The CMMC Level 1 scoping worksheet.
Scoping is the single most expensive decision in CMMC. Get it right and your work shrinks 90%. Get it wrong and you secure your entire company when you only needed to secure a corner of it.
- 20 min
- To complete
- 1
- Boundary you defend
- 90%
- Less work if scoped right
What scoping is
Scoping means drawing a line around the people, devices, networks, and cloud apps that touch Federal Contract Information (FCI). Anything inside the line has to meet the 15 CMMC L1 controls. Anything outside does not.
The mistake everyone makes: treating everything in the companyas in-scope. A 6-person shop with one federal contract often has 3 laptops, 2 cloud apps, and a firewall in scope — not 20 systems.
The contracts that trigger CMMC for you
List every active federal contract or subcontract that references FAR 52.204-21 or contains FCI. If none, you don't need CMMC L1 yet.
| Contract / PO # | Prime or agency | FAR 52.204-21? | Contains CUI? |
|---|---|---|---|
If any rowsays yes to “Contains CUI?”, you need CMMC Level 2, not Level 1. Stop here and see CUI vs FCI.
People who touch FCI
Every person whose job involves opening, editing, emailing, or filing FCI. Front desk staff who only stamp envelopes usually aren't in scope; the project lead and engineers usually are.
| Name | Role | Why they need access | Access type |
|---|---|---|---|
Devices in scope
Any laptop, desktop, phone, or server that processes, stores, or transmits FCI.
| Device (make / model) | Assigned to | OS | MFA / antivirus on? |
|---|---|---|---|
Cloud apps & external connections
Email, file storage, accounting, project management, vendor portals — anything cloud-hosted where FCI lives or travels.
| App / service | What it holds | MFA enforced? | Owner |
|---|---|---|---|
Network & physical boundary
Boundary diagram — draw it
On the grid below, sketch your boundary. Inside the box: in-scope people, devices, cloud apps. Outside: everything else. A 30-second drawing is a 100% acceptable Level 1 diagram.
Out of scope — declared
Anything that does nottouch FCI. Listing this explicitly protects you when a prime asks “is X part of your assessment boundary?” The answer is on file.
Sign-off
I confirm that the scope defined above accurately reflects the systems, people, and information that touch federal contract information at our organization, and that anything not listed has been intentionally excluded.