Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.
Step 3 of 5 · Scope your assessment
Put everything you have in its official category
The rule sorts every person, device, place, and provider into one of five categories (32 CFR § 170.19(c)(1) Table 3), and that sorted list, confirmed, is the assessment scope. Meridian's team placed all 12 items, wrote the reason for each one outside CUI Assets, and confirmed the scope.
CUI Assets
4 itemsTouches the controlled files: opens, stores, prints, or sends them.
The rule: “Assets that process, store, or transmit CUI.” Your duty: On the list, its treatment in your security plan (the SSP), on the map. The assessor: Assessed against all 110 requirements.
Where engineers open and edit CUI
Work with CUI under a need to know
Where CUI is worked
Cloud provider: yes · Holds CUI: yes · Holds security data: no · the 7012 (c) through (g) commitment on file. FedRAMP authorized at Moderate or higher. Evidence: the FedRAMP Marketplace listing, plus the provider's written commitment to DFARS 252.204-7012 paragraphs (c) through (g).
Shared with Microsoft 365 GCC High: their half is in your responsibility matrix (Microsoft Product Placemat for CMMC 2.0 (Preview)). Your half is still needed. Drafted from the placemat: 109 requirements shared, 1 the customer's alone, and none inherited, so Meridian shows its own proof on every one. Carla Reyes confirmed the rows against the document.
Security Protection Assets
4 itemsProtects the things above: firewall, antivirus, sign in provider, the IT company, the person who runs the network.
The rule: “Assets that provide security functions or capabilities to the OSA's CMMC Assessment Scope.” Your duty: On the list, its treatment in your security plan, on the map. The assessor: Assessed for the protection it provides.
Protects every in scope workstation
Why: Provides malware protection for the in scope systems; assessed for the protection it provides. Managed by our IT company, a provider on this board.
Manages device configuration and compliance
Why: Enforces the configuration and compliance settings on every engineering workstation; assessed for the protection it provides. Managed by our IT company, a provider on this board.
Boundary protection for the office network
Why: Provides boundary protection for the in scope systems; assessed for the protection it provides. Managed by our IT company, a provider on this board.
Cloud provider: no · Holds CUI: no · Holds security data: yes · a contract or SLA on file. Not a cloud provider: no FedRAMP requirement. Its services are assessed inside this assessment (32 CFR § 170.19(c)(2) Table 4).
Nothing is inherited from this provider. An IT company is an External Service Provider but not a cloud service provider, so its rows document who does what and carry no requirement. 5 requirements are written as shared with Northstar Managed IT, and Meridian shows its own proof on each.
Contractor Risk Managed Assets
1 itemCould touch the files, but a written rule says it must not.
The rule: “Assets that can, but are not intended to, process, store, or transmit CUI because of security policy, procedures, and practices in place.” Your duty: On the list, its treatment in your security plan with the written rule, on the map. The assessor: The assessor reads the rule and may run a limited check.
Can, but is not intended to, show CUI; policy keeps it off
Why: Policy: CUI is never shown or cast on this display, and it signs in to no account on the CUI systems. The written rule is in the Access Control Policy.
Specialized Assets
1 itemOne of the six kinds the rule names as unable to be fully secured: machines and controls, sensors and smart devices, government furnished equipment, test equipment, systems built to government specifications.
The rule: “Assets that can process, store, or transmit CUI but are unable to be fully secured, including: Internet of Things (IoT) devices, Industrial Internet of Things (IIoT) devices, Operational Technology (OT), Government Furnished Equipment (GFE), Restricted Information Systems, and Test Equipment.” Your duty: On the list, its treatment in your security plan showing how your policies keep it safe, on the map. The assessor: The plan is reviewed; the machine is not assessed against the 110.
If a requirement can never be met on this asset, record an Enduring Exception at step 5 and name what you do instead (CMMC Scoping Guide Level 2: a Specialized Asset may be eligible for an Enduring Exception).
Test equipment, specialized
Why: Test Equipment per 32 CFR 170.19(c)(1) Table 3 (hardware and associated IT used to test products, components, and deliverables: oscilloscopes, spectrum analyzers, power meters, gauges, special test equipment). Kept safe: It sits on its own network segment with no internet access. The vendor maintains and updates it under the maintenance policy. Managed under our risk based security policies, procedures, and practices (32 CFR 170.19(c)(1) Table 3); reviewed in the SSP, not assessed against the 110.
Out of Scope Assets
2 itemsCannot touch the files and is kept separate.
The rule: “Assets that cannot process, store, or transmit CUI; and do not provide security protections for CUI Assets.” Your duty: Be ready to say why (the rule has no documentation requirement here; naming it is what an assessor respects). The assessor: Not assessed.
Holds no CUI, no connection to the enclave
Why: Cannot reach CUI: sales mail and marketing files only, in a separate tenant with no accounts on the CUI systems and no sharing into the GCC High tenant.
Separate network, no route to the enclave
Why: Cannot reach CUI: a separate network with no path to the in scope systems (logical separation per the Scoping Guide). Logically separated: data transfer to the CUI systems is prevented by the firewall, VLAN, or VPN configuration, and it has no accounts on the CUI systems (CMMC Scoping Guide Level 2, Separation Techniques).
What you do not have
A missing chip proves nothing. Each line is a confirmed fact under a name and a date, printed on the scope statement, and asked again, still true today, at every affirmation.
- No removable media in use (confirmed by Marcus Hale, 2026-02-03)
- No publicly accessible system we run (confirmed by Marcus Hale, 2026-02-03)
- No controlled information on paper (confirmed by Marcus Hale, 2026-02-03)
The network diagram, the assessor's first read
Saved, v2 with 13 assetsDrafted from the board at confirm, then refined by the team. On a phone, scroll the diagram sideways.
Separation: The commercial tenant and the guest Wi Fi have no route and no account into the GCC High tenant or the engineering PCs.
Confirm your assessment scope
The rule makes a business specify its scope before any assessment (32 CFR § 170.19(c)). Confirming says: these five lists are the scope. Anything can still change after; a change shows on the statement until the team confirms again.
- specialized qualification missing for Environmental test chamber controller
What an assessor would still ask for
Nothing on the scope statement. The controlled files are listed, both providers carry their facts and a responsibility matrix, and the diagram is saved.
Your team maps the people, devices, places and providers that touch CUI, and a credentialed officer reviews the scope before anything is signed. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.