Level 1 Scoping Guidance - Revision history

David at 01:29, 2 March 2026

2026-03-02T01:29:41Z

← Older revision		Revision as of 01:29, 2 March 2026
Line 1:		Line 1:
	'''Source of Reference: The official [https://dodcio.defense.gov/CMMC/Resources-Documentation/ CMMC Level 1 Scoping Guidance Version 2.13, September 2024] from the Department of Defense Chief Information Officer (DoD CIO).'''		'''Source of Reference: The official [https://dodcio.defense.gov/CMMC/Resources-Documentation/ CMMC Level 1 Scoping Guidance Version 2.13, September 2024] from the Department of Defense Chief Information Officer (DoD CIO).'''

	For inquiries and reporting errors on this wiki, please [mailto:support@~~cmmctoolkit~~.org contact us]. Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmcwiki.org contact us]. Thank you.

	== NOTICES ==		== NOTICES ==

David at 02:40, 17 March 2025

2025-03-17T02:40:48Z

← Older revision		Revision as of 02:40, 17 March 2025
Line 1:		Line 1:
	'''Source of Reference: The official [https://dodcio.defense.gov/CMMC/Resources-Documentation/ CMMC Level 1 Scoping Guidance] from the Department of Defense Chief Information Officer (DoD CIO).'''		'''Source of Reference: The official [https://dodcio.defense.gov/CMMC/Resources-Documentation/ CMMC Level 1 Scoping Guidance Version 2.13, September 2024] from the Department of Defense Chief Information Officer (DoD CIO).'''

	For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.

David at 18:11, 24 February 2025

2025-02-24T18:11:16Z

← Older revision		Revision as of 18:11, 24 February 2025
Line 3:		Line 3:
	For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.

	= NOTICES =		== NOTICES ==

	The contents of this document do not have the force and effect of law and are not meant to bind the public in any way. This document is intended only to provide clarity to the public regarding existing requirements under the law or departmental policies.		The contents of this document do not have the force and effect of law and are not meant to bind the public in any way. This document is intended only to provide clarity to the public regarding existing requirements under the law or departmental policies.
Line 9:		Line 9:
	DISTRIBUTION STATEMENT A. Approved for public release. Distribution is unlimited.		DISTRIBUTION STATEMENT A. Approved for public release. Distribution is unlimited.

	= Introduction =		== Introduction ==
	This document provides scoping guidance for Level 1 of the Cybersecurity Maturity Model Certification (CMMC) as set forth in section 170.19 of title 32, Code of Federal Regulations (CFR). Guidance for scoping a Level 2 self-assessment or certification assessment can be found in the ''CMMC Scoping Guide – Level 2 '' document. Guidance for scoping a Level 3 certification assessment can be found in the ''CMMC Scoping Guide – Level 3'' document. More details on the CMMC Model can be found in the ''CMMC Model Overview'' document.		This document provides scoping guidance for Level 1 of the Cybersecurity Maturity Model Certification (CMMC) as set forth in section 170.19 of title 32, Code of Federal Regulations (CFR). Guidance for scoping a Level 2 self-assessment or certification assessment can be found in the ''CMMC Scoping Guide – Level 2 '' document. Guidance for scoping a Level 3 certification assessment can be found in the ''CMMC Scoping Guide – Level 3'' document. More details on the CMMC Model can be found in the ''CMMC Model Overview'' document.

	== Purpose and Audience ==		=== Purpose and Audience ===
	This guide is intended for Organizations Seeking Assessment (OSAs) that will be conducting a Level 1 self-assessment and the professionals or companies that will support them in those efforts.		This guide is intended for Organizations Seeking Assessment (OSAs) that will be conducting a Level 1 self-assessment and the professionals or companies that will support them in those efforts.

	= Identifying the CMMC Assessment Scope =		== Identifying the CMMC Assessment Scope ==
	== Level 1 Assessment Scope ==		=== Level 1 Assessment Scope ===
	Prior to a Level 1 self-assessment the OSA must specify the CMMC Assessment Scope. The CMMC Assessment Scope defines which assets within the OSA’s environment will be assessed and the details of the self-assessment. There are no documentation requirements for Level 1 self-assessments including In-Scope, Out-of-Scope, and Specialized Assets.		Prior to a Level 1 self-assessment the OSA must specify the CMMC Assessment Scope. The CMMC Assessment Scope defines which assets within the OSA’s environment will be assessed and the details of the self-assessment. There are no documentation requirements for Level 1 self-assessments including In-Scope, Out-of-Scope, and Specialized Assets.

