates it, where its information goes, and how it connects to the broader scope.

Discuss your CMMC requirement

Do not use the acronym as a shortcut

Calling something an SPA does not complete the scope analysis. The organization still needs to evaluate the capability, architecture, data, connections, ownership, operating records, and relevant Level 2 requirements. A security function that is assumed but not documented creates the same problem as an asset that was never identified.

Questions to ask about an SPA

What security capability does it provide?

Describe the function in practical terms, such as an access, monitoring, protection, logging, configuration, detection, or response capability. Connect it to the environment it supports.

What information and dependencies are involved?

Map relevant Security Protection Data, configurations, logs, administrative paths, integrations, and provider dependencies. Explain how the asset can affect the protected environment.

Who operates and reviews it?

Identify customer and provider responsibilities for configuration, access, monitoring, changes, exceptions, evidence, escalation, and recurring review.

Where is it documented?

Current DoD guidance calls for the organization seeking assessment to document in-scope asset categories in its asset inventory and network diagram and to document treatment in the System Security Plan as applicable. The records should tell the same scope story.

What requirements are relevant?

Security Protection Assets are evaluated against the Level 2 requirements relevant to their capabilities. The appropriate mapping depends on the actual function and environment, not the product category alone.

eTrepid's role

Within an agreed scope, eTrepid can help organize the asset and responsibility questions, support operating evidence, and prepare a practical readiness plan. The client remains responsible for its asset inventory, System Security Plan, scope decisions, facts, representations, risk acceptance, and performance. eTrepid does not issue CMMC certification or determine assessment scope for a client through a website article.

Sources and limits

This candidate is based on the current DoD CMMC Level 2 Scoping Guide. It is general information, not an assessment conclusion, certification advice, or a substitute for a fact-specific scope decision.