Overview

CMMC Level 2 Scoping

Defining the CMMC Assessment scope

Prior to conducting the Level 2 self-assessment, the Organization Seeking Assessment (OSA) must specify the CMMC Assessment Scope. This scope defines the assets within the OSA’s environment that will be assessed in accordance with the specified asset categories. A key difference for Level 2 is that documentation is required and must be maintained or provided to the assessor to facilitate scoping discussions. The required documentation for level 2 scoping includes:

1. An asset inventory listing all asset categories
2. A network diagram of the CMMC Assessment Scope
3. A System Security Plan (SSP) that documents the treatment of all in-scope assets

Asset Categorization for CMMC Level 2

The scoping process categorizes assets based on their relationship with Controlled Unclassified Information (CUI). For a level 2 assessment, assets are mapped into one of five categories, with 4 of them being part of the CMMC assessment scope.

Asset Category	Description	Assessment requirement
CUI Assets	Assets that: Process CUI: CUI is used by the asset, such as when it is accessed, entered, edited, generated, manipulated, or printed Store CUI: CUI is inactive or at rest on the asset, such as when it is located on electronic media, in system component memory, or in physical format (like paper documents) Transmit CUI: CUI is being transferred from one asset to another using physical or digital transport methods (data in transit)	Must be assessed against all CMMC level 2 requirements
Security Protection Assets (SPAs)	Assets that provide security functions or capabilities to the CMMC assessment scope. Examples include SIEM solutions, cloud-based security tools, consultants providing security services, etc. SPAs may handle Security Protection Data (SPD), such as logs or configuration data.	Must be assessed against CMMC level 2 security requirements that are relevant to the capabilities provided by the asset. The assessment implicitly covers the protection of the SPD they handle.
Contractor Risk Managed Assets (CRMAs)	Assets that are capable of, but not intended to, process, store, or transmit CUI due to established security policy and practices. CRMAs are not requires to be physically or logically separated from CUI assets.	Assessment involves a review of the SSP. If sufficiently documented, CRMAs are not assessed. Limited checks against relevant CMMC requirements to identify deficiencies can be conducted if documentation of these assets are deemed insufficient or if the OSA’s risk-based security policies, procedures, and practices documentation raise questions
Specialized Assets	Assets that can process, store, or transmit CUI but are unable to be fully secured. Examples include: Operational Technology (OT), Internet of Things (IoT)/Industrial Internet of Things (IIoT) devices, Government Furnished Equipment (GFE), Restricted Information Systems, and Test Equipment.	Assessment focuses on reviewing the SSP to verify that these assets are managed using the OSA’s risk-based security policies, procedures, and practices. No assessment against other CMMC security requirements is conducted.
Out-of-Scope Assets	Assets that cannot process, store, or transmit CUI, and do not provide security protections for CUI Assets. They must be physically or logically separated from CUI assets.	None. Out-of-Scope Assets are not part of the assessment, but the OSA must be prepared to justify the inability of the asset to handle CUI.

Considerations for CMMC Level 2 Scoping

To appropriately scope a Level 2 self-assessment, the following components of an asset’s environment should be considered. Below is a breakdown of these components as they relate to CUI assets and SPAs:

Asset Category	People	Technology	Facilities
CUI Asset	Individuals who interact with CUI which includes researchers, IT staff, contractors, vendors, external service providers, etc.	Information systems and components that interact with CUI which includes servers, client computers/endpoints, mobile devices, network appliances (firewalls, switches, APs, routers), VoIP devices, applications, virtual machines, database systems, etc.	Physical locations related to CUI handling which includes physical office locations, satellite/off-site offices, server rooms, datacenters, manufacturing plants, and secured rooms.
Security Protection Assets (SPAs)	Consultants who provide cybersecurity service which includes managed service provider personnel who implement system maintenance or enterprise network administrators.	Cloud-based security solutions such as hosted VPN services or SIEM solutions.	Co-located data centers, Security Operation Centers (SOCs), or OSA office buildings

Special Considerations for External Service Providers (ESPs)

If an External Service Provider (ESP) is used, it may be included in the OSA’s scope if it meets the criteria for a CUI Asset (stores/processes/transmits CUI data on behalf of the OSA) or a Security Protection Asset (Provides security functions or capabilities).