	=== In-Scope Assets ===		==== In-Scope Assets ====
	Assets in scope for a Level 1 self-assessment, as defined in 32 CFR § 170.19(b), are all assets that process, store, or transmit Federal Contract Information (FCI).		Assets in scope for a Level 1 self-assessment, as defined in 32 CFR § 170.19(b), are all assets that process, store, or transmit Federal Contract Information (FCI).
	* '''Process''' – FCI is used by an asset (e.g., accessed, entered, edited, generated, manipulated, or printed).		* '''Process''' – FCI is used by an asset (e.g., accessed, entered, edited, generated, manipulated, or printed).
Line 27:		Line 27:
	These assets are part of the CMMC Assessment Scope and are assessed against all Level 1 requirements.		These assets are part of the CMMC Assessment Scope and are assessed against all Level 1 requirements.

	=== Out-of-Scope Assets ===		==== Out-of-Scope Assets ====
	Assets out of scope for a Level 1 self-assessment, as defined in 32 CFR § 170.19(b)(2), are those that do not process, store, or transmit FCI. These assets are outside of the CMMC Assessment Scope and are not part of the assessment.		Assets out of scope for a Level 1 self-assessment, as defined in 32 CFR § 170.19(b)(2), are those that do not process, store, or transmit FCI. These assets are outside of the CMMC Assessment Scope and are not part of the assessment.

	== ''Specialized Assets'' ==		=== ''Specialized Assets'' ===
	Specialized Assets, as defined in 32 CFR § 170.19(b)(2)(ii), are those assets that can process, store, or transmit FCI but are unable to be fully secured, including: Internet of Things (IoT) devices, Industrial Internet of Things (IIoT) devices, Operational Technology (OT), Government Furnished Equipment (GFE), Restricted Information Systems, and Test Equipment. Specialized Assets are not part of the Level 1 self-assessment scope and are not assessed against CMMC requirements. The following assets, defined in 32 CFR § 170.4, are considered specialized assets for a Level 1 self-assessment.		Specialized Assets, as defined in 32 CFR § 170.19(b)(2)(ii), are those assets that can process, store, or transmit FCI but are unable to be fully secured, including: Internet of Things (IoT) devices, Industrial Internet of Things (IIoT) devices, Operational Technology (OT), Government Furnished Equipment (GFE), Restricted Information Systems, and Test Equipment. Specialized Assets are not part of the Level 1 self-assessment scope and are not assessed against CMMC requirements. The following assets, defined in 32 CFR § 170.4, are considered specialized assets for a Level 1 self-assessment.
	* '''Government Furnished Equipment''' (GFE) has the same meaning as “government-furnished property” as defined in 48 CFR § 45.101. Government-furnished property means property in the possession of, or directly acquired by, the Government and subsequently furnished to the contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification. Government-furnished property also includes contractor-acquired property if the contractor-acquired property is a deliverable under a cost contract when accepted by the Government for continued use under the contract.		* '''Government Furnished Equipment''' (GFE) has the same meaning as “government-furnished property” as defined in 48 CFR § 45.101. Government-furnished property means property in the possession of, or directly acquired by, the Government and subsequently furnished to the contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification. Government-furnished property also includes contractor-acquired property if the contractor-acquired property is a deliverable under a cost contract when accepted by the Government for continued use under the contract.
Line 38:		Line 38:
	* '''Test Equipment''' means hardware and/or associated IT components used in the testing of products, system components, and contract deliverables.		* '''Test Equipment''' means hardware and/or associated IT components used in the testing of products, system components, and contract deliverables.

