CMMC Level 1 & Level 2 Scoping Guide - CCA 2025

Prior to a Level 1 Self-Assessment, the contractor must specify what?

The scope

What does the scope identify?

Which assets within the contractor's environment will be assessed and the details of the self-assessment

In scope FCI assets performs what three functions?

Process, Store, Transmit FCI

What are out-of-scope assets?

Assets that do not process, store or transmit FCI or CUI.

Physical or logical separation from CUI assets are required.

What are some examples of specialized assets?

Government property, IOT or IIOT, Restricted Information Systems, Test Equipment.

Are specialized assets part of the assessment scope? Why or why not?

No

Falls out of scope if properly documented. There should already be risk-based policy and procedures in place.

What are the four main categories that process, store or transmit FCI within the contractor's environment?

People, technology, facilities, external service providers

Assets that process, store or transmit FCI are considered in which type of assessment scope?

Self-assessment scope

What are security protection assets?

Assets that provide security functions or capabilities to the assessment scope, regardless of whether or not they process, store or transmit CUI.

What are contractor risk managed assets?

Assets that can, but are not intended to, process, store or transmit CUI due to policy, procedures and practices that are in place.

Not required to be physically or logically separated from CUI assets.

What are specialized assets?

Assets that may or may not process, store, transmit CUI.

For Level 2, which four assets are required to be documented in an asset inventory, SSP and network diagram?

1. CUI Assets

2. Security Protection Assets

3. Contractor Risk Managed Assets

4. Specialized Assets

Which assets are assessed against CMMC practices?

CUI Assets and Security Protection Assets

When it comes to Contractor Risk Managed Assets, if documentation raises questions about the assets what does the Assessor do?

Limited spot check

What are the two requirements of a limited spot check?

1. Shall not materially increase duration or cost of assessment

2. Must be within the defined assessment scope

SSP's are reviewed by the Assessor in accordance with CA.L2-3.12-4 for which two asset types?

1. Contractor Risk Managed

2. Specialized