Scoping decision record
Which level, which systems are in and out of the boundary, and why — the document that stops the boundary growing by accident.
AdvisoryKnow what CMMC actually requires of you
Know what CMMC actually requires of you
before you spend on it.
Most defense contractors do not have a CMMC problem. They have a scoping problem, a documentation problem, and a managed-service-provider problem, and CMMC is the deadline that makes all three visible at once.
This is readiness work: establishing which level applies, where the boundary sits, what the gap against NIST SP 800-171 really is, and what has to be true before an assessor arrives. It runs as a current-state assessment scoped to your obligation, or as fractional CISO work when someone has to own the program through the assessment.
We are not a C3PAO. We prepare you for the assessment; we do not conduct it, and nobody can guarantee its outcome.
CISSPCISMC|CISO
NIST 800-171·DFARS 252.204-7012·CMMC 2.0| also SOC 2 · HIPAA · ISO 27001
The obligation
The contract sets the requirement. Your environment sets the scope.
Your required CMMC status comes from the solicitation, contract, task order, delivery order, or valid flow-down — not from information type alone. The information involved then determines applicability and scope. Under the codified model, Level 1 uses the 15 FAR safeguarding requirements for FCI, Level 2 uses the 110 requirements of NIST SP 800-171 Revision 2 for CUI, and Level 3 adds selected NIST SP 800-172 requirements.
Scope follows the actual environment: the systems and services used in performance that process, store, or transmit FCI or CUI; the people and facilities involved; enclave connections; applicable external providers; and, at Level 2, assets that protect the CUI environment. The objective is the smallest defensible boundary — not a whole-company default, and not an enclave that excludes assets the rules place inside it. The readiness work answers five questions in a form your leadership and your assessor can both use.
- What CMMC status does the governing procurement require now?
- Where do FCI and CUI live, move, and get processed — and which systems, services, people, facilities, and external providers belong inside the boundary?
- Against the 110 requirements, what is genuinely in place, what is documented but not practised, and what is missing?
- Which of your providers inherit requirements, and can they evidence them?
- What must be closed before the assessment, and what can legitimately sit on a POA&M?
Coverage
What readiness work includes.
Leadership-level work that produces the artifacts an assessment turns on. Where control implementation is needed, we specify it and your team or provider does it.
01Applicability and obligation triage
Read the contracts and the flow-downs, identify FCI and CUI, and settle which level applies to which work. Sometimes the answer is that a smaller obligation than assumed is the real one.
02Boundary and scoping
Trace where CUI is created, stored, transmitted, and processed, then draw the boundary deliberately — including what to de-scope, and the enclave or segmentation decisions that make de-scoping defensible. Every scoping decision is recorded with its reasoning.
03Gap assessment against SP 800-171
Each of the 110 requirements assessed as implemented, partially implemented, or not implemented, with the evidence that supports the answer. The output is the basis for an honest SPRS score, not an optimistic one.
- NIST SP 800-171 Rev 2
- NIST SP 800-171A assessment objectives
- DFARS 252.204-7012 / 7019 / 7020 / 7021
- 32 CFR Part 170
04System Security Plan, POA&M, and evidence
An SSP that describes the system you actually run. A POA&M sequenced against what an assessor will and will not accept as open. An evidence plan that says, for each requirement, what artifact proves it and who owns keeping it current.
05Provider and assessment coordination
Your MSP and other external service providers can affect scope and evidence even when the current requirement is a self-assessment. We establish what each provider inherits, what each must evidence, and what its contract needs to say. If an independent or government-led assessment applies, the same record is ready for that assessor.
Deliverables
What you receive.
The documents the assessment is conducted against, written so they survive contact with an assessor.
Gap assessment
All 110 requirements with implementation status and supporting evidence, and the SPRS score that status honestly supports.
System Security Plan
A description of the environment, the boundary, and how each requirement is met, in the form an assessor expects to read.
Remediation roadmap and CMMC POA&M
Two plans, kept separate. The security roadmap sequences the wider program at 30, 60, 180, and 365 days. If an assessment results in Conditional CMMC Status, the CMMC POA&M is limited to eligible NOT MET requirements and must be closed through the required closeout assessment within 180 days. Work outside those rules stays on the internal roadmap; it is not represented as an open CMMC assessment finding.
Evidence and provider plan
Per requirement: the artifact that proves it, who owns it, and which provider inherits it — with the contract language those providers need to be held to.
Fit
Who this is for.
- Defense subcontractors with a CMMC clause in a new or renewing contract and no clear picture of what it requires
- Primes asking their suppliers for an SPRS score or a certification date
- Organizations that have bought a compliance platform and are unsure what it has actually closed
- Companies whose MSP says “we handle that” and have never seen the evidence
- Leadership that needs to know the true cost of Level 2 before committing to it
- Teams that have already been assessed once and did not pass
Scope
What this is not.
Clarity cuts both ways. Here is what we do not do, so you can rule us out quickly if we are the wrong fit.
- Not a C3PAO — we do not conduct certification assessments, and we do not participate in yours
- Not a guarantee of certification, a score, or an assessment outcome
- Not control implementation — we specify the work; your team or provider performs it
- Not a managed service, and not tool resale — no vendor partnerships, no referral fees, no enclave product of our own
- Not legal advice on your DFARS clauses or your contract's obligations
- Not a substitute for reading the contract — the contract's requirements control, not this page
Before you call
Questions we get first.
Do we actually need Level 2?
CUI generally brings the Level 2 requirements into view, but it does not by itself establish the CMMC status required for a particular procurement. Start with the solicitation, contract, task order, delivery order, or valid flow-down. Confirm the clause, the stated CMMC status, and the current implementation direction; then identify the FCI or CUI involved and every system or service used in performance that processes, stores, or transmits it. We settle both questions first: what the procurement requires now, and what environment must carry it.
Can you certify us?
No. Certification assessments are conducted by an accredited C3PAO, and readiness work is deliberately separate from assessment so that the assessor is independent. We prepare you; we do not assess you. One of the engagements on our representative experience page went on to complete a Level 2 certification assessment with a C3PAO — the assessment was theirs, not ours.
Can we leave items on a POA&M?
Only within the conditional-status rules. Level 1 permits no CMMC POA&M. At Level 2, conditional status requires a score of at least 80 percent of the Level 2 total, excludes specified requirements and most findings worth more than one point, and expires unless the POA&M is successfully closed through a closeout assessment within 180 days. Other improvement work belongs on the internal security roadmap, not on the CMMC assessment POA&M.
What about SP 800-171 Revision 3?
CMMC currently uses Revision 2, and the Department's interim enforcement posture also relies on Revision 2. The CMMC scope, evidence, and assessment package therefore need to stay aligned to Revision 2. NIST published Revision 3 in May 2024, and a separate Revision 3 gap analysis or migration plan may still be appropriate where another contract or customer requires it, or where leadership is intentionally preparing for transition. We keep those workstreams distinct rather than blending Revision 3 evidence into a Revision 2 CMMC package.
Our MSP says they are CMMC-compliant. Is that enough?
A provider can be well run and still not cover your requirements, because inheritance is specific: it depends on what they do for you, what your contract with them says, and what evidence they can produce. We establish that per requirement rather than accepting the general claim.
Find out what it will really cost before you commit.
Thirty minutes to establish which level applies and whether readiness work is the right next move. If it isn't, we'll tell you that on the call.