Level 2 Scoping Guidance - Revision history

David at 01:30, 2 March 2026

2026-03-02T01:30:10Z

← Older revision		Revision as of 01:30, 2 March 2026
Line 1:		Line 1:
	'''Source of Reference: The official [https://dodcio.defense.gov/CMMC/Resources-Documentation/ CMMC Level 2 Scoping Guidance Version 2.13, September 2024] from the Department of Defense Chief Information Officer (DoD CIO).'''		'''Source of Reference: The official [https://dodcio.defense.gov/CMMC/Resources-Documentation/ CMMC Level 2 Scoping Guidance Version 2.13, September 2024] from the Department of Defense Chief Information Officer (DoD CIO).'''

	For inquiries and reporting errors on this wiki, please [mailto:support@~~cmmctoolkit~~.org contact us].Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmcwiki.org contact us].Thank you.

	== NOTICES ==		== NOTICES ==

David: /* Separation Techniques */

2026-02-23T18:31:00Z

Separation Techniques

← Older revision		Revision as of 18:31, 23 February 2026
Line 218:		Line 218:

	=== Separation Techniques ===		=== Separation Techniques ===
	Separation is a system architecture design concept that can provide physical/logical isolation of assets that process, transmit, or store CUI from assets not involved with CUI. Effective separation involves logically or physically separating assets and is required only for Out-of-Scope Assets.By separating assets, the CMMC Assessment Scope can be limited. Effective separation for CMMC follows the guidance in NIST SP 800-171 Rev 2, which states:		Separation is a system architecture design concept that can provide physical/logical isolation of assets that process, transmit, or store CUI from assets not involved with CUI. Effective separation involves logically or physically separating assets and is required only for Out-of-Scope Assets. By separating assets, the CMMC Assessment Scope can be limited. Effective separation for CMMC follows the guidance in NIST SP 800-171 Rev 2, which states:

	''If nonfederal organizations designate specific system components for the processing, storage, or transmission of CUI, those organizations may limit the scope of the security requirements by isolating the designated system components in a separate CUI security domain.Isolation can be achieved by applying architectural and design concepts (e.g., implementing subnetworks with firewalls or other boundary protection devices and using information flow control mechanisms).Security domains may employ physical separation, logical separation, or a combination of both.This approach can provide adequate security for the CUI and avoid increasing the organization’s security posture to a level beyond that which it requires for protecting its missions, operations, and assets.''		''If nonfederal organizations designate specific system components for the processing, storage, or transmission of CUI, those organizations may limit the scope of the security requirements by isolating the designated system components in a separate CUI security domain. Isolation can be achieved by applying architectural and design concepts (e.g., implementing subnetworks with firewalls or other boundary protection devices and using information flow control mechanisms).Security domains may employ physical separation, logical separation, or a combination of both. This approach can provide adequate security for the CUI and avoid increasing the organization’s security posture to a level beyond that which it requires for protecting its missions, operations, and assets.''

	'''Logical separation''' occurs when data transfer between physically connected assets (wired or wireless) is prevented by non-physical means such as software or network assets (e.g., firewall, routers, VPNs, VLANs).		'''Logical separation''' occurs when data transfer between physically connected assets (wired or wireless) is prevented by non-physical means such as software or network assets (e.g., firewall, routers, VPNs, VLANs).

David: /* Separation Techniques */

2026-02-23T18:30:32Z

Separation Techniques

← Older revision		Revision as of 18:30, 23 February 2026
Line 226:		Line 226:
	'''Physical separation''' occurs when assets have no connection (wired or wireless). Data can only be transferred manually (e.g., USB drive).		'''Physical separation''' occurs when assets have no connection (wired or wireless). Data can only be transferred manually (e.g., USB drive).

