Your C3PAO has selected you as the Lead Assessor for the Assessment Team assessing an OSC's implementation of CMMC practices. Part of this assessment…

The CMMC assessment scope is focused on the information systems and assets owned, operated, or managed by the Organization Seeking Certification (OSC). Government assets are external to the OSC's environment and are not part of the OSC's certification boundary. While the CUI transmitted from the government asset is in scope once it enters the OSC's systems, the government asset itself is not assessed as part of the OSC's CMMC implementation. The other options represent asset categories that are explicitly defined as being in scope for a CMMC assessment.

B: Organizational assets that process, store, or transmit CUI or FCI are defined as "CUI Assets" and are the primary focus of the CMMC assessment scope.

C: Assets providing security functions for the CUI environment, such as firewalls or authentication servers, are defined as "Security Protection Assets" and are in scope.

D: Third-party assets, such as those from an External Service Provider (ESP) that store, process, or transmit CUI on behalf of the OSC, are in scope.

---

1. U.S. Department of Defense (DoD), CMMC Scoping Guide, Level 2, Version 2.0 (December 2021).

Section 2.2, "Categorization of Assets," defines CUI Assets (covering option B) and Security Protection Assets (covering option C) as in-scope.

Section 2.3, "External Service Providers (ESPs)," details how services from third parties that handle CUI are included in the assessment scope (covering option D). The guide does not include external government systems as part of the OSC's scope.

2. U.S. Department of Defense (DoD), CMMC Assessment Process (CAP) for CMMC Level 2, Version 2.0 (December 2021).

Section 2.3.1, "Confirm the CMMC Assessment Scope," states the assessment team must validate the OSC's defined scope, which is based on the flow of CUI and FCI through the OSC's assets and any ESPs, not external government entities.