A software development company uses a cloud-based source code repository and continuous integration/continuous deployment (CI/CD) platform to manage…

According to the CMMC Level 2 Scoping Guide, the assessment scope is determined by where Controlled Unclassified Information (CUI) is processed, stored, or transmitted. When an Organization Seeking Certification (OSC) utilizes an External Service Provider (ESP), such as a cloud provider, for these functions, the ESP's services and assets become part of the CMMC assessment scope. The OSC remains responsible for protecting its CUI, regardless of physical ownership or management of the assets. The "sensitive code" in the scenario is treated as CUI, placing the cloud provider's platform squarely within the assessment scope. The OSC must verify the provider meets the required CMMC practices, often by leveraging a FedRAMP authorization.

A. Ownership or direct management does not determine the assessment scope; the presence and handling of CUI is the determining factor.

C. The terms "certification boundary" and "assessment scope" are used to define the same set of assets for a CMMC assessment; an asset cannot be within the boundary but excluded from the scope.

D. A contract defines the shared responsibilities for security controls but does not alter the fundamental requirement that assets handling CUI must be included in the assessment scope.

1. Cybersecurity Maturity Model Certification (CMMC) Scoping Guide, Level 2, Version 2.0, December 2021.

Section 2.3, Scoping of External Service Providers (ESPs), Page 8: "If an OSC leverages an external cloud service provider, the OSC is ultimately responsible and accountable for the protection of CUI that is processed, stored, or transmitted by the external cloud service provider... For a cloud service offering (CSO) to be considered in scope for a CMMC Level 2 assessment, it must be able to process, store, or transmit CUI." This directly supports including the cloud provider's assets in the scope.

2. Cybersecurity Maturity Model Certification (CMMC) Scoping Guide, Level 2, Version 2.0, December 2021.

Section 2.2, Asset Categories, Page 6: Defines CUI Assets as "assets that process, store, or transmit CUI." It clarifies that these assets are "in-scope for the CMMC assessment." This refutes option A, as the location or ownership is irrelevant if the asset handles CUI.