Every year, defense contractors spend hundreds of thousands of dollars preparing for the Cybersecurity Maturity Model Certification (CMMC). They deploy expensive firewalls, buy elite security software, and write months of policy. Then the assessor arrives, and the whole project stalls or falls apart. 

The failure rarely comes from weak security tools. It comes from poorly defined scope, and that’s a problem that must be solved at the start, because it’s the foundation every other part of CMMC stands on. Get it wrong and you don’t just fail an assessment, you sign affirmations you can’t stand behind and pass risk to partners counting on you. Get it right and certification, ongoing compliance, and supply chain security all become achievable. 

Before another dollar gets spent, settle what your scope is. 

CMMC scope defined

Scope exists for one reason: Controlled Unclassified Information (CUI) must be protected. That is not a DoD preference, it is national policy. Executive Order 13556 established the CUI Program in 2010. 32 CFR Part 2002 sets the rules for how CUI is designated, marked, and safeguarded. For defense contractors, the safeguarding obligation runs through DFARS 252.204-7012 and NIST SP 800-171. CMMC did not invent these duties. It verifies you are meeting the ones already written to protect the nonpublic information that supports the warfighter. Your scope is simply the perimeter of where that obligation lives inside your business. 

Look past the marketing and go straight to the source. Under 32 CFR § 170.19(a)(1), the CMMC Assessment Scope is “the set of all assets in the Organization Seeking Assessment (OSA) environment that will be assessed against CMMC security requirements.” 

Scope is not a circle drawn around your IT department. It is the documented process of categorizing every asset by how it touches federal data.  

For a Level 1 (FCI) scope, the regulation directs you to consider the people, technology, facilities, and External Service Providers (ESPs) that process, store, or transmit federal information (32 CFR § 170.19(b)).  

For a Level 2 (CUI) scope, that same logic is formalized into five asset categories (Table 3 to § 170.19(c)(1)). Either way, scope runs through your staff, systems, physical locations, and the third parties you depend on.  

Miss one of those four, and your boundary is already broken. 

Those five CMMC Level 2 asset categories are worth keeping close: 

• CUI assets: Assets that process, store, or transmit CUI. All 110 NIST SP 800-171 Revision 2 requirements apply. 
• Security protection assets (SPAs): Systems and people that provide security functions to your CUI environment (a SIEM, firewalls, an ESP running log management, your SOC team), are in scope even if they never touch CUI, because they defend the assets that do. 
• Contractor risk managed assets (CRMAs): Assets capable of touching CUI but kept from it by deliberate policy. No separation is required, but you must document how CUI stays out and manage them under your risk-based practices. 
• Specialized assets: Government-furnished equipment, IoT/IIoT, operational technology (OT), restricted information systems, and test equipment. Documented in the SSP and managed by risk-based policy at Level 2; assessed against the full requirement set at Level 3. 
• Out-of-scope assets: Assets that cannot process, store, or transmit CUI and provide no security protection to those that do, kept that way by logical or physical separation. 

Here is why categorization is judgment, not labeling.  

Take a single tool like Slack and watch it land in three different categories depending on one thing: how it touches federal data. If you share CUI in Slack collaboration channels, Slack is a CUI Asset, and the full requirement set applies. If Slack is capable of carrying CUI but your policy and enforcement deliberately keep CUI out of it, it could be a CRMA, meaning it’s in scope, but evaluated against your risk-management practice rather than all 110 requirements. And if it is genuinely walled off from federal data and provides no security function, it’s an out-of-scope asset. 

Same software, three radically different obligations, decided entirely by how it interacts with CUI. Put it in the wrong category and you have either inflated your bill or created a hole in your boundary. There is no third outcome. 

Getting certified — scope is where the assessment is won or lost

Most contractors start backward. They download a control checklist and try to apply 110 requirements to their entire enterprise. That is a strategic error that destroys budgets. 

Start with the data, not the inventory. Under DFARS 252.204-7012, a Covered Contractor Information System is one that processes, stores, or transmits covered defense information. You cannot find that system by listing your devices. You find it by tracing how federal data flows through the workflows that earn you revenue, from the moment it arrives to the moment you deliver. Map the functional path first. The in-scope systems reveal themselves. 

Hunt the hidden in-scope assets. Contractors assume that if a system never stores CUI, it’s out of scope. The Level 2 scoping framework says otherwise. Your centralized logging, SIEM, and backup systems are textbook Security Protection Assets. And a “break-glass” emergency account that bypasses MFA isn’t a separate category at all. It’s a privileged credential that can reach the CUI environment, so it is fully in scope and assessed under the access controland identification requirements. Assess your security tools with the same intensity as your CUI databases. 

Categorize correctly — it’s leverage, not just paperwork. Accurate categorization is where scope stops being a compliance cost and becomes a business decision. Over-scope, and you pay to protect assets that never needed it. Under-scope, and you carry risk you can’t see. Categorize each asset to reflect how the business uses it and how your contracts and customers require it to be handled. Your boundary aligns with the work, not with fear or general guidance. That alignment is the opportunity most contractors leave on the table. 

