Example, read only. A sample account that shows what finished CMMC looks like.
Step 3 of 7 · Scope your assessment
Map where your FCI lives.
If an asset touches federal contract information, it is in scope. Cedar Ridge Machine Works, LLC mapped its people, devices, places, and vendors from a few setup answers, confirmed each suggested row, and recorded the scope fact about the shop floor: it holds no FCI, so it sits outside the boundary. Charlie can also interview you and fill this in over chat.
People in scope
- Owner and Affirming OfficialFull access, holds admin rights in Microsoft 365
- Two estimatorsOpen and edit federal quotes and drawings
- Office administratorRead only on federal files, manages the visitor log
- Shop leadFederal quoting access, no admin rights
Devices & apps in scope
- Microsoft 365 Business Premium tenantThe Cedar Ridge Federal Programs enclave
- 12 managed Windows 11 workstationsEnrolled in Intune, Defender enforced
- Shop floor estimating PCConnects to the tenant over the company VPN only
- SharePoint Online and Exchange OnlineThe company file share and mail
Places in scope
- Main office, Bend ORControlled area, locked server closet, visitor escort
Vendors in scope
- Microsoft 365Email, files, and identity; responsibilities documented on the Microsoft trust portal
- High Desert IT ServicesManaged IT support with admin access to the tenant
Kept out of scope
- Shop floor CNC machines and networkHold no FCI, separated with no inbound internet, so out of scope
The real step requires the vendor list: add at least one external service provider or attest you have none before step 4 opens.
The platform maps your people, devices, places, and vendors from a few setup answers, so your scope is accurate and defensible. Start free, or book a call.