	Self-assessments and certification assessments may be valid for a defined CMMC Assessment Scope as outlined in 32 CFR § 170.19 CMMC Scoping.A new assessment is required if there are significant architectural or boundary changes to the previous CMMC Assessment Scope. Examples include, but are not limited to, expansions of networks or mergers and acquisitions. Operational changes within a CMMC Assessment Scope, such as adding or subtracting resources within the existing assessment boundary that follow the existing SSP, do not require a new assessment, but rather may be covered by annual affirmations to the continuing compliance with requirements.		Self-assessments and certification assessments may be valid for a defined CMMC Assessment Scope as outlined in 32 CFR § 170.19 CMMC Scoping. A new assessment is required if there are significant architectural or boundary changes to the previous CMMC Assessment Scope. Examples include, but are not limited to, expansions of networks or mergers and acquisitions. Operational changes within a CMMC Assessment Scope, such as adding or subtracting resources within the existing assessment boundary that follow the existing SSP, do not require a new assessment, but rather may be covered by annual affirmations to the continuing compliance with requirements.

	=== External Service Provider Considerations ===		=== External Service Provider Considerations ===

David: /* External Service Provider Considerations */

2025-05-27T18:20:40Z

External Service Provider Considerations

← Older revision		Revision as of 18:20, 27 May 2025
Line 245:		Line 245:
	* When ESPs are assessed as part of an OSAs assessment, the type of the assessment is dictated by the OSA's DoD solicitation and contract requirement.		* When ESPs are assessed as part of an OSAs assessment, the type of the assessment is dictated by the OSA's DoD solicitation and contract requirement.

	Cloud Service Provider (CSP) means an external company that provides cloud services based on cloud computing. Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction .An ESP would be considered a CSP when it provides its own cloud services based on a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing that can be rapidly provisioned and released with minimal management effort or service provider interaction.		Cloud Service Provider (CSP) means an external company that provides cloud services based on cloud computing. Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. An ESP would be considered a CSP when it provides its own cloud services based on a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing that can be rapidly provisioned and released with minimal management effort or service provider interaction.

	An ESP (not a CSP) that provides technical support services to its clients would be considered a Managed Service Provider. It does not host its own cloud platform offering. An ESP may utilize cloud offerings to deliver services to clients without being a CSP.		An ESP (not a CSP) that provides technical support services to its clients would be considered a Managed Service Provider. It does not host its own cloud platform offering. An ESP may utilize cloud offerings to deliver services to clients without being a CSP.

David: /* External Service Provider Considerations */

2025-05-27T18:14:29Z

External Service Provider Considerations

David at 02:41, 17 March 2025

2025-03-17T02:41:53Z

← Older revision		Revision as of 02:41, 17 March 2025
Line 1:		Line 1:
	'''Source of Reference: The official [https://dodcio.defense.gov/CMMC/Resources-Documentation/ CMMC Level 2 Scoping Guidance] from the Department of Defense Chief Information Officer (DoD CIO).'''		'''Source of Reference: The official [https://dodcio.defense.gov/CMMC/Resources-Documentation/ CMMC Level 2 Scoping Guidance Version 2.13, September 2024] from the Department of Defense Chief Information Officer (DoD CIO).'''

	For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us].Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us].Thank you.

David at 00:16, 25 February 2025

2025-02-25T00:16:54Z

Show changes

David at 00:07, 25 February 2025

2025-02-25T00:07:51Z

Show changes

David: Importing content from PDF File: https://dodcio.defense.gov/Portals/0/Documents/CMMC/ScopingGuideL2v2.pdf

2025-02-24T18:58:57Z

Importing content from PDF File: https://dodcio.defense.gov/Portals/0/Documents/CMMC/ScopingGuideL2v2.pdf

Show changes

Wikiadmin at 23:32, 30 November 2022

2022-11-30T23:32:53Z

← Older revision		Revision as of 23:32, 30 November 2022
Line 1:		Line 1:
	'''Source of Reference: The official [https://~~www~~.~~acq~~.~~osd.mil~~/~~cmmc~~/~~documentation.html~~ CMMC Level 2 Scoping Guidance] from the ~~Office of the Under Secretary~~ of Defense ~~for Acquisition & Sustainment~~.'''		'''Source of Reference: The official [https://dodcio.defense.gov/CMMC/Documentation/ CMMC Level 2 Scoping Guidance] from the Department of Defense Chief Information Officer (DoD CIO).'''

