Your organization’s Cybersecurity Maturity Model Certification (CMMC) Scope matters because scope directly affects cost and complexity. Larger organizational environments take longer to prepare for CMMC. More systems and users at an organization can mean that additional controls, documentation, and validation are needed.
A well-defined CMMC scope can support a smoother assessment process. The goal of CMMC scope is not to create the smallest possible scope. Instead, it should create the right, defensible scope for the organization.
“My audience might be limited, but I will argue with anyone that cares to listen that scoping is the most important part of CMMC, maybe aside from the assessment.”
-- Cynomi Cybersecurity Expert
Your organization’s CMMC Scope includes systems, processes that transmit Controlled Unclassified Information (CUI), and people that touch CUI. CMMC scope is not limited to technology. If something touches CUI, it belongs in scope.
Systems that store data can be part of the CUI lifecycle. When CUI data is stored, it is at rest.
Any systems or locations where CUI data is saved, archived, or held are part of the CUI lifecycle.
When CUI data is in motion, it is connected to the systems that transmit, read, and edit CUI data.
The people and processes that touch CUI are instrumental in defining your scope.
Storing, processing, and transmitting CUI data is governed by the principle that, if it touches CUI, it matters.
“What is CMMC Scope? Well, we talked a little bit about this. Scope includes systems, people, assets that store and process and transmit CUI.”
-- Cynomi Cybersecurity Expert
Organizations can get started with CMMC Scope by mapping their CUI data flow.
Potential sources of CUI data may include:
Customers
Prime contractors
Government contracts
Physical documentation
Secure portals
Potential locations for CUI data may include:
Servers
Cloud platforms
Endpoints
Shared storage
Physical media
Backup environments
When considering who has access to CUI, include intended users as well as anyone who may have permissions to access shared systems or storage. Review who can access files, servers, applications, and other systems containing CUI.
When considering whether CUI information is shared with others, think about who should have access to sensitive information. CUI can be shared with:
Customers
Prime contractors
Subcontractors
Vendors
Other members of the supply chain
Common CMMC Scoping blind spots exist for organizations that need to protect CUI data.
Email systems that transmit CUI may affect scope. Third-party Software as a Service (SaaS) applications that interact with CUI should be evaluated.
Shared environments can expand CMMC scope when CUI and non-CUI information are stored together.
Remote Workers and Home Offices
When supporting remote workers and home offices, consider how employees may interact with CUI through workstations, access methods, networks, physical documents, and other business communication infrastructure.
Physical documents and removable media containing CUI data require appropriate handling, labeling, and storage.
Backup systems containing CUI may extend the CMMC environment. Cloud replication and redundant backup environments can further expand security boundaries.
“So, what are the blind spots that are common. We mentioned . . . before that some organizations unintentionally expand the CMMC Scope, probably due to lack of understanding of CUI flow in their organization or an assumption that everybody needs to be covered….”
-- Cynomi Cybersecurity Expert
Over-scoping creates unnecessary cost and complexity. Potential impacts of errors in scoping include:
Why Under-Scoping Creates Assessment Risk
Under-scoping creates assessment risk because assets, systems, users, or processes that interact with CUI should not be excluded from CMMC scoping simply to make the environment smaller.
The smallest possible scope is not always the correct scope. Organizations that handle CMMC data should balance security and compliance requirements with how employees need to work.
Organizations heavily involved in defense work may need a broader CMMC scope than companies with only a small group handling CUI.
Need help defining your CMMC Scope?
If your company needs help defining CMMC Scope, a managed IT provider like Xceptional can work with you to:
Map CUI data flows: Map CUI data flows across your organization to define CMMC Scope.
Identify potential compliance gaps: Detect potential compliance gaps in your organization.
Define a manageable CMMC environment: Use CMMC Scope to define a manageable IT environment.
Prepare systems and documentation for CMMC: Prepare systems and documentation related to CUI for CMMC Scope.
Support ongoing CMMC compliance: Support ongoing CMMC compliance by defining CMMC Scope.
Request a quote from the CMMC Scope experts at Xceptional.