To transfer CUI between a government client and its internal systems, a defense contractor uses a Secure File-Sharing Application provided by the…

The Secure File-Sharing Application is provided by the Department of Defense (DoD), making it an external government system from the contractor's perspective. According to the CMMC Level 2 Scoping Guide, external systems, including government systems and external cloud services, are not part of the contractor's CMMC assessment scope. While the contractor is responsible for securing the connection to this external service (e.g., via their NGFW), the application itself is managed by the government and is therefore considered "Out of Scope" for the contractor's specific CMMC assessment.

B. CUI Asset: This is incorrect because the application is not an asset within the contractor's assessment scope; it is an external system provided and managed by the government.

C. Security Protection Asset (SPA): This is incorrect because the application is not a security control for the contractor's environment. The contractor's NGFW is the SPA in this scenario, not the external application.

D. Contractor Risk Managed Asset (CRMA): This is incorrect as CRMAs are assets within the contractor's network that do not handle CUI. This application is external and government-provided.

---

1. Cybersecurity Maturity Model Certification (CMMC) Scoping Guide, Level 2, Version 2.0, December 2021.

Page 7, Section 2.2, CMMC Assessment Scope: "External systems, such as an external cloud service or a government system, are not part of the CMMC assessment scope." This statement directly classifies the DoD-provided application as out of scope for the contractor's assessment.

Page 8, Table 2, Asset Categories: The table defines the different asset categories. The guidance on page 7 clarifies that even if an external system processes CUI, it is not included in the contractor's scope, thus falling under the "Out of Scope" determination for their assessment.