Level 3 Scoping Guidance - Revision history

David at 01:30, 2 March 2026

2026-03-02T01:30:33Z

← Older revision		Revision as of 01:30, 2 March 2026
Line 1:		Line 1:
	'''Source of Reference: The official [https://dodcio.defense.gov/CMMC/Resources-Documentation/ CMMC Level 3 Scoping Guidance Version 2.13, September 2024] from the Department of Defense Chief Information Officer (DoD CIO).'''		'''Source of Reference: The official [https://dodcio.defense.gov/CMMC/Resources-Documentation/ CMMC Level 3 Scoping Guidance Version 2.13, September 2024] from the Department of Defense Chief Information Officer (DoD CIO).'''

	For inquiries and reporting errors on this wiki, please [mailto:support@~~cmmctoolkit~~.org contact us]. Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmcwiki.org contact us]. Thank you.

	== NOTICES ==		== NOTICES ==

David at 02:43, 17 March 2025

2025-03-17T02:43:13Z

← Older revision		Revision as of 02:43, 17 March 2025
Line 1:		Line 1:
	'''Source of Reference: The official [https://dodcio.defense.gov/CMMC/Resources-Documentation/ CMMC Level 3 Scoping Guidance] from the Department of Defense Chief Information Officer (DoD CIO).'''		'''Source of Reference: The official [https://dodcio.defense.gov/CMMC/Resources-Documentation/ CMMC Level 3 Scoping Guidance Version 2.13, September 2024] from the Department of Defense Chief Information Officer (DoD CIO).'''

	For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.

David at 18:13, 24 February 2025

2025-02-24T18:13:08Z

← Older revision		Revision as of 18:13, 24 February 2025
Line 3:		Line 3:
	For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.

	= NOTICES =		== NOTICES ==
	The contents of this document do not have the force and effect of law and are not meant to bind the public in any way. This document is intended only to provide clarity to the public regarding existing CMMC requirements under the law or departmental policies. DISTRIBUTION STATEMENT A. Approved for public release. Distribution is unlimited.		The contents of this document do not have the force and effect of law and are not meant to bind the public in any way. This document is intended only to provide clarity to the public regarding existing CMMC requirements under the law or departmental policies. DISTRIBUTION STATEMENT A. Approved for public release. Distribution is unlimited.

	= Introduction =		== Introduction ==
	This document provides scoping guidance for Level 3 of the Cybersecurity Maturity Model Certification (CMMC) as set forth in section 170.19 of title 32, Code of Federal Regulations (CFR). Guidance for scoping a Level 1 self-assessment can be found in the ''CMMC Scoping Guide – Level 1'' document. Guidance for scoping a Level 2 self-assessment or certification assessment can be found in the ''CMMC Scoping Guide – Level 2'' document. More details on the CMMC Model can be found in the ''CMMC Model Overview'' document.		This document provides scoping guidance for Level 3 of the Cybersecurity Maturity Model Certification (CMMC) as set forth in section 170.19 of title 32, Code of Federal Regulations (CFR). Guidance for scoping a Level 1 self-assessment can be found in the ''CMMC Scoping Guide – Level 1'' document. Guidance for scoping a Level 2 self-assessment or certification assessment can be found in the ''CMMC Scoping Guide – Level 2'' document. More details on the CMMC Model can be found in the ''CMMC Model Overview'' document.

	== Purpose and Audience ==		=== Purpose and Audience ===
	This guide is intended for Organizations Seeking Certification (OSCs) that will be obtaining a Level 3 certification assessment and the professionals or companies that will support them in those efforts.		This guide is intended for Organizations Seeking Certification (OSCs) that will be obtaining a Level 3 certification assessment and the professionals or companies that will support them in those efforts.

	= Identifying the CMMC Assessment Scope =		== Identifying the CMMC Assessment Scope ==
	An ''assessment'', as defined in 32 CFR § 170.4, means the testing or evaluation of security controls to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for an information system or organization.		An ''assessment'', as defined in 32 CFR § 170.4, means the testing or evaluation of security controls to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for an information system or organization.

Line 27:		Line 27:
	CRMAs and Specialized Assets not assessed to the Level 3 scoping requirements by a C3PAO during the Level 2 certification assessment, will undergo limited checks for compliance with Level 2 security requirements during the DCMA DIBCAC Level 3 certification assessment and will be assessed against all CMMC Level 3 security requirements.		CRMAs and Specialized Assets not assessed to the Level 3 scoping requirements by a C3PAO during the Level 2 certification assessment, will undergo limited checks for compliance with Level 2 security requirements during the DCMA DIBCAC Level 3 certification assessment and will be assessed against all CMMC Level 3 security requirements.