• Documentation regarding the ESP’s use, relationship to the OSA, and services must be included in the SSP
• The OSA must evaluate the ESP’s Customer Responsibility Matrix (CRM), which specifies which CMMC level 2 security requirements are the provider’s responsibility and which are the OSA’s responsibility
• If an ESP is a Cloud Service Provider (CSP) and processes, stores, or transmits CUI, they must meet FedRAMP requirements as stipulated in DFARS clause 252.204-7012. If they are a CSP but do not handle CUI, FedRAMP is not required. A Cloud Service Provider (CSP) means an external company that provides cloud services based on cloud computing. An ESP would be considered a CSP when it provides its own cloud services. An ESP that manages a third-party cloud service on behalf of a ESP would not be considered a CSP.
• Not all external service companies, such as typical Human Resources or accounting SaaS applications, are considered ESPs that contribute to the security of the CMMC environment, process Security Protection Data, or handle CUI

Recommendations for Limiting CMMC Scope

The CMMC compliance boundary should maximize the amount of out-of-scope assets to reduce the overall number of assets that fall under the assessment scope. For an OSA’s asset to be be considered out-of-scope, it is required to be effectively separated from CUI assets and cannot store, process, or transmit CUI.

Separation is a system architecture design concept that can provide physical/logical isolation of assets that process, transmit, or store CUI from assets not involved with CUI. Effective separation involves either logically or physically separating assets following guidance from NIST 800-171 Rev 2:

• Physical Separation: Occurs when assets have no wired or wireless connection. Data transfer can only happen manually (e.g., using a USB drive)
• Logical Separation: Occurs when data transfer between physically connected assets (wired or wireless) is prevented by non-physical means. Examples of network assets or software used to achieve logical separation include firewalls, routers, VPNs, and VLANs. Implementation includes configuring sub-networks with firewalls to control information flow.

CMMC Level 2 Security Requirements

This table itemizes the security requirements for each domain and at each level. Each requirement has a requirement identification number in the format – DD.L#-REQ – where:

• DD is the two-letter domain abbreviation that align with the families specified in NIST 800-171 Rev. 2;
• L# is the level number; and
• REQ is the FAR Clause 52.204-21 paragraph number, NIST SP 800-171 Rev 2, or NIST SP 800-172 security requirement number.

