Most CMMC Level 2 projects go wrong at the very first step: scope. If you don't know which systems handle Controlled Unclassified Information (CUI), you can't know which systems need the 110 NIST SP 800-171 requirements.
Start with the contract
CUI reaches you through a contract. Look for DFARS 7012, flow-down clauses from your prime, and CUI markings on the documents you receive. Those tell you what data you're protecting.
Follow the data
Once you know what the CUI is, trace where it goes:
Where it arrives (email, file share, a prime's portal)
Where it's stored
Who and what can access it
Where it leaves
Sort your assets
The CMMC Level 2 scoping guidance puts assets into five groups:
CUI assets that store, process, or transmit CUI
Security protection assets that protect those systems, like your firewall, identity provider, or SIEM
Contractor risk managed assets that could reach CUI but are kept from it by policy and controls
Specialized assets such as IoT, OT, test equipment, and government property
Out-of-scope assets that can't touch CUI at all
Consider an enclave
Many small contractors keep CUI in a separate, tightly controlled environment (an enclave) instead of applying every requirement to the whole company. A smaller scope means fewer systems to protect, simpler compliance, and an easier assessment.
Write it down
Document your scope in your System Security Plan (SSP) with a network diagram and an asset inventory. An assessor will start there, and so should your SPRS score.
Need a hand?
Cyberneza is a veteran-owned, 100% US-based cybersecurity firm that helps defense contractors scope and prepare for CMMC. Get in touch, or start with our free SPRS Score Worksheet.
Top comments (0)