	== CMMC Asset Categories ==		=== CMMC Asset Categories ===
	For a Level 3 assessment, assets are mapped into one of four categories defined in 32 CFR § 170.19(d)(1) Table 4. This table describes each asset category and its corresponding OSC requirements and CMMC assessment requirements. Additional information about each asset category is provided in the ensuing sections.		For a Level 3 assessment, assets are mapped into one of four categories defined in 32 CFR § 170.19(d)(1) Table 4. This table describes each asset category and its corresponding OSC requirements and CMMC assessment requirements. Additional information about each asset category is provided in the ensuing sections.

Line 89:		Line 89:
	\|}		\|}

	= Additional Guidance on Level 3 Scoping =		== Additional Guidance on Level 3 Scoping ==
	The OSC is required to document all assets that are part of the Level 3 certification assessment in an asset inventory and provide a network diagram of the CMMC Assessment Scope to facilitate scoping discussions during pre-assessment activities.		The OSC is required to document all assets that are part of the Level 3 certification assessment in an asset inventory and provide a network diagram of the CMMC Assessment Scope to facilitate scoping discussions during pre-assessment activities.

	== CUI Assets ==		=== CUI Assets ===
	CUI Assets can process, store, or transmit CUI as follows:		CUI Assets can process, store, or transmit CUI as follows:
	* '''Process'''– CUI is used by an asset (e.g., accessed, entered, edited, generated, manipulated, or printed).		* '''Process'''– CUI is used by an asset (e.g., accessed, entered, edited, generated, manipulated, or printed).
Line 105:		Line 105:
	* provide a network diagram of the CMMC Assessment Scope (to include these assets) to facilitate scoping discussions during the pre-assessment.		* provide a network diagram of the CMMC Assessment Scope (to include these assets) to facilitate scoping discussions during the pre-assessment.

	== Security Protection Assets/Security Protection Data ==		=== Security Protection Assets/Security Protection Data ===
	Security Protection Assets provide security functions or capabilities within the OSC’s CMMC Assessment Scope.		Security Protection Assets provide security functions or capabilities within the OSC’s CMMC Assessment Scope.

Line 150:		Line 150:
	* provide a network diagram of the CMMC Assessment Scope (to include these assets) to facilitate scoping discussions during the pre-assessment.		* provide a network diagram of the CMMC Assessment Scope (to include these assets) to facilitate scoping discussions during the pre-assessment.

	== Specialized Assets ==		=== Specialized Assets ===
	The following are considered Specialized Assets for a Level 3 certification assessment:		The following are considered Specialized Assets for a Level 3 certification assessment:
	* '''Government Furnished Equipment (GFE)''' is all equipment owned or leased by the government and includes OSC-acquired equipment that is based on government required specifications and/or configurations. Government Furnished Equipment does not include intellectual property or software [Reference: Federal Acquisition Regulation (FAR) 52.245-1].		* '''Government Furnished Equipment (GFE)''' is all equipment owned or leased by the government and includes OSC-acquired equipment that is based on government required specifications and/or configurations. Government Furnished Equipment does not include intellectual property or software [Reference: Federal Acquisition Regulation (FAR) 52.245-1].
Line 160:		Line 160:
	Specialized Assets are part of the Level 3 CMMC Assessment Scope per 32 CFR § 170.19(d)(1) Table 3. Note that Specialized Assets may be eligible for an Enduring Exception. The OSC should prepare for these assets to be assessed against all CMMC requirements unless they are physically or logically isolated into purpose-specific networks (with no connection to the Internet or other networks). Specialized Assets may have limitations on the application of certain security requirements. To accommodate such issues intermediary devices are permitted to provide the capability for the specialized asset to meet one or more CMMC requirements. An example of an intermediary device used in conjunction with a specialized asset is a boundary device or a proxy.		Specialized Assets are part of the Level 3 CMMC Assessment Scope per 32 CFR § 170.19(d)(1) Table 3. Note that Specialized Assets may be eligible for an Enduring Exception. The OSC should prepare for these assets to be assessed against all CMMC requirements unless they are physically or logically isolated into purpose-specific networks (with no connection to the Internet or other networks). Specialized Assets may have limitations on the application of certain security requirements. To accommodate such issues intermediary devices are permitted to provide the capability for the specialized asset to meet one or more CMMC requirements. An example of an intermediary device used in conjunction with a specialized asset is a boundary device or a proxy.

