How to scope CUI for a CMMC Level 2 assessment.

What CUI means in this rule

32 CFR 170.4 points to 32 CFR 2002.4(h) for the definition of controlled unclassified information. That section says CUI is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. CUI does not include classified information. It also does not include information a non-executive branch entity possesses in its own systems that did not come from, and was not created or possessed by or for, an executive branch agency or an entity acting for an agency. ^{2, 7}

The assessment scope is the set of all assets in the environment that will be assessed against CMMC security requirements. The company has to specify it before the assessment. ^{1, 2}

The Level 2 asset categories

Table 3 of 32 CFR 170.19(c)(1) is the Level 2 list. ¹

CUI assets process, store, or transmit CUI. Document them in the asset inventory, document how they are treated in the system security plan, and show them on the network diagram of the assessment scope. They are assessed against all Level 2 security requirements.

Security protection assets provide security functions or capabilities to the assessment scope. Document them the same way. They are assessed against the Level 2 requirements that are relevant to the capabilities they provide.

Contractor risk managed assets can process, store, or transmit CUI, and are not intended to, because of the security policy, procedures, and practices in place. They do not have to be physically or logically separated from CUI assets. Document them in the inventory, the system security plan, and the network diagram. The assessor reviews the system security plan. If the documentation is sufficient, those assets are not assessed against other CMMC requirements, except as the section notes. If the risk-based documentation or other findings raise questions, the assessor can conduct a limited check. That limited check shall not materially increase the assessment duration or the assessment cost. The limited check is assessed against CMMC security requirements.

Specialized assets can process, store, or transmit CUI and are unable to be fully secured. The section lists Internet of Things devices, Industrial Internet of Things devices, operational technology, government furnished equipment, restricted information systems, and test equipment. Document them in the inventory, the system security plan, and the network diagram, and show that they are managed under the contractor's risk-based security policies, procedures, and practices. The assessor reviews the system security plan and does not assess them against other CMMC security requirements.

What can sit out of scope

Out-of-scope assets cannot process, store, or transmit CUI, and they do not provide security protections for CUI assets. They are physically or logically separated from CUI assets. An asset that falls into any in-scope category cannot be treated as out of scope. There is no assessment requirement for an out-of-scope asset. The company prepares to justify why the asset cannot process, store, or transmit CUI. ¹

An endpoint that hosts a virtual desktop client is out of scope when that client is configured so it does not allow any processing, storage, or transmission of CUI beyond the keyboard, video, and mouse sent to the client. ¹

External service providers

32 CFR 170.4 says an external service provider is external people, technology, or facilities that an organization uses to provide and manage IT or cybersecurity services on its behalf. In the CMMC program, CUI or security protection data has to be processed, stored, or transmitted on those assets for the provider to count as an external service provider. Security protection data is data stored or processed by security protection assets and used to protect the assessed environment. The definition gives examples: configuration data required to operate a security protection asset, log files generated or ingested by one, data on the configuration or vulnerability status of in-scope assets, and passwords that grant access to the in-scope environment. ²

Table 4 of 32 CFR 170.19 splits the provider by whether it is a cloud service provider and by what it handles. ¹

If the provider processes, stores, or transmits CUI, and it is a cloud service provider, the cloud service provider shall meet the FedRAMP requirements in DFARS 252.204-7012. If it is not a cloud service provider, the services are in the assessment scope and are assessed as part of the assessment.

If the provider handles security protection data and does not handle CUI, the services are in the assessment scope and are assessed as security protection assets. That line applies whether or not the provider is a cloud service provider.

A service provider that processes neither CUI nor security protection data does not meet the CMMC definition of an external service provider.

The use of the provider, the relationship, and the services have to be documented in the system security plan and described in the provider's service description and customer responsibility matrix. The section notes that the provider may voluntarily undergo a CMMC certification assessment. The minimum assessment type for the provider is dictated by the contract requirement. ¹

DFARS 252.204-7012 says that if the contractor intends to use an external cloud service provider to store, process, or transmit covered defense information, the contractor shall require the cloud service provider to meet security requirements equivalent to the FedRAMP Moderate baseline and to comply with paragraphs (c) through (g) of that clause. ⁵

32 CFR 170.16 and 32 CFR 170.17 add a separate cloud line for the assessment: the cloud product or service meets the FedRAMP Moderate baseline the rule names, or it meets security requirements equivalent to that baseline under DoD policy.

The source says: The rule's words are FedRAMP Authorized at the Moderate baseline or higher, or not FedRAMP Authorized at that baseline and equivalent under DoD policy. The same sections say the company's on-premises infrastructure connecting to that offering is part of the assessment scope and will also be assessed, and that the security requirements from the customer responsibility matrix must be documented or referred to in the system security plan. ^{3, 4}

A software listing on this site is not a finding that a product meets either of those cloud lines. Read the contract and the provider's own authorization page.

Level 3 is a tighter boundary

If a later contract asks for Level 3, 32 CFR 170.19(e) says the Level 3 assessment scope must be equal to or a subset of the Level 2 scope. Any Level 2 plan of action and milestones items must be closed before the Level 3 certification assessment starts. DCMA DIBCAC may check any Level 2 security requirement of any in-scope asset. ¹

Sources checked October 16, 2026. Not legal advice.