	= Additional Guidance on Level 1 Scoping =		== Additional Guidance on Level 1 Scoping ==
	In accordance with 32 CFR § 170.19(b)(3), to appropriately scope a Level 1 self-assessment, the OSA should consider the people, technology, facilities, and external service providers within its environment that process, store, or transmit FCI.		In accordance with 32 CFR § 170.19(b)(3), to appropriately scope a Level 1 self-assessment, the OSA should consider the people, technology, facilities, and external service providers within its environment that process, store, or transmit FCI.
	* '''People''' – May include, but are not limited to, employees, contractors, vendors, and external service provider personnel.		* '''People''' – May include, but are not limited to, employees, contractors, vendors, and external service provider personnel.
Line 56:		Line 56:
	Self-assessments and certification assessments may be valid for a defined CMMC Assessment Scope as outlined in 32 CFR § 170.19 CMMC Scoping. A new assessment is required if there are significant architectural or boundary changes to the previous CMMC Assessment Scope. Examples include, but are not limited to, expansions of networks or mergers and acquisitions. Operational changes within a CMMC Assessment Scope, such as adding or subtracting resources within the existing assessment boundary that follow the existing SSP<ref>It is recommended that an OSA develop a SSP as a best practice at Level 1. However, it is not required in order to conduct a Level 1 self-assessment.</ref> do not require a new assessment, but rather are covered by the annual affirmations to the continuing compliance with requirements.		Self-assessments and certification assessments may be valid for a defined CMMC Assessment Scope as outlined in 32 CFR § 170.19 CMMC Scoping. A new assessment is required if there are significant architectural or boundary changes to the previous CMMC Assessment Scope. Examples include, but are not limited to, expansions of networks or mergers and acquisitions. Operational changes within a CMMC Assessment Scope, such as adding or subtracting resources within the existing assessment boundary that follow the existing SSP<ref>It is recommended that an OSA develop a SSP as a best practice at Level 1. However, it is not required in order to conduct a Level 1 self-assessment.</ref> do not require a new assessment, but rather are covered by the annual affirmations to the continuing compliance with requirements.

	= Notes =		== Notes ==
	<references />		<references />

	~~= Document Outline =~~

	* [[017fc2ea748b1f3e96df9700ce159821fc970307.html#3\|Introduction]]
	* [[017fc2ea748b1f3e96df9700ce159821fc970307.html#4\|Identifying the CMMC Assessment Scope]]
	** [[017fc2ea748b1f3e96df9700ce159821fc970307.html#4\|Level 1 Assessment Scope]]
	*** [[017fc2ea748b1f3e96df9700ce159821fc970307.html#4\|In-Scope Assets]]
	*** [[017fc2ea748b1f3e96df9700ce159821fc970307.html#4\|Out-of-Scope Assets]]
	**** [[017fc2ea748b1f3e96df9700ce159821fc970307.html#4\|Specialized Assets]]
	* [[017fc2ea748b1f3e96df9700ce159821fc970307.html#6\|Additional Guidance on Level 1 Scoping]]


	~~-----~~

	~~Original source: https://dodcio.defense.gov/Portals/0/Documents/CMMC/ScopingGuideL1v2.pdf~~