	== Out-of-Scope Assets ==		=== Out-of-Scope Assets ===
	Out-of-Scope Assets cannot process, store, or transmit CUI, and do not provide security protections for CUI Assets. Assets that are physically or logically separated from CUI Assets and do not provide security protections for CUI Assets are also Out-of-Scope Assets. Assets that fall into any in-scope asset category cannot be considered an Out-of-Scope Asset.		Out-of-Scope Assets cannot process, store, or transmit CUI, and do not provide security protections for CUI Assets. Assets that are physically or logically separated from CUI Assets and do not provide security protections for CUI Assets are also Out-of-Scope Assets. Assets that fall into any in-scope asset category cannot be considered an Out-of-Scope Asset.

	In accordance with 32 CFR § 170.19(d)(1), Out-of-Scope Assets are not part of a Level 3 certification assessment. There are no documentation requirements for Out-of-Scope Assets.		In accordance with 32 CFR § 170.19(d)(1), Out-of-Scope Assets are not part of a Level 3 certification assessment. There are no documentation requirements for Out-of-Scope Assets.

	== Defining the CMMC Assessment Scope ==		=== Defining the CMMC Assessment Scope ===
	After categorizing its assets, the OSC then specifies the CMMC Assessment Scope.		After categorizing its assets, the OSC then specifies the CMMC Assessment Scope.

Line 207:		Line 207:
	== Notes ==		== Notes ==
	<references />		<references />

	~~= Document Outline =~~

	* [[80bcaf55992e2fba3e61cce9c1ce754ba903547d.html#3\|Introduction]]
	* [[80bcaf55992e2fba3e61cce9c1ce754ba903547d.html#4\|Identifying the CMMC Assessment Scope]]
	** [[80bcaf55992e2fba3e61cce9c1ce754ba903547d.html#4\|CMMC Asset Categories]]
	* [[80bcaf55992e2fba3e61cce9c1ce754ba903547d.html#7\|Additional Guidance on Level 3 Scoping]]
	** [[80bcaf55992e2fba3e61cce9c1ce754ba903547d.html#7\|CUI Assets]]
	** [[80bcaf55992e2fba3e61cce9c1ce754ba903547d.html#7\|Security Protection Assets/Security Protection Data]]
	** [[80bcaf55992e2fba3e61cce9c1ce754ba903547d.html#8\|Specialized Assets]]
	** [[80bcaf55992e2fba3e61cce9c1ce754ba903547d.html#9\|Out-of-Scope Assets]]
	** [[80bcaf55992e2fba3e61cce9c1ce754ba903547d.html#9\|Defining the CMMC Assessment Scope]]
	** [[80bcaf55992e2fba3e61cce9c1ce754ba903547d.html#10\|External Service Provider Considerations]]


	~~-----~~

	~~Original source: https://dodcio.defense.gov/Portals/0/Documents/CMMC/ScopingGuideL3v2.pdf~~

Wikiadmin at 03:27, 24 February 2025

2025-02-24T03:27:54Z

← Older revision		Revision as of 03:27, 24 February 2025
Line 1:		Line 1:
			'''Source of Reference: The official [https://dodcio.defense.gov/CMMC/Resources-Documentation/ CMMC Level 3 Scoping Guidance] from the Department of Defense Chief Information Officer (DoD CIO).'''

			For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.

	= NOTICES =		= NOTICES =
	The contents of this document do not have the force and effect of law and are not meant to bind the public in any way. This document is intended only to provide clarity to the public regarding existing CMMC requirements under the law or departmental policies. DISTRIBUTION STATEMENT A. Approved for public release. Distribution is unlimited.		The contents of this document do not have the force and effect of law and are not meant to bind the public in any way. This document is intended only to provide clarity to the public regarding existing CMMC requirements under the law or departmental policies. DISTRIBUTION STATEMENT A. Approved for public release. Distribution is unlimited.

Wikiadmin: /* External Service Provider Considerations */

2025-02-23T21:51:35Z

External Service Provider Considerations

Show changes

Wikiadmin: /* Defining the CMMC Assessment Scope */

2025-02-23T21:45:16Z

Defining the CMMC Assessment Scope

← Older revision		Revision as of 21:45, 23 February 2025
Line 164:		Line 164:
	After categorizing its assets, the OSC then specifies the CMMC Assessment Scope.		After categorizing its assets, the OSC then specifies the CMMC Assessment Scope.