ID #	Control Name	Description
ACCESS CONTROL (AC)
AC.L2-3.1.1	Authorized Access Control [CUI Data]	Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
AC.L2-3.1.2	Transaction & Function Control [CUI Data]	Limit system access to the types of transactions and functions that authorized users are permitted to execute.
AC.L2-3.1.3	Control CUI Flow	Control the flow of CUI in accordance with approved authorizations.
AC.L2-3.1.4	Separation of Duties	Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
AC.L2-3.1.5	Least Privilege	Employ the principle of least privilege, including for specific security functions and privileged accounts
AC.L2-3.1.6	Non-Privileged Account Use	Use non-privileged accounts or roles when accessing nonsecurity functions.
AC.L2-3.1.7	Privileged Functions	Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
AC.L2-3.1.8	Unsuccessful Logon Attempts	Limit unsuccessful logon attempts.
AC.L2-3.1.9	Privacy & Security Notices	Provide privacy and security notices consistent with applicable CUI rules.
AC.L2-3.1.10	Session Lock	Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.
AC.L2-3.1.11	Session Termination	Terminate (automatically) a user session after a defined condition.
AC.L2-3.1.12	Control Remote Access	Monitor and control remote access sessions.
AC.L2-3.1.13	Remote Access Confidentiality	Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
AC.L2-3.1.14	Remote Access Routing	Route remote access via managed access control points.
AC.L2-3.1.15	Privileged Remote Access	Authorize remote execution of privileged commands and remote access to security-relevant information.
AC.L2-3.1.16	Wireless Access Authorization	Authorize wireless access prior to allowing such connections.
AC.L2-3.1.17	Wireless Access Protection	Protect wireless access using authentication and encryption.
AC.L2-3.1.18	Mobile Device Connection	Control connection of mobile devices.
AC.L2-3.1.19	Encrypt CUI on Mobile	Encrypt CUI on mobile devices and mobile computing platforms.
AC.L2-3.1.20	External Connections [CUI Data]	Verify and control/limit connections to and use of external systems.
AC.L2-3.1.21	Portable Storage Use	Limit use of portable storage devices on external systems
AC.L2-3.1.22	Control Public Information [CUI Data]	Control CUI posted or processed on publicly accessible systems.
AWARENESS AND TRAINING (AT)
AT.L2-3.2.1	Role-Based Risk Awareness	Inform managers, systems administrators, and users of organizational systems of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.
AT.L2-3.2.2	Role-Based Training	Train personnel to carry out their assigned information security-related duties and responsibilities.
AT.L2-3.2.3	Insider Threat Awareness	Provide security awareness training on recognizing and reporting potential indicators of insider threat.
AUDIT AND ACCOUNTABILITY (AU)
AU.L2-3.3.1	System Auditing	Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
AU.L2-3.3.2	User Accountability	Uniquely trace the actions of individual system users, so they can be held accountable for their actions.
AU.L2-3.3.3	Event Review	Review and update logged events.
AU.L2-3.3.4	Audit Failure Alerting	Alert in the event of an audit logging process failure.
AU.L2-3.3.5	Audit Correlation	Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.
AU.L2-3.3.6	Reduction & Reporting	Provide audit record reduction and report generation to support on-demand analysis and reporting.
AU.L2-3.3.7	Authoritative Time Source	Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.
AU.L2-3.3.8	Audit Protection	Protect audit information and audit logging tools from unauthorized access, modification, and deletion.
AU.L2-3.3.9	Audit Management	Limit management of audit logging functionality to a subset of privileged users.
CONFIGURATION MANAGEMENT (CM)
CM.L2-3.4.1	System Baselining	Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.
CM.L2-3.4.2	Security Configuration Enforcement	Establish and enforce security configuration settings for information technology products employed in organizational systems.
CM.L2-3.4.3	System Change Management	Track, review, approve or disapprove, and log changes to organizational systems.
CM.L2-3.4.4	Security Impact Analysis	Analyze the security impact of changes prior to implementation.
CM.L2-3.4.5	Access Restrictions for Change	Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
CM.L2-3.4.6	Least Functionality	Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.
CM.L2-3.4.7	Nonessential Functionality	Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
CM.L2-3.4.8	Application Execution Policy	Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.
CM.L2-3.4.9	User-Installed Software	Control and monitor user-installed software
IDENTIFICATION AND AUTHENTICATION (IA)
IA.L2-3.5.1	Identification [CUI Data]	Identify system users, processes acting on behalf of users, and devices.
IA.L2-3.5.2	Authentication [CUI Data]	Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.
IA.L2-3.5.3	Multifactor Authentication	Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
IA.L2-3.5.4	Replay-Resistant Authentication	Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
IA.L2-3.5.5	Identifier Reuse	Prevent reuse of identifiers for a defined period.
IA.L2-3.5.6	Identifier Handling	Disable identifiers after a defined period of inactivity.
IA.L2-3.5.7	Password Complexity	Enforce a minimum password complexity and change of characters when new passwords are created.
IA.L2-3.5.8	Password Reuse	Prohibit password reuse for a specified number of generations.
IA.L2-3.5.9	Temporary Passwords	Allow temporary password use for system logons with an immediate change to a permanent password.
IA.L2-3.5.10	Cryptographically-Protected Passwords	Store and transmit only cryptographically protected passwords.
IA.L2-3.5.11	Obscure Feedback	Obscure feedback of authentication information.