Your documents drive the assessment plan, and the assessor validates your scope. Asset categorization is not an internal exercise that stays internal. It produces your three foundational artifacts: the asset inventory, the network diagram, and the System Security Plan. Those three documents and the asset categorization shape the assessment plan. Get the categorization wrong and you’ve mis-shaped the engagement before it starts. 

That is why scope validation is a formal step of the assessment, not a prerequisite to it. The Lead Certified CMMC Assessor (CCA) validates your CMMC Assessment Scope before the assessment proceeds, and any disagreement about what is in or out has to be resolved first.  

The regulation also ties scope to documentation: under 32 CFR § 170.19 you need a current System Security Plan (the SSP requirement, CA.L2-3.12.4) describing every in-scope system at the time of assessment. When your inventory, diagram, and SSP disagree, the assessor sees it early. That is a scoping failure, not a control failure, and it is one of the most common reasons an assessment stalls into a discovery exercise. 

Staying certified — scope is what your Affirming Official is signing

Certification lasts three years, but it is a baseline you are legally responsible for maintaining, not a finish line. Under 32 CFR § 170.22, an Affirming Official must affirm your organization’s continuing compliance at assessment completion, POA&M closeout, and annually, entered electronically in SPRS. It applies to every organization in the chain, prime or subcontractor. 

That signature has a named, defined owner. The regulation (32 CFR § 170.4) defines the Affirming Official as the senior representative “responsible for ensuring the OSA’s compliance with the CMMC Program requirements” and holding “the authority to affirm the OSA’s continuing compliance.”  

Two distinct demands live in that definition: responsibility for compliance and the authority to commit the organization. The affirmation names the official and attests that the organization has implemented, and will maintain, all applicable CMMC security requirements for every system within the assessment scope. 

This is why naming your Affirming Official is a business decision, not an IT one. It cannot be your network engineer. It must be someone senior enough to legally bind the company and informed enough to know the affirmation is true. If your organization can’t immediately say who holds that role, you have a governance gap, not a paperwork or technical gap.  

The affirmation is a legal attestation, and signing it while ignoring known gaps is the kind of knowing misrepresentation, or reckless disregard for the truth, that the False Claims Act reaches, with treble damages and per-claim penalties. Enforcement is escalating in fiscal year 2025 the Department of Justice reported nine cybersecurity-fraud settlements recovering more than $52 million (more than in either of the prior two years) and that enforcement has reached into the subcontractor tier of the defense supply chain. Many of those cases began with whistleblowers. The official’s name is on the claim. 

And here is the connection most leaders miss: you can only affirm what is true within your scope. Scope drifts. People change roles. New SaaS tools get adopted without review. A team provisions a cloud environment that starts handling CUI without review. An organization perfectly scoped on assessment day can be materially out of bounds within months, and the Affirming Official is signing for it anyway.  

The only defense is continuous scope management. In practice, that means tying a scope review to your change-management process so every new tool, cloud tenant, vendor, or role is checked against the boundary before it goes live. The document your senior official signs should reflect reality, not last year’s drawing. You cannot affirm what you have stopped tracking. 

The organizations that recertify smoothly in three years are the ones who treat scope as a living program, not a one-time drawing. 

Securing the supply chain — scope is liability that flows both directions

CMMC exists to protect defense information as it moves across a supply chain of more than 200,000 contractors and subcontractors. Your scope is your piece of that chain and the connections at its edges are where assessments and breaches both happen. 

Data flows downhill, but liability flows everywhere. If you share CUI with a subcontractor, that data pipeline stays firmly in your scope, and you are responsible for protecting it. Your subcontractor must get their scope right, which is why primes are increasingly demanding proof, not promises, before they let CUI flow down. If your systems connect to a prime’s portal, that boundary must be locked so a breach on your end cannot traverse back to theirs. 

External Service Providers (ESPs) are the other edge. An ESP whose systems store, process, or transmit your CUI or that handle the security data protecting it are in your scope. If that provider is a cloud service provider handling CUI, it must meet FedRAMP Moderate authorization or equivalency, a requirement that catches a surprising number of contractors off guard. Every in-scope ESP owes you a Customer Responsibility Matrix that maps each requirement to who implements it — the provider, you, or both. The practical move is simple: require that matrix from every ESP before your assessment, and a current CMMC status from every subcontractor you send CUI to. Trust is not control; documentation is. 

Securing the supply chain is not an abstract mission statement. It is the concrete work of knowing where your boundary touches everyone else’s, and that work is impossible if you don’t know where your boundary is. 

Get scope right and everything else follows

Scope is the foundation under all 110 NIST SP 800-171 requirements. You cannot get certified if your boundary is imaginary. The assessor validates your scope before the assessment can even begin. You cannot honestly stay certified if you’ve stopped tracking where that boundary really is. The affirmation becomes a liability with your senior official’s name on it. And you cannot secure the supply chain if you don’t know where your scope ends and your partners’ begins. 

Get scope right, and these stop being three separate fights. They become one disciplined practice. Get it wrong, and no amount of firewalls, software, or policy will save the rest. 

Scope first. Everything else is downstream. 

Scope is hard to get right once  and harder to keep consistent across a supply chain, which is exactly where primes and subs drift apart. Ready to get started with your CMMC assessment? Contact us today.