Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.

Custodia shield
Start free for 30 days, no card
← Back to the Level 2 workspace

Step 3 of 5 · Scope your assessment

Where is CUI processed, stored, or transmitted?

Meridian named every kind of controlled file it handles, where each comes from and where it gets opened. The next step, Scope your assessment, then places everything those files touch into the five official categories.

This is the official scoping test: an asset is in the assessment the moment it processes CUI (opens, edits, prints), stores it (files at rest, even paper), or transmits it (sends it anywhere). CMMC Scoping Guide Level 2, 32 CFR § 170.19(c).

A short quiz builds the list. The team taps what the contracts send, and every answer becomes a row. Anything the quiz missed is added by hand.
Not sure what counts as CUI? Charlie can interview your team about its contracts and draft the list with you. Your team confirms every row.

The controlled files

6 kinds: 3 come in, 2 stay internal, 1 goes out
  • Part drawings and CAD models from the prime
    From: The prime's controlled file portal
    CategoryControlled Technical Information
    Comes in
    Opened or saved inGCC High SharePoint, engineering workstations
  • Specifications and statements of work
    From: Encrypted email from the prime
    CategoryControlled Technical Information
    Comes in
    Opened or saved inGCC High Exchange Online
  • Bid and pricing data for the program
    From: The prime's controlled file portal
    CategoryGeneral Procurement and Acquisition
    Comes in
    Opened or saved inGCC High SharePoint
  • Test reports and inspection data
    From: Meridian engineering
    CategoryControlled Technical Information
    Stays internal
    Opened or saved inGCC High SharePoint
  • Export controlled technical data
    From: Meridian program engineering
    CategoryExport Controlled
    Stays internal
    Opened or saved inGCC High SharePoint, engineering workstations
  • Finished deliverables back to the prime
    From: Meridian engineering
    CategoryControlled Technical Information
    Goes out
    Opened or saved inThe prime's controlled file portal

Export controlled work is a legal question

This list includes export controlled material. If people outside the United States handle it, that raises a legal question the platform does not decide. The next step surfaces it where people and places are placed; the answer comes from your attorney or your prime contractor.

Which files count

List what you handle for defense work: the contracts carrying DFARS 252.204-7012 or 252.204-7021. Those files decide the level, because CMMC covers what you handle “in the performance of the DoD contract or subcontract” (32 CFR § 170.23(a)). Not sure whether a contract counts? Ask your prime, or ask Charlie.

The controlled files are on the list. Now place everything those files touch into the five official categories.Next: Scope your assessmentOpen →

Your team finds the CUI. A credentialed officer reviews the map. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.

Start free for 30 days, no cardBook a free advisory call