Contractor scoping requirements for a CMMC Level 2 Assessment to document the asset in an inventory, in the SSP and on the network diagram apply to:

According to the CMMC Level 2 Scoping Guide, all assets within the CMMC Assessment Scope must be documented. This scope explicitly includes CUI Assets, Security Protection Assets (SPAs), Contractor Risk Managed Assets (CRMAs), and Specialized Assets. For each of these categories, the contractor is required to document the asset in the asset inventory, describe it in the System Security Plan (SSP), and depict it on the network diagram. The only category exempt from these documentation requirements is Out-of-Scope Assets, which are, by definition, outside the assessment boundary.

A. GUI Assets. "GUI Assets" is not a defined asset category within the CMMC scoping framework; it is a distractor term.

B. CUI and Security Protection Asset categories. This is incorrect because it is an incomplete list. It omits Contractor Risk Managed Assets (CRMAs) and Specialized Assets, which must also be documented.

D. Contractor Risk Managed Assets and Specialized Assets. This is incorrect because it is also an incomplete list. It omits the primary CUI Assets and Security Protection Assets from the documentation requirements.

---

1. U.S. Department of Defense (DoD). (2021

December). CMMC Scoping Guide Level 2

Version 2.0.

Page 11

Table 3

"CMMC Asset Categories and Associated Requirements." This table explicitly lists the documentation requirements for each asset category. For CUI Assets

Security Protection Assets

Contractor Risk Managed Assets

and Specialized Assets

the requirements to "Document the asset in the asset inventory

" "Document the asset in the SSP

" and "Document the asset on the network diagram" are all marked as required. For the "Out-of-Scope Assets" category

these requirements are marked "N/A." This directly supports that all asset categories except for Out-of-Scope Assets have these documentation requirements.

Page 7

Section 2.2

"Categorization of Assets." This section defines the five asset categories used for CMMC scoping

confirming that "GUI Assets" is not a valid category.