INCIDENT RESPONSE (IR)
IR.L2-3.6.1	Incident Handling	Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.
IR.L2-3.6.2	Incident Reporting	Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.
IR.L2-3.6.3	Incident Response Testing	Test the organizational incident response capability.
MAINTENANCE (MA)
MA.L2-3.7.1	Perform Maintenance	Perform maintenance on organizational systems.
MA.L2-3.7.2	System Maintenance Control	Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
MA.L2-3.7.3	Equipment Sanitization	Sanitize equipment removed for off-site maintenance of any CUI.
MA.L2-3.7.4	Media Inspection	Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.
MA.L2-3.7.5	Nonlocal Maintenance	Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.
MA.L2-3.7.6	Maintenance Personnel	Supervise the maintenance activities of maintenance personnel without required access authorization.
MEDIA PROTECTION (MP)
MP.L2-3.8.1	Media Protection	Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
MP.L2-3.8.2	Media Access	Limit access to CUI on system media to authorized users.
MP.L2-3.8.3	Media Disposal [CUI Data]	Sanitize or destroy system media containing CUI before disposal or release for reuse.
MP.L2-3.8.4	Media Markings	Mark media with necessary CUI markings and distribution limitations.
MP.L2-3.8.5	Media Accountability	Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
MP.L2-3.8.6	Portable Storage Encryption	Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
MP.L2-3.8.7	Removable Media	Control the use of removable media on system components.
MP.L2-3.8.8	Shared Media	Prohibit the use of portable storage devices when such devices have no identifiable owner.
MP.L2-3.8.9	Protect Backups	Protect the confidentiality of backup CUI at storage locations.
PERSONNEL SECURITY (PS)
PS.L2-3.9.1	Screen Individuals	Screen individuals prior to authorizing access to organizational systems containing CUI.
PS.L2-3.9.2	Personnel Actions	Protect organizational systems containing CUI during and after personnel actions such as terminations and transfers.
PHYSICAL PROTECTION (PE)
PE.L2-3.10.1	Limit Physical Access [CUI Data]	Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.
PE.L2-3.10.2	Monitor Facility	Protect and monitor the physical facility and support infrastructure for organizational systems.
PE.L2-3.10.3	Escort Visitors [CUI Data]	Escort visitors and monitor visitor activity.
PE.L2-3.10.4	Physical Access Logs [CUI Data]	Maintain audit logs of physical access.
PE.L2-3.10.5	Manage Physical Access [CUI Data]	Control and manage physical access devices.
PE.L2-3.10.6	Alternative Work Sites	Enforce safeguarding measures for CUI at alternate work sites.
RISK ASSESSMENT (RA)
RA.L2-3.11.1	Risk Assessments	Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
RA.L2-3.11.2	Vulnerability Scan	Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.
RA.L2-3.11.3	Vulnerability Remediation	Remediate vulnerabilities in accordance with risk assessments.
SECURITY ASSESSMENT (CA)
CA.L2-3.12.1	Security Control Assessment	Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.
CA.L2-3.12.2	Operational Plan of Action	Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.
CA.L2-3.12.3	Security Control Monitoring	Monitor security controls on an ongoing basis to determine the continued effectiveness of the controls.
CA.L2-3.12.4	System Security Plan	Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.
SYSTEM AND COMMUNICATIONS PROTECTION (SC)
SC.L2-3.13.1	Boundary Protection [CUI Data]	Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.
SC.L2-3.13.2	Security Engineering	Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.
SC.L2-3.13.3	Role Separation	Separate user functionality from system management functionality.
SC.L2-3.13.4	Shared Resource Control	Prevent unauthorized and unintended information transfer via shared system resources.
SC.L2-3.13.5	Public-Access System Separation [CUI Data]	Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
SC.L2-3.13.6	Network Communication by Exception	Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
SC.L2-3.13.7	Split Tunneling	Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).
SC.L2-3.13.8	Data in Transit	Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
SC.L2-3.13.9	Connections Termination	Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.
SC.L2-3.13.10	Key Management	Establish and manage cryptographic keys for cryptography employed in organizational systems.
SC.L2-3.13.11	CUI Encryption	Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
SC.L2-3.13.12	Collaborative Device Control	Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device.
SC.L2-3.13.13	Mobile Code	Control and monitor the use of mobile code.
SC.L2-3.13.14	Voice over Internet Protocol	Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.
SC.L2-3.13.15	Communications Authenticity	Protect the authenticity of communications sessions.
SC.L2-3.13.16	Data at Rest	Protect the confidentiality of CUI at rest.
SYSTEM AND INFORMATION INTEGRITY (SI)
SI.L2-3.14.1	Flaw Remediation [CUI Data]	Identify, report, and correct system flaws in a timely manner.
SI.L2-3.14.2	Malicious Code Protection [CUI Data]	Provide protection from malicious code at designated locations within organizational systems.
SI.L2-3.14.3	Security Alerts & Advisories	Monitor system security alerts and advisories and take action in response.
SI.L2-3.14.4	Update Malicious Code Protection [CUI Data]	Update malicious code protection mechanisms when new releases are available.
SI.L2-3.14.5	System & File Scanning [CUI Data]	Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.
SI.L2-3.14.6	Monitor Communications for Attacks	Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
SI.L2-3.14.7	Identify Unauthorized Use	Identify unauthorized use of organizational systems.