What "scope" means
Before any CMMC assessment, you define its scope: the set of assets in your environment that will be assessed. Assets include people, technology, facilities, and external service providers, not just computers.
Scope is the biggest single driver of how much work CMMC is. Every system in scope has to meet the requirements, be documented, and be shown to an assessor. A smaller, well-defined scope is usually cheaper to secure, cheaper to assess, and easier to keep compliant.
Level 1 scope
For Level 1, the rule is simple: any of your information systems that process, store, or transmit FCI are in scope and self-assessed against the 15 Level 1 requirements.
- Systems that never touch FCI are out of scope, with no documentation requirements.
- Specialized assets (equipment that can handle FCI but cannot be fully secured, such as IoT devices, operational technology, test equipment, or government-furnished equipment) are not assessed at Level 1.
Level 2 asset categories
Level 2 sorts every asset into one of five categories. The category decides how it is treated.
- CUI assets process, store, or transmit CUI. They are assessed against all Level 2 requirements.
- Security protection assets provide security functions to the in-scope environment: think firewalls, identity systems, or a security monitoring service. They are assessed against the requirements relevant to what they do.
- Contractor risk managed assets can process CUI but are not intended to, because your policies and procedures keep CUI off them. They must be documented in your System Security Plan; the assessor reviews that documentation and may do a limited check.
- Specialized assets (as above) must be documented and shown to be managed under your risk-based policies, but are not assessed against the other requirements.
- Out-of-scope assets cannot process CUI and do not protect anything that does. They must be physically or logically separated from CUI assets, and you should be ready to explain why they cannot process CUI.
All in-scope categories go into your asset inventory, System Security Plan, and network diagram.
What an enclave is
An enclave (a deliberately separated part of your environment that holds the information needing protection) is a scoping strategy, not a product. Instead of bringing your whole company into Level 2 scope, you keep CUI inside a smaller, separated environment, and only that environment (plus whatever protects it) is assessed.
Common shapes:
- A separate network segment with its own devices, used only for CUI work.
- Dedicated machines for the people who need CUI, with everyone else outside the boundary.
- A cloud environment set up specifically for CUI, which your staff reach into from their normal workspace.
Cloud and outside providers
Outside help is part of your scope too.
- A cloud service provider that stores or processes your CUI must meet FedRAMP Moderate or an equivalent under DFARS 252.204-7012. The FedRAMP Marketplace lists authorized services.
- An external service provider that is not a cloud provider (for example a managed IT company with access to your CUI systems) has its services assessed as part of your assessment. It does not need its own CMMC certification, though it may choose to get one.
- Either way, document the provider in your System Security Plan, and expect a description of the service and a customer responsibility matrix: who is responsible for which requirement.
Trade-offs to weigh
An enclave can cut scope dramatically, but it changes how people work.
- Discipline: CUI has to stay inside the boundary. A single drawing saved to a laptop outside it can pull that laptop into scope.
- Workflow friction: the people who need CUI work in two environments.
- Cost moves, not vanishes: you spend less securing the whole company and more building and running the enclave.
- Best fit: companies where a small number of people touch CUI. If most of the company works with CUI every day, a company-wide boundary may be simpler.