Most defense contractors don’t fail CMMC because of a missing policy or a weak password rule. They fail because they never correctly defined what they were protecting in the first place.
Scoping is the step that happens before documentation, before remediation, before anyone ever talks to a C3PAO. It is also the step most companies rush through, because it feels like a formality on the way to the “real” work. It isn’t. Scoping is the foundation on which everything else sits, and a mistake here doesn’t just slow you down. It can invalidate months of work that was built on the wrong boundary.
What Scoping Actually Means
Scoping is the process of identifying every system, application, network segment, device, and user that stores, processes, or transmits Controlled Unclassified Information, as well as the supporting assets that protect or directly affect that environment. The Department of War publishes guidance on how to do this for each CMMC level, but the guidance only tells you the rules. Applying those rules correctly requires understanding how CUI actually moves through your business, day to day, not how you assume it moves.
That distinction is where most of the trouble starts.
It also helps to remember that scoping isn’t a single category. The CMMC Level 2 Scoping Guide, published by the DoW CIO and aligned with 32 CFR § 170.19, classifies systems into CUI Assets, Security Protection Assets, Contractor Risk-Managed Assets, Specialized Assets, and Out-of-Scope Assets. Most of the scoping mistakes below stem from treating the assessment scope as a single bucket, when in practice each category carries different expectations for how it should be assessed.
Mistake 1: Over-Scoping
Some organizations respond to the ambiguity of scoping by going wide. If there’s any doubt about whether a system touches CUI, it goes in the boundary. This feels safe, but it isn’t free.
Every system inside your CUI environment needs the full set of applicable controls implemented, documented, and demonstrated to an assessor. Pulling in systems that don’t actually need to be there means more endpoints to secure, more policies to write, more evidence to maintain, and a larger, more expensive environment to defend during assessment. Over-scoping doesn’t make you more compliant. It makes compliance more expensive and more complicated to sustain.
Mistake 2: Under-Scoping
This is the more dangerous version. Under-scoping occurs when systems that handle CUI are left out of the boundary, usually because no one traced the data flow carefully enough to notice they were involved.
A few examples that come up constantly during gap analyses and assessments:
- A laptop an engineer uses to review drawings while traveling, which was never enrolled in the managed environment.
- A backup system that captures CUI alongside other data, without anyone accounting for it in the boundary.
- A piece of shop floor equipment that receives technical specifications directly, separate from the office network.
- Personal devices that were never supposed to touch CUI but occasionally do, through email, file sync, or a quick photo of a drawing.
- Mixed environments where CUI and non-CUI data live side by side without real segmentation between them.
Under-scoping is what turns an assessment into a failure rather than a delay. If a system handling CUI sits outside your defined boundary, the controls protecting your actual CUI environment have a gap, and the assessment can be invalidated entirely once that’s discovered.
Not sure where your organization stands with CMMC, ITAR, or federal cybersecurity requirements? The fastest way to get clarity is to talk with an expert. Book a call with our team to review your current environment, identify compliance risks, and determine the steps required to move forward. A short conversation can help you avoid costly mistakes and focus on what matters for contract eligibility and security.
SCHEDULE YOUR FREE CONSULTATION!
Mistake 3: Overlooking Security Protection Assets
One of the most commonly overlooked categories is Security Protection Assets. Systems such as identity providers, SIEM platforms, vulnerability scanners, endpoint management tools, and backup security infrastructure may never store CUI themselves, but if they protect the CUI environment, they’re often included in the assessment scope. Teams frequently scope based on where CUI lives and stops there, missing the infrastructure that secures that environment from the outside. A domain controller that authenticates users into the CUI enclave, or a SIEM that ingests logs from it, doesn’t need to touch CUI directly to belong in the boundary.
Contractor Risk Managed Assets are another area of confusion because they can interact with the CUI environment without being intended to process, store, or transmit CUI, yet they still have defined treatment under the Level 2 Scoping Guide. Leaving them out of the scoping conversation entirely, simply because they aren’t supposed to touch CUI, is a common mistake in itself.
