Your organization’s Cybersecurity Maturity Model Certification (CMMC) Scope matters because scope directly affects cost and complexity. Larger organizational environments take longer to prepare for CMMC. More systems and users at an organization can mean that additional controls, documentation, and validation are needed.
A well-defined CMMC scope can support a smoother assessment process. The goal of CMMC scope is not to create the smallest possible scope. Instead, it should create the right, defensible scope for the organization.
“My audience might be limited, but I will argue with anyone that cares to listen that scoping is the most important part of CMMC, maybe aside from the assessment.”
-- Cynomi Cybersecurity Expert
What is Included in Your CMMC Scope?
Your organization’s CMMC Scope includes systems, processes that transmit Controlled Unclassified Information (CUI), and people that touch CUI. CMMC scope is not limited to technology. If something touches CUI, it belongs in scope.
Systems that Store CUI
Systems that store data can be part of the CUI lifecycle. When CUI data is stored, it is at rest.
Systems That Process CUI
Any systems or locations where CUI data is saved, archived, or held are part of the CUI lifecycle.
Systems That Transmit CUI
When CUI data is in motion, it is connected to the systems that transmit, read, and edit CUI data.
People and Processes That Touch CUI
The people and processes that touch CUI are instrumental in defining your scope.
Storing, processing, and transmitting CUI data is governed by the principle that, if it touches CUI, it matters.
“What is CMMC Scope? Well, we talked a little bit about this. Scope includes systems, people, assets that store and process and transmit CUI.”
-- Cynomi Cybersecurity Expert
How to Start by Mapping Your CUI Data Flow
Organizations can get started with CMMC Scope by mapping their CUI data flow.
Where does CUI enter your organization?
Potential sources of CUI data may include:
-
Customers
-
Prime contractors
-
Government contracts
-
Email
-
Physical documentation
-
Secure portals
Where is CUI Stored
Potential locations for CUI data may include:
-
Servers
-
Cloud platforms
-
Endpoints
-
Shared storage
-
Physical media
-
Backup environments
Who has access to CUI?
When considering who has access to CUI, include intended users as well as anyone who may have permissions to access shared systems or storage. Review who can access files, servers, applications, and other systems containing CUI.
Where does CUI go next
When considering whether CUI information is shared with others, think about who should have access to sensitive information. CUI can be shared with:
-
Customers
-
Prime contractors
-
Subcontractors
-
Vendors
-
Other members of the supply chain
Common CMMC Scoping Blind Spots
Common CMMC Scoping blind spots exist for organizations that need to protect CUI data.
Email and SaaS Applications
Email systems that transmit CUI may affect scope. Third-party Software as a Service (SaaS) applications that interact with CUI should be evaluated.
Shared File Storage
Shared environments can expand CMMC scope when CUI and non-CUI information are stored together.
Remote Workers and Home Offices
When supporting remote workers and home offices, consider how employees may interact with CUI through workstations, access methods, networks, physical documents, and other business communication infrastructure.
Physical Media and USB Drives
Physical documents and removable media containing CUI data require appropriate handling, labeling, and storage.
Backup and Disaster Recovery Systems
Backup systems containing CUI may extend the CMMC environment. Cloud replication and redundant backup environments can further expand security boundaries.
“So, what are the blind spots that are common. We mentioned . . . before that some organizations unintentionally expand the CMMC Scope, probably due to lack of understanding of CUI flow in their organization or an assumption that everybody needs to be covered….”
-- Cynomi Cybersecurity Expert
Avoid Both Over-Scoping and Under-Scoping
Over-scoping creates unnecessary cost and complexity. Potential impacts of errors in scoping include:
- Scope directly affects cost and complexity.
- Larger environments can take longer to prepare for CMMC.
- More systems and users can mean additional controls, documentation, and validation.
- A well-defined scope can support a smoother assessment process.
- The goal is not necessarily to create the smallest possible scope, but the right, defensible scope for the organization.
Why Under-Scoping Creates Assessment Risk
Under-scoping creates assessment risk because assets, systems, users, or processes that interact with CUI should not be excluded from CMMC scoping simply to make the environment smaller.
How to Find the Right CMMC Scope for Your Business
The smallest possible scope is not always the correct scope. Organizations that handle CMMC data should balance security and compliance requirements with how employees need to work.
Organizations heavily involved in defense work may need a broader CMMC scope than companies with only a small group handling CUI.
Need help defining your CMMC Scope?
If your company needs help defining CMMC Scope, a managed IT provider like Xceptional can work with you to:
-
Map CUI data flows: Map CUI data flows across your organization to define CMMC Scope.
-
Identify potential compliance gaps: Detect potential compliance gaps in your organization.
-
Define a manageable CMMC environment: Use CMMC Scope to define a manageable IT environment.
-
Prepare systems and documentation for CMMC: Prepare systems and documentation related to CUI for CMMC Scope.
-
Support ongoing CMMC compliance: Support ongoing CMMC compliance by defining CMMC Scope.
Request a quote from the CMMC Scope experts at Xceptional.