Skip to main content

Now accepting design partners.

Request a demo
Request a demo

CMMC scoping wizard

Know your CMMC scope in about 20 minutes.

Free. No account. Seven steps from business context to a scoping package you can take to an assessor.

Start scopingSee what you leave withSee what you leave with

CMMC scoping / step 3 of 7

Step 3 of 7
  1. 1 Business context, done
  2. 2 CUI identification, done
  3. 3 Asset inventory, current step
  4. 4 CUI data flow
  5. 5 Boundary
  6. 6 Gap analysis
  7. 7 Scoping package

Asset inventory

Assign each asset to a category.

5 MIN

AssetCategory
Laptop fleetCUI asset
File serverCUI asset
FirewallSecurity protection asset
PrinterContractor risk managed
Lab equipmentSpecialized
Guest networkOut of scope

Seven decisions, in order.

About 20 minutes of answers. Each step uses what the one before it found.

  1. Step 1: Business context

    Who you work for and under which contracts.

    2 MIN

  2. Step 2: CUI identification

    Which of your information is CUI.

    3 MIN

  3. Step 3: Asset inventory

    What handles it and what protects it.

    5 MIN

  4. Step 4: CUI data flow mapping

    How it comes in, moves and goes out.

    4 MIN

  5. Step 5: Assessment boundary definition

    Where the line around it sits.

    2 MIN

  6. Step 6: Gap analysis against 110 practices

    What is met and what is not.

    3 MIN

  7. Step 7: Scoping package

    The documents, generated from your answers.

    INSTANT

TIME PER STEP

19 MIN OF ANSWERS, THEN THE PACKAGE

Scope is a decision about every asset.

Each asset lands in one of five categories. The boundary follows from where they land.

assessment boundary

CUI assets

Process, store or transmit CUI.

Laptop fleetFile server

Security protection assets

Provide security functions for the scope.

Firewall

Specialized assets

Such as test equipment and operational technology.

Lab equipment

Contractor risk managed assets

Could handle CUI, but are not meant to.

Printer

ON THE EDGE

outside the boundary

Out of scope

Cannot handle CUI.

Guest network

See where CUI enters, moves and leaves.

Every transfer that touches CUI, drawn from your answers.

CMMC scoping / CUI data flow

Step 4
Prime contractor portalSOURCE
CUI enters

assessment boundary

Email gatewayENTERS
moves
File shareSTORED
moves
Engineering workstationPROCESSED
CUI leaves
ExportDESTINATION

Generated in step 4. Required for the SSP.

4 TRANSFERS, 2 BOUNDARY CROSSINGS

A scoping package, not a quiz result.

Five documents, built from your answers, that you can take to an assessor.

  1. Level determination

    With the regulatory basis for it.

  2. Boundary description

    What sits inside the assessment boundary.

  3. Categorized asset inventory

    Every asset, in one of five categories.

  4. CUI data flow diagram

    Where CUI enters, moves and leaves.

  5. Gap analysis

    Against 110 practices, with an SPRS score.

CMMC scoping / gap analysis

Estimate

SPRS estimate

94of 110

Practices met
104
Not met
6
Points to recover
16
Three highest-weight gaps, ordered by weight
Three highest-weight gapsORDERED BY WEIGHT
AU.L2-3.3.1AU.L2-3.3.1Create and retain system audit logsWeight 5
RA.L2-3.11.2RA.L2-3.11.2Scan for vulnerabilitiesWeight 5
AC.L2-3.1.5AC.L2-3.1.5Employ least privilegeWeight 3

Three more gaps at weight 1. Scores are an estimate from your answers, not an assessment result.

WHERE CMMC STANDS

CMMC Phase II
third-party assessments
were suspended on
July 13, 2026.

Self-assessments, DFARS 252.204-7012 and the 110 NIST SP 800-171 requirements remain, and scope still decides how much work that is.

32 CFR Part 170. NIST SP 800-171 Rev 2. CMMC Scoping Guidance.

Start scoping

SUSPENDED

  • Phase II third-party assessmentsJULY 13, 2026

STILL IN FORCE

  • Level 1 and Level 2 self-assessments
  • DFARS 252.204-7012
  • 110 NIST SP 800-171 requirements
  • SPRS entries

Authorization is not a destination. It is a system property.

Request a demo and we will walk one finding from detection to signed evidence.

Request a demoSee the platform

  • Federal programs

    Invitation only, with CAC and PIV.

    Request access

  • Commercial teams

    Self-register with single sign-on.

    Create a workspace

  • Pricing

    Plans start at $2,500 per month. In-boundary and air-gapped deployments are scoped per program.

    See pricing