Why scoping is the 90% lever
Every CMMC dollar you spend is multiplied by the size of your scope. If you treat “everything in the company” as in-scope, you owe the 15 controls on every laptop, every cloud app, every room, every joiner. If you scope carefully, a typical 6-person defense contractor has 3 laptops, 2 cloud apps, and one network in scope.
Scoping is also the area where consultants extract the most margin, a 30-minute scoping conversation often becomes a four figure line item. It shouldn't. Here is what the work actually looks like.
The five things to scope
- People who touch FCI. Names and roles. Not every employee, only those who handle, view, or store federal contract info.
- Devices that touch FCI. Laptops, desktops, phones, tablets, on-prem servers. Identified by hostname or serial.
- Cloud apps that store, transmit, or process FCI. Email is almost always in. CRM, depends. Accounting, usually out.
- The network and physical area. Which Wi-Fi, which firewall, which physical room.
- External connections. VPNs to primes, B2B portals, MSP remote access.
What can legitimately be out of scope
- A phone or laptop that never touches federal contract info or your work email
- The bookkeeping computer if it's on its own login and doesn't hold FCI
- A guest Wi-Fi that's isolated from the work network
- A shared printer with no scanned FCI in its history
- Personal phones if you don't allow work email on them
Drawing the boundary diagram
A boundary diagram is a sketch that shows what's inside the boundary (in scope) and what's outside. A typical one for a small contractor:
- A box labeled “In-scope work area” with the 3 laptops, the work Wi-Fi, the firewall.
- An arrow to “M365 / Email” in the cloud.
- Outside the box: guest Wi-Fi, personal phones, the front desk computer.
- An arrow showing the connection to your prime's portal.
Pencil on paper is fine. So is Lucidchart or draw.io or a screenshot of a whiteboard. What matters is clarity.
Get the free worksheet
The Custodia scoping worksheet walks you through all five elements with tables to fill in and signature blocks: Open the worksheet →
Or follow the full DIY path: The Free DIY CMMC Level 1 Handbook.
FAQ
What is FCI?
Federal Contract Information. It's information provided by or generated for the government under a contract, not intended for public release. Examples: contract performance status, proposal drafts, technical specifications shared with you for delivery. See our CUI vs FCI guide for the line between FCI (Level 1) and CUI (Level 2).
Can I exclude a laptop from scope?
Yes, if it never touches FCI. The receptionist's laptop, the bookkeeper's laptop used only for QuickBooks, the warehouse tablet used only for inventory: these can be out of scope if they're segregated. Document the segregation in your scoping worksheet.
Do I need a fancy network diagram?
No. At Level 1 a pencil sketch is acceptable evidence. What matters is that someone unfamiliar with your company can look at it and understand where FCI lives, who can access it, and where the boundary stops.