Mistake 4: Scoping Once and Never Revisiting It
Scoping isn’t a one-time exercise you complete and file away. Acquisitions, new vendors, new tools, a shift to remote work, and a new product line introducing a new data flow. Any of these can quietly expand or shift your CUI boundary without anyone updating the System Security Plan to reflect it.
This is the same operational reality covered in How to Handle System Changes Without Losing CMMC Compliance: a System Security Plan that was accurate on the day it was written can become inaccurate within months if scope isn’t reviewed as the business changes.
Why This Mistake Is So Expensive to Catch Late
A scoping error discovered during remediation doesn’t just cost time to fix. It can reset documentation work that was already considered finished, because policies, evidence, and System Security Plan content were all built around the wrong boundary. A scoping error discovered during the assessment itself is worse. An assessor who discovers systems handling CUI that were improperly excluded from the assessment scope may determine the scope is inaccurate, requiring the assessment boundary to be redefined before certification can proceed, consistent with the assessment scope requirements in 32 CFR Part 170. That kind of finding can send a company back to square one with a record of an incomplete or failed attempt.
This is also where the connection to The Difference Between a Readiness Assessment and a Certification Assessment matters. A readiness assessment exists specifically to catch a scoping problem like this before a C3PAO ever sees it. Skipping that step to save time usually causes the more expensive version of this mistake to occur during certification instead.
How to Get Scoping Right
Start with the data, not the network diagram. Map where CUI enters your organization, not just where your systems live. CUI typically arrives via contract, portal, email, or file transfer from a prime or the government. Trace it forward from that point of entry through every system, person, and process it touches. The network diagram should validate your data flow, not define it.
Account for every path CUI can travel, not just the obvious ones. Email platforms, cloud storage, backup systems, remote access tools, and vendor connections all need to be evaluated, because CUI doesn’t always stay where IT assumes it does.
Draw a defensible boundary, and enforce it with segmentation. A well-defined CUI enclave, with controlled users, systems, and data flows, is consistently the most effective way to manage both cost and risk. It keeps the certified environment small enough to defend confidently while keeping the rest of the business entirely out of scope, as long as the segmentation actually holds up under scrutiny.
Document the reasoning, not just the result. An assessor isn’t only checking whether your boundary is correct. They’re checking whether you can explain how you arrived at it. A scoping decision without a documented rationale is a liability, even when the boundary itself is right.
Your System Security Plan doesn’t just document your controls. It documents the systems, users, and boundaries to which those controls apply.
If the scope is wrong, the SSP is wrong. No amount of well-implemented controls can compensate for an inaccurate assessment boundary.
Revisit scope on a schedule, not just when something breaks. Treat scope review as a recurring task tied to business changes, not a one-time deliverable from the early planning phase.
The Bottom Line
CMMC compliance is often discussed in terms of the 110 controls in NIST SP 800-171, the System Security Plan, or the C3PAO assessment itself. Scoping rarely gets the same attention, but it determines whether all of that other work is even pointed at the right target. Getting it right the first time is far less expensive than discovering it was wrong after the documentation is already written, the controls are already implemented, and an assessor is already in the room.
If you’re not confident your CUI boundary is correctly defined, that’s the question worth answering before any other part of your compliance program moves forward.
If your organization supports defense contracts and is unsure how CMMC timelines, SPRS requirements, or assessment readiness apply to you, now is the time to get clarity.
About Brea Networks
Brea Networks is a cybersecurity and compliance-focused IT partner dedicated to supporting Defense Industrial Base (DIB) contractors. We help organizations understand and implement the security requirements outlined in FAR 52.204-21, DFARS 252.204-7012, and the CMMC framework. From Level 1 self-assessments to Level 2 readiness and certification preparation, our team works alongside contractors to strengthen system security, define scope, prepare documentation, and build sustainable compliance programs that protect FCI and CUI.
What Changes: The Affirmation Requirement. The annual affirmation requirement applies at Level 3 just as it does at Level 2. Under 32 CFR § 170.22, a senior company official must submit an annual affirmation in SPRS confirming continued compliance within the CMMC Assessment Scope. Given that Level 3 status also satisfies Level 1 and Level 2 status requirements for the same scope, the annual affirmation at Level 3 covers the full body of requirements across all three levels.