In Scope Isn’t One Thing
In scope is a set of categories, each with a different amount of work attached. Sorting honestly is what makes the program affordable. Sorting wishfully is what makes it expensive later.
You followed the drawing. You know where controlled information enters, where it lands, who opens it, and where it goes after that. Now someone puts the list on the table and asks the obvious question: so is all of this in scope?
It is the right question, and the honest answer surprises people. In scope is not one thing.
It is a set of categories, each with a different amount of work attached, and sorting your list into them is the next real job.
The two-pile problem
Picture a team that finishes the discovery work and comes back with a long list. They do what feels natural. They make two piles, in and out. The in pile is frightening, so the out pile gets generous. Nobody is being dishonest. They are triaging by budget, because in and out are the only two options anyone gave them.
Two things go wrong. The first is that the sorting is driven by what the company can afford rather than by what each asset actually does. The second is quieter: some of the most important items never make either pile, because nobody thinks of them as assets at all. The monitoring platform. The provider who administers the network. The room where the drawings get discussed.
When I was the compliance lead, the thing that reframed scope for me was realizing our service provider was not sitting beside our environment. Their tooling reached into it. Once you see that, you stop asking which of our machines hold CUI and start asking what touches this environment and what protects it.
The mistake is sorting by cost instead of by function
So the mistake is not carelessness. It is using the wrong question. In and out is a budget question. The rule actually asks a functional one: what does this asset do in relation to controlled information? Does it handle it, protect it, sit near it, or genuinely have nothing to do with it? Answer that first, and the category follows. Answer the budget question first, and you will end up defending a scope decision you cannot explain.
Every relevant asset needs a scope decision
In scope isn’t one obligation. It’s several different ones, and knowing which one applies is what keeps the work proportional.
That is the shift, and it is good news rather than bad. The categories exist precisely so that not everything in your environment carries the full weight of the standard. Sorting honestly is what makes the program affordable. Sorting wishfully is what makes it expensive later.
A new stop every Tuesday and Thursday.
Our twice-weekly series breaking CMMC down one step at a time. Opt in and we’ll send each one to your inbox.
What the in-scope categories actually are
In scope means one thing here: the controlled information that lives inside your boundary, and the assets that handle or protect it. At Level 1 the same question applies to federal contract information. There are four categories for the assets that fall inside that boundary. Here is the plain-language version, and it is worth reading with your list in front of you.
CUI assets.
Anything that processes, stores, or transmits controlled information. These carry the full set of Level 2 requirements. This is the pile people expect.
Security protection assets.
Assets that provide security functions or capabilities to your CUI environment, measured against the requirements relevant to what they provide. Think authentication, monitoring, logging, filtering, endpoint protection, and vulnerability management. These are easy to miss, because they may never hold the controlled information you were following. They protect the systems that do.
Contractor risk managed assets.
Assets that can, but are not intended to, process, store, or transmit CUI because of the security policies, procedures, and practices you have in place. They are documented rather than routinely measured against the full set of requirements, and they are not required to be separated from your CUI assets. The documentation is the price of admission here.
Specialized assets.
Government furnished equipment, operational technology, Internet of Things devices, restricted information systems, and test equipment. Think an industrial control system on the floor or the oscilloscope on the bench. They are documented and managed under a risk-based approach rather than measured against everything.
Out of scope is not a fifth category alongside those four. It is a determination you make and have to be able to explain: the asset cannot process, store, or transmit controlled information, and it provides no security protection to the assets that do. There is one rule worth writing on the wall. An asset that falls into any in-scope category cannot be treated as out of scope.
Each in-scope category comes with its own documentation expectations and its own degree of obligation against the requirements, and which applies depends on the category. Your job is to identify the asset, document why it belongs in that category, and make sure your system security plan, asset inventory, and network diagram accurately reflect the environment. Categories are not labels you apply. They are positions you take, in writing.
People, facilities, and outside providers shape your scope too, and they deserve their own analysis rather than an automatic label. The firm that administers or monitors your environment, the facility where controlled work happens, the administrator who holds the keys: what matters is the function each performs in relation to your controlled environment. Work that out deliberately instead of assuming it falls outside the question.
Why the sort has to be honest
There is a reason to get this right that has nothing to do with certification timelines, and three things in particular do not pause.
An incident does not wait for your paperwork. Controlled information sitting somewhere you never categorized is also sitting somewhere you never protected, and the obligation under DFARS 252.204-7012 to report a cyber incident within 72 hours applies to it either way.
Government-led review continues. The Department has said it will keep enforcing the standard through self-assessments and selected government-led assessments, so a pause in third-party certification is not a pause in oversight.
And the number you post rests on this sort. When you submit a score and affirm it, you are making a representation about what you protect. In June 2026, a Huntsville defense contractor agreed to pay $507,144 to resolve False Claims Act allegations that it certified compliance on two Navy contracts while failing to implement required NIST SP 800-171 controls. A government assessment later scored that environment at negative 170, at the low end of a range that runs from negative 203 to 110. The distance between what was claimed and what was there is the whole case.
This is sorting, not spending
Here is the encouraging part. The first part of this work is primarily analysis and documentation rather than purchasing technology. It runs on a list you already built and decisions only your people can make. You are not buying anything yet. You are figuring out what you would be buying it for.
And the categories work in your favor. Without them, every asset in the building looks like it needs the full standard, which is how a program ends up looking unaffordable before it starts. With them, the full weight lands where the controlled information actually is, and the rest is documented honestly and managed for what it is.
What I would do if I were in your seat
Determine the treatment of every relevant asset on the discovery list.
If it is in scope, decide which category applies. If you believe it is out of scope, document why. Work down the list once without stopping to argue, then go back to the hard ones.
Start with what protects the environment, because that pile gets missed.
Who administers it, who monitors it, who backs it up, who filters the mail, who holds the keys. Then ask which of those are people or companies rather than machines.
Name the places and providers, not just the equipment.
The rooms where controlled work happens, the facilities that house your systems, and the outside firms with access all need to be considered when you define and document your boundary.
Write the treatment as you go, one short paragraph per asset.
What it is, which category, and why. Writing it while the reasoning is fresh is far easier than reconstructing it months later, and it is what your system security plan needs anyway.
Check your out-of-scope pile against the rule.
Anything that lands in an in-scope category cannot be moved out of scope, no matter how much you would like it to be. Catching that now is cheaper than having it caught for you.
Where this leaves you
You don’t need to start this work by buying a tool or waiting for another budget cycle. What it takes is going through the list you already have and being willing to say what each thing is. That sort is what turns a pile of discovery notes into a scope you can describe, and a scope you can describe is what everything after this depends on.
So here is the question worth sitting with, and it tends to change the conversation in a leadership meeting.
If we listed every asset that protects our controlled environment, how many of them would we not own? If that number is higher than you expected, you have just found the part of your scope that lives outside your walls.
CMMC: Everything You Need to Know to Get Started (6th Edition)
Want the full compliance framework and the funding resources available to defense contractors? Our guide has it.
A few sources
- CMMC Level 2 scoping guidance and 32 CFR 170.19: the asset categories, what each one means, and what each one obligates you to do
- U.S. Department of Justice settlement announcement (June 18, 2026) and DFARS 252.204-7012: what a compliance representation is worth, and the 72-hour incident reporting obligation that does not pause
- NIST SP 800-171 Rev. 2: the security requirements that CUI assets are measured against under the current CMMC Level 2 framework