David: /* Notes */

2025-02-24T17:56:49Z

Notes

Show changes

David: /* Specialized Assets */

2025-02-24T17:48:07Z

Specialized Assets

← Older revision		Revision as of 17:48, 24 February 2025
Line 34:		Line 34:
	* '''Government Furnished Equipment''' (GFE) has the same meaning as “government-furnished property” as defined in 48 CFR § 45.101. Government-furnished property means property in the possession of, or directly acquired by, the Government and subsequently furnished to the contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification. Government-furnished property also includes contractor-acquired property if the contractor-acquired property is a deliverable under a cost contract when accepted by the Government for continued use under the contract.		* '''Government Furnished Equipment''' (GFE) has the same meaning as “government-furnished property” as defined in 48 CFR § 45.101. Government-furnished property means property in the possession of, or directly acquired by, the Government and subsequently furnished to the contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification. Government-furnished property also includes contractor-acquired property if the contractor-acquired property is a deliverable under a cost contract when accepted by the Government for continued use under the contract.
	* '''Internet of Things (IoT) or Industrial Internet of Things (IIoT)''' is defined is NIST SP800-172A. These are interconnected devices having physical or virtual representation in the digital world, sensing/actuation capability, and programmability features. They are uniquely identifiable and may include smart electric grids, lighting, heating, air conditioning, and fire and smoke detectors [Reference: iot.ieee.org/definition; National Institute of Standards and Technology (NIST) 800-183].		* '''Internet of Things (IoT) or Industrial Internet of Things (IIoT)''' is defined is NIST SP800-172A. These are interconnected devices having physical or virtual representation in the digital world, sensing/actuation capability, and programmability features. They are uniquely identifiable and may include smart electric grids, lighting, heating, air conditioning, and fire and smoke detectors [Reference: iot.ieee.org/definition; National Institute of Standards and Technology (NIST) 800-183].
	* '''Operational Technology (OT)'''~~[[017fc2ea748b1f3e96df9700ce159821fc970307~~.~~html#5\|1 ]]~~means programmable systems or devices that interact with the physical environment (or manage devices that interact with the physical environment). These systems or devices detect or cause a direct change through the monitoring or control of devices, processes, and events. Examples include industrial control systems, building management systems, fire control systems, and physical access control mechanisms. [Source: NIST SP 800-160v2 Rev 1] NOTE: Operational Technology (OT) specifically includes Supervisory Control and Data Acquisition (SCADA); this is a rapidly evolving field. [Source: NIST SP 800-82r3]		* '''Operational Technology (OT)'''<ref>Operational Technology includes hardware and software that use direct monitoring and control of industrial equipment to detect or cause a change.</ref> means programmable systems or devices that interact with the physical environment (or manage devices that interact with the physical environment). These systems or devices detect or cause a direct change through the monitoring or control of devices, processes, and events. Examples include industrial control systems, building management systems, fire control systems, and physical access control mechanisms. [Source: NIST SP 800-160v2 Rev 1] NOTE: Operational Technology (OT) specifically includes Supervisory Control and Data Acquisition (SCADA); this is a rapidly evolving field. [Source: NIST SP 800-82r3]
	* '''Restricted Information Systems''' means systems [and associated Information Technology (IT) components comprising the system] that are configured based entirely on government security requirements (i.e., connected to something that was required to support a functional requirement) and are used to support a contract (e.g., fielded systems, obsolete systems, and product deliverable replicas).		* '''Restricted Information Systems''' means systems [and associated Information Technology (IT) components comprising the system] that are configured based entirely on government security requirements (i.e., connected to something that was required to support a functional requirement) and are used to support a contract (e.g., fielded systems, obsolete systems, and product deliverable replicas).
	* '''Test Equipment''' means hardware and/or associated IT components used in the testing of products, system components, and contract deliverables.		* '''Test Equipment''' means hardware and/or associated IT components used in the testing of products, system components, and contract deliverables.

David: /* Notes */

2025-02-24T17:47:20Z

Notes

← Older revision		Revision as of 17:47, 24 February 2025
Line 48:		Line 48:
	1		1

	~~Operational Technology includes hardware and software that use direct monitoring and control of industrial~~

	~~equipment to detect or cause a change.~~

David: /* Specialized Assets */

2025-02-24T17:46:23Z

Specialized Assets

@@ Line 38: / Line 38: @@
 * '''Test Equipment''' means hardware and/or associated IT components used in the testing of products, system components, and contract deliverables.
@@ Line 203: / Line 205: @@
 ''This page intentionally left blank. ''
 = Document Outline =

David at 17:45, 24 February 2025

2025-02-24T17:45:14Z

← Older revision		Revision as of 17:45, 24 February 2025
Line 1:		Line 1:
	'''Source of Reference: The official [https://dodcio.defense.gov/CMMC/Documentation/ CMMC Level 1 Scoping Guidance] from the Department of Defense Chief Information Officer (DoD CIO).'''		'''Source of Reference: The official [https://dodcio.defense.gov/CMMC/Resources-Documentation/ CMMC Level 1 Scoping Guidance] from the Department of Defense Chief Information Officer (DoD CIO).'''

	For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.

Wikiadmin at 17:17, 24 February 2025

2025-02-24T17:17:33Z

Show changes

Wikiadmin at 15:54, 24 February 2025

2025-02-24T15:54:32Z

Show changes