CMMC Level 2: Defining Scope Before Securing Systems

Many CMMC Level 2 projects fail at the outset because contractors have not identified which systems handle Controlled Unclassified Information. CUI is typically flagged through contract terms such as DFARS 7012, flow-down clauses from primes, and markings on documents. Organizations should trace how CUI arrives, where it is stored, who can access it, and where it leaves. Assets are sorted into groups such as CUI assets, security protection assets, risk-managed assets, specialized assets, and out-of-scope assets. Keeping CUI in a separate, tightly controlled enclave can reduce the number of systems requiring protection and simplify assessment, with the scope documented in the System Security Plan.