An OSC is looking to bid for a contract to manufacture turboprop engines for an unmanned aerial vehicle (UAV) fleet used by the Army for long-range…

According to the official CMMC Level 2 Scoping Guide, Operational Technology (OT) is classified as a "Specialized Asset." When these assets do not process, store, or transmit Controlled Unclassified Information (CUI), they are not required to be assessed against CMMC practices. However, the Organization Seeking Certification (OSC) must document these assets in the asset inventory, the System Security Plan (SSP), and the network diagram. The OSC must also implement a risk management plan for these assets. The C3PAO's role is to review this documentation to verify compliance with scoping requirements, not to assess the OT systems against the CMMC controls directly.

A. The C3PAO's role is to actively review and validate the SSP to ensure it meets CMMC requirements, not to passively accept documentation as-is.

B. There is no CMMC guidance that mandates assessing OT solely against practice CA.L2-3.12.3; this is an incorrect and arbitrary application of a single control.

C. Assessing OT against all CMMC practices is only required if it is categorized as a CUI Asset, which is not the default or required treatment for OT that doesn't handle CUI.

1. Department of Defense, CMMC Scoping Guide Level 2, Version 2.0, December 3, 2021.

Page 6, Section 2.3, "Asset Categories": Defines "Specialized Assets" to include Operational Technology (OT).

Page 7, Table 2, "CMMC Assessment Scope": Specifies the treatment for Specialized Assets. For those that do not process, store, or transmit CUI, it states, "...it is not required to be assessed. The asset must be documented in the asset inventory, the SSP, and the network diagram, and have a risk management plan in place that is reviewed and approved by the OSC." This directly supports the C3PAO's role as reviewing the SSP documentation rather than assessing the asset.