Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.
Step 3 of 5 · Scope your assessment
Map where your FCI lives.
If an asset touches federal contract information, it is in scope. Cedar Ridge Machine Works, LLC mapped its people, devices, places, and vendors from a few setup answers, confirmed each suggested row, and recorded the scope fact about the shop floor: it holds no FCI, so it sits outside the boundary. Charlie can also interview the team and fill this in over chat.
Microsoft 365 connected, read only
Who has access and how people sign in come in from the tenant, and the team confirms every answer. Nothing turns MET on its own.
People in scope
- Owner and Affirming OfficialFull access, one of two named admin accounts in Microsoft 365
- Two estimatorsOpen and edit federal quotes and drawings
- Office administratorRead only on federal files, manages the visitor log
- Shop leadFederal quoting access, no admin rights
Devices & apps in scope
- Microsoft 365 Business Premium tenantThe Cedar Ridge Federal Programs enclave
- 12 managed Windows 11 workstationsEnrolled in Intune, Defender enforced
- Shop floor estimating PCConnects to the tenant over the company VPN only
- SharePoint Online and Exchange OnlineThe company file share and mail
Places in scope
- Main office, Bend ORControlled area, locked server closet, visitor escort
Vendors in scope
- Microsoft 365Email, files, and identity; responsibilities documented on the Microsoft Service Trust Portal
- High Desert IT ServicesManaged IT support through one separate named admin account with multi factor authentication
Kept out of scope
- Shop floor CNC machines and networkHold no FCI, on a separate network with no inbound internet, so out of scope
Out of scope means one thing: the asset does not process, store, or transmit FCI (32 CFR § 170.19(b)(2)(i)). The real step also requires the vendor list: add at least one outside service provider or attest you have none before the next step opens.
Where this step lands
Your FCI boundary: everything above, one picture
The lists above say what is in scope. The boundary shows how contract information reaches the business and leaves, drawn from the same lists, in the team's own words. Specifying it is the company's act under 32 CFR § 170.19(b); it feeds the System Security Plan and it is the picture a prime asks for.
- People who touch contract files4 confirmed
- Systems and devices4 confirmed
- Places the work happens1 confirmed
- Outside services (vendors)2 listed
- Specialized equipmentoptional, skip freely
- The boundary itself3 flows described, official on file
Drawings and purchase orders from the prime
Exchange Online, then the SharePoint job folder
Solicitation files from SAM.gov and PIEE
SharePoint Online
Quotes and delivery paperwork back to the prime
Sent from Exchange Online
Worth knowing: the Level 1 Scoping Guide says plainly that a Level 1 self assessment carries no documentation requirements. The boundary is drawn because a reviewer will ask how FCI reaches you and the security plan quotes it, not because a rule demands the paperwork.
Your team maps the people, devices, places and vendors that touch FCI, and a credentialed officer reviews the scope before anything is signed. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.