An aerospace company has requested a CMMC assessment for an enclave only. Your team has verified that the company has a valid CAGE code and is…

The assessor can and should proceed with the assessment scoped to the enclave. The CAGE code and SAM.gov registration identify the legal entity, the Organization Seeking Certification (OSC), not the specific assessment boundary. The CMMC framework explicitly allows an OSC to define the assessment scope, such as an enclave, which contains the systems that process, store, or transmit Controlled Unclassified Information (CUI). The assessor's role is to validate that this defined scope is appropriate and that all CUI assets are included within the boundary. The absence of a separate CAGE code for the enclave is irrelevant as it is part of the larger, registered organization.

B. The assessor cannot proceed with the enclave assessment.

This is incorrect. CMMC assessment guidance is built on the principle of scoping, allowing organizations to define boundaries like enclaves to contain CUI and limit the assessment's scope.

C. The assessor must assess the entire company network.

This is incorrect. Requiring a full enterprise assessment is contrary to CMMC scoping principles, which aim to focus the assessment only on the assets relevant to protecting CUI.

D. The assessor can proceed with the enclave assessment, but only for a lower CMMC level.

This is incorrect. The required CMMC level is determined by the type of information being protected (CUI requires Level 2), not by the scope of the assessment (enclave vs. enterprise).

1. U.S. Department of Defense, CMMC Scoping Guide Level 2, Version 2.0 (December 2021).

Section 2.2, "Scoping Steps," Page 6: This section outlines the process for determining the assessment scope. Step 1 is "Identify and document the CMMC Assessment Scope for the CMMC Level 2 assessment." This confirms that the OSC defines the scope, which can be an enclave, prior to the assessment. The guide focuses on locating CUI, not on CAGE codes for sub-networks.

2. U.S. Department of Defense, CMMC Assessment Process (CAP) for CMMC Level 2, Version 2.1 (Draft, December 2022).

Section 2.2, "Assessment Scope," Page 10: "The OSC is responsible for defining the scope of the CMMC Assessment... The CMMC Assessment Scope is the set of assets that will be assessed against the applicable CMMC practices and processes." This officially places the responsibility of defining the scope (e.g., an enclave) on the company being assessed.

3. U.S. Department of Defense, CMMC Model 2.0, "CMMC 2.0 Program Overview" Briefing (November 2021).

Slide 10, "Scoping": The briefing explicitly states, "CMMC 2.0 requires that a subset of assets at a given site be protected... Scoping guidance will enable a DIB company to define the assessment scope." This reinforces that the assessment does not have to cover the entire enterprise network.