A defensible boundary connects contractual requirements, the information handled, and the assets and services involved. A tool purchase alone does not establish that boundary.
Confirm what information is involved
Review the award, subcontract flowdowns, delivery instructions, markings, and customer guidance. Use the official CUI Registry to understand information categories and their authorities. Do not classify every engineering drawing or internal business record as CUI by assumption. Resolve unclear designations with the appropriate customer or contracting authority.
Follow the work from receipt to disposal
Map how information enters the business, who uses it, where it is processed or stored, how it is transmitted, and how it is retained or disposed of. Include ordinary workflows such as email, shared folders, manufacturing systems, remote access, backups, printing, and supplier exchanges where relevant. Keep detailed maps in an appropriately protected environment.
Consider more than the obvious CUI systems
CMMC Level 2 scoping distinguishes CUI assets, security protection assets, contractor risk managed assets, specialized assets, and out-of-scope assets. The treatment and evidence expectations differ. A system can matter to the scope because it provides security capabilities even when it does not itself hold CUI. An out-of-scope label needs a defensible basis.
- Identify security services and administrative access supporting the boundary.
- Review cloud and other service providers and document shared responsibilities.
- Evaluate specialized equipment and operational technology using the applicable scoping rules.
- Validate claimed separation instead of assuming a separate folder establishes it.
Produce a scope package you can maintain
A useful planning package includes an information-flow description, asset inventory, boundary rationale, provider responsibility record, open questions, and documented decisions. Update the SSP and relevant diagrams to match. Revisit the scope when contracts, systems, providers, or information flows change. Continuum supports this analysis and coordinates technical validation where needed; public inquiry forms are not a channel for submitting CUI or network diagrams.
Relevant government sources
Review current source material alongside your actual contract and customer instructions. This guide provides general education; it does not determine your organization’s compliance status.