	The CMMC Assessment Scope includes all assets in the OSC’s environment that will be assessed in accordance with Table 1. OSCs will be required to provide documentation that specifies the CMMC Assessment Scope to the assessor. Details about required documentation for each asset category can be found in the [[Level_3_Scoping_Guidance#CMMC Asset Categories\|CMMC Asset Categories]] section above.		The CMMC Assessment Scope includes all assets in the OSC’s environment that will be assessed in accordance with [[Level_3_Scoping_Guidance#CMMC Asset Categories\|Table 1]]. OSCs will be required to provide documentation that specifies the CMMC Assessment Scope to the assessor. Details about required documentation for each asset category can be found in the [[Level_3_Scoping_Guidance#CMMC Asset Categories\|CMMC Asset Categories]] section above.

	The following asset categories are part of the Level 3 CMMC Assessment Scope: <br />		The following asset categories are part of the Level 3 CMMC Assessment Scope: <br />

Wikiadmin: /* Defining the CMMC Assessment Scope */

2025-02-23T21:43:10Z

Defining the CMMC Assessment Scope

← Older revision		Revision as of 21:43, 23 February 2025
Line 164:		Line 164:
	After categorizing its assets, the OSC then specifies the CMMC Assessment Scope.		After categorizing its assets, the OSC then specifies the CMMC Assessment Scope.

	The CMMC Assessment Scope includes all assets in the OSC’s environment that will be assessed in accordance with Table 1. OSCs will be required to provide documentation that specifies the CMMC Assessment Scope to the assessor. Details about required documentation for each asset category can be found in the [[Level_3_Scoping_Guidance:CMMC Asset Categories\|CMMC Asset Categories]] section above.		The CMMC Assessment Scope includes all assets in the OSC’s environment that will be assessed in accordance with Table 1. OSCs will be required to provide documentation that specifies the CMMC Assessment Scope to the assessor. Details about required documentation for each asset category can be found in the [[Level_3_Scoping_Guidance#CMMC Asset Categories\|CMMC Asset Categories]] section above.

	The following asset categories are part of the Level 3 CMMC Assessment Scope: <br />		The following asset categories are part of the Level 3 CMMC Assessment Scope: <br />

Wikiadmin: /* Defining the CMMC Assessment Scope */

2025-02-23T21:41:58Z

Defining the CMMC Assessment Scope

← Older revision		Revision as of 21:41, 23 February 2025
Line 164:		Line 164:
	After categorizing its assets, the OSC then specifies the CMMC Assessment Scope.		After categorizing its assets, the OSC then specifies the CMMC Assessment Scope.

	The CMMC Assessment Scope includes all assets in the OSC’s environment that will be assessed in accordance with Table 1. OSCs will be required to provide documentation that specifies the CMMC Assessment Scope to the assessor. Details about required documentation for each asset category can be found in the [[CMMC Asset Categories\|CMMC Asset Categories]] section above.		The CMMC Assessment Scope includes all assets in the OSC’s environment that will be assessed in accordance with Table 1. OSCs will be required to provide documentation that specifies the CMMC Assessment Scope to the assessor. Details about required documentation for each asset category can be found in the [[Level_3_Scoping_Guidance:CMMC Asset Categories\|CMMC Asset Categories]] section above.

	The following asset categories are part of the Level 3 CMMC Assessment Scope: <br />		The following asset categories are part of the Level 3 CMMC Assessment Scope: <br />

Wikiadmin: /* Defining the CMMC Assessment Scope */

2025-02-23T21:40:47Z

Defining the CMMC Assessment Scope

← Older revision		Revision as of 21:40, 23 February 2025
Line 164:		Line 164:
	After categorizing its assets, the OSC then specifies the CMMC Assessment Scope.		After categorizing its assets, the OSC then specifies the CMMC Assessment Scope.

	The CMMC Assessment Scope includes all assets in the OSC’s environment that will be assessed in accordance with Table 1. OSCs will be required to provide documentation that specifies the CMMC Assessment Scope to the assessor. Details about required documentation for each asset category can be found in the CMMC Asset Categories section above.		The CMMC Assessment Scope includes all assets in the OSC’s environment that will be assessed in accordance with Table 1. OSCs will be required to provide documentation that specifies the CMMC Assessment Scope to the assessor. Details about required documentation for each asset category can be found in the [[CMMC Asset Categories\|CMMC Asset Categories]] section above.

	The following asset categories are part of the Level 3 CMMC Assessment Scope: <br />		The following asset categories are part of the Level 3 CMMC Assessment Scope: <br />

Wikiadmin: /* Specialized Assets */

2025-02-23T21:39:14Z

Specialized Assets

Show changes