	For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.

← Older revision		Revision as of 18:14, 27 May 2025
Line 237:		Line 237:
	** and do NOT store, process, or transmit CUI, are not required to meet FedRAMP requirements in DFARS clause 252.204-7012.Services provided by an ESP are in the OSA’s assessment scope.		** and do NOT store, process, or transmit CUI, are not required to meet FedRAMP requirements in DFARS clause 252.204-7012.Services provided by an ESP are in the OSA’s assessment scope.
	* ESPs that are not a CSP,		* ESPs that are not a CSP,
	** and store, process, or transmit CUI, require assessment.The ESP services used to meet OSA requirements are within the scope of the OSA’s CMMC assessment.		** and store, process, or transmit CUI, require assessment. The ESP services used to meet OSA requirements are within the scope of the OSA’s CMMC assessment.
	** and do NOT store, process, or transmit CUI, do not require their own CMMC assessment.Services provided by an ESP are in the OSA’s assessment scope.		** and do NOT store, process, or transmit CUI, do not require their own CMMC assessment. Services provided by an ESP are in the OSA’s assessment scope.
	** may voluntarily request a C3PAO assessment, and a C3PAO may conduct such an assessment, if the ESP makes that business decision.		** may voluntarily request a C3PAO assessment, and a C3PAO may conduct such an assessment, if the ESP makes that business decision.
	* OSAs shall also be assessed at Level 2, as applicable, against their on-premise infrastructure connecting to the CSP.As part of the CMMC Assessment Scope, the security requirements from the CRM must be documented or referred to in the OSA’s SSP, which will also be assessed.		* OSAs shall also be assessed at Level 2, as applicable, against their on-premise infrastructure connecting to the CSP.As part of the CMMC Assessment Scope, the security requirements from the CRM must be documented or referred to in the OSA’s SSP, which will also be assessed.
Line 245:		Line 245:
	* When ESPs are assessed as part of an OSAs assessment, the type of the assessment is dictated by the OSA's DoD solicitation and contract requirement.		* When ESPs are assessed as part of an OSAs assessment, the type of the assessment is dictated by the OSA's DoD solicitation and contract requirement.

	Cloud Service Provider (CSP) means an external company that provides cloud services based on cloud computing.Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.An ESP would be considered a CSP when it provides its own cloud services based on a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing that can be rapidly provisioned and released with minimal management effort or service provider interaction.		Cloud Service Provider (CSP) means an external company that provides cloud services based on cloud computing. Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction .An ESP would be considered a CSP when it provides its own cloud services based on a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing that can be rapidly provisioned and released with minimal management effort or service provider interaction.

	An ESP (not a CSP) that provides technical support services to its clients would be considered a Managed Service Provider.It does not host its own cloud platform offering.An ESP may utilize cloud offerings to deliver services to clients without being a CSP.		An ESP (not a CSP) that provides technical support services to its clients would be considered a Managed Service Provider. It does not host its own cloud platform offering. An ESP may utilize cloud offerings to deliver services to clients without being a CSP.

	An ESP that manages a third-party cloud service on behalf of an OSA would not be considered a CSP.		An ESP that manages a third-party cloud service on behalf of an OSA would not be considered a CSP.

	Not all companies that provide services to an OSA should be considered an ESP. Cloud based services such as human resource and accounting SaaS applications typically do not contribute to the security of the OSA’s environment; process or store SPD; or process, store, or transmit CUI.The OSA must determine if the company providing the service should be considered an ESP based on the services provided and if CUI is processed, stored, or transmitted.		Not all companies that provide services to an OSA should be considered an ESP. Cloud based services such as human resource and accounting SaaS applications typically do not contribute to the security of the OSA’s environment; process or store SPD; or process, store, or transmit CUI. The OSA must determine if the company providing the service should be considered an ESP based on the services provided and if CUI is processed, stored, or transmitted.

	=== Use Cases ===		=== Use Cases ===