What assets are in scope for a CMMC Level 2 assessment?

Anything that processes, stores, or transmits CUI is in scope, plus the assets that protect it. 32 CFR 170.19 sorts your environment into five categories: CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets, and Out-of-Scope Assets, each with different documentation and assessment treatment.

Is a CMMC enclave cheaper than putting the whole organization in scope?

Usually yes on paper: a small enclave means implementing 110 practices for a handful of seats instead of the whole company. The savings hold only if CUI genuinely stays inside the boundary. When CUI flows through everyday operations, enclave discipline breaks down and whole-org scoping is often the simpler, more durable choice.

Is my email system in scope for CMMC?

If CUI has ever been emailed, your email system processed and transmitted it, so it is in scope. Keeping email out of scope requires technical controls and evidence proving CUI cannot traverse it; a policy telling people not to email CUI does not count as separation.

Does my MSP need to be in my CMMC scope?

If an MSP has administrative access to your CUI environment or provides security functions for it, the relationship is in scope and must be documented in your SSP with a customer responsibility matrix. Cloud services that store, process, or transmit CUI must also meet FedRAMP Moderate or equivalent under DFARS 252.204-7012.

Do home office laptops count in CMMC scope?

Yes, if they touch CUI. Location does not change the analysis: an employee opening a CUI drawing on a laptop at home puts that laptop in scope exactly as if it sat at headquarters. People count too; an administrator with rights over CUI systems is a Security Protection Asset.

CUI Scoping for CMMC Level 2: Enclave vs Whole-Org Boundary

body{font-family:'Inter',sans-serif;max-width:800px;margin:40px auto;padding:0 20px;line-height:1.6}CUI Scoping for CMMC Level 2: Enclave vs Whole-Org BoundaryHow to decide what is in scope for CMMC Level 2: the five asset categories, the enclave vs whole-org tradeoff, and the scoping mistakes that derail assessments.Supports Level 1 (15 practices, FAR 52.204-21) and Level 2 (110 practices, NIST SP 800-171).Please enable JavaScript to use CMMCTrack.