During scoping discussions with a Lead Assessor, the OSC mentions that there are several connected systems within the organization’s network. How…

The CMMC assessment scope is determined by identifying all assets that handle sensitive government information and those that protect it. This includes two primary categories: CUI Assets, which process, store, or transmit Controlled Unclassified Information (CUI) or Federal Contract Information (FCI), and Security Protection Assets (SPAs). SPAs are systems that provide security functions (e.g., firewalls, authentication servers, SIEMs) and are in scope because their compromise or failure could directly impact the security of the CUI environment, even if they do not handle CUI themselves. Option D correctly encompasses both of these in-scope asset categories.

A. The Lead Assessor, not the Organization Seeking Certification (OSC), is responsible for validating and finalizing the assessment scope based on CMMC methodology.

B. This is too narrow. It only describes CUI Assets and incorrectly excludes Security Protection Assets (SPAs), which are in scope but do not handle CUI/FCI.

C. This is incorrect because it excludes externally connected systems (e.g., cloud services) and Security Protection Assets (SPAs) that are critical to the assessment scope.

---

1. U.S. Department of Defense, "CMMC Scoping Guide, Level 2," Version 2.0, December 21, 2021.

Page 4, Section 2.1, CMMC Assessment Scope: "The CMMC Assessment Scope is the set of all assets that will be assessed against the CMMC requirements. The CMMC Assessment Scope includes CUI Assets and Security Protection Assets."

Page 5, Section 2.2, Asset Categories: Defines CUI Assets as those that "process, store, or transmit CUI." It defines Security Protection Assets (SPAs) as assets that "provide security functions or services" and notes that "their compromise or failure could impact the confidentiality or integrity of CUI." This directly supports the two conditions outlined in answer D.

2. The Cyber AB, "CMMC Assessment Process (CAP) for CMMC Level 2," Version 2.0, December 2021.

Page 16, Section 3.2.1, Scoping Verification: "The Lead Assessor is responsible for verifying the OSC’s CMMC Assessment Scope... The Lead Assessor must ensure that all assets where CUI is processed, stored, or transmitted are included in the CMMC Assessment Scope along with all Security Protection Assets." This reinforces that the assessor verifies the scope and that it must include both CUI assets and SPAs.