# CMMC Asset Scoping and Categorization Worksheet

> Source: https://netray.co/tools/cmmc-asset-scoping-categorization-worksheet
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

Build your in scope asset inventory by CMMC category, with quantities, documentation effort and annual tool cost so you can see what scope reduction would save.

## Category

compliance-legal

## Industry

Defense

## Audience

- IT manager
- Compliance lead
- Consultant
- Operations manager

## Tool

**Kind:** worksheet

**Mode:** editable

**Currency:** $

**Columns:**

#### Asset or group

**Key:** asset

**Type:** text

#### CMMC category

**Key:** category

**Type:** select

**Options:**

- CUI Asset
- Security Protection Asset
- Contractor Risk Managed Asset
- Specialized Asset
- Out-of-Scope Asset

#### Type

**Key:** type

**Type:** select

**Options:**

- Workstation
- Server
- Network device
- Cloud service
- Machine tool or CNC
- Mobile device
- Printer or MFP
- Facility
- People

#### Quantity

**Key:** qty

**Type:** number

#### Documentation hours each

**Key:** hrs

**Type:** number

**Help:** SSP entry, diagram, config baseline, evidence

#### Annual tool cost each

**Key:** lic

**Type:** number

**Format:** currency

**Help:** EDR, MFA, logging, patching licenses

#### Total hours

**Key:** ext_hrs

**Type:** number

**Expr:** qty * hrs

**Format:** number

#### Total annual tool cost

**Key:** ext_cost

**Type:** number

**Expr:** qty * lic

**Format:** currency

#### Rationale

**Key:** note

**Type:** text

**Rows:**

**Asset:** Engineering laptops handling drawings

**Category:** CUI Asset

**Type:** Workstation

**Qty:** 18

**Hrs:** 2

**Lic:** 220

**Note:** Store and process CTI

**Asset:** File server with program data

**Category:** CUI Asset

**Type:** Server

**Qty:** 2

**Hrs:** 8

**Lic:** 600

**Note:** CUI repository

**Asset:** Firewall and VPN gateway

**Category:** Security Protection Asset

**Type:** Network device

**Qty:** 2

**Hrs:** 6

**Lic:** 900

**Note:** Boundary protection

**Asset:** SIEM and log collector

**Category:** Security Protection Asset

**Type:** Cloud service

**Qty:** 1

**Hrs:** 10

**Lic:** 7200

**Note:** Audit and alerting

**Asset:** Office PCs with no CUI

**Category:** Out-of-Scope Asset

**Type:** Workstation

**Qty:** 25

**Hrs:** 0.5

**Lic:** 0

**Note:** Segmented, no CUI path

**Asset:** CNC controllers on isolated VLAN

**Category:** Specialized Asset

**Type:** Machine tool or CNC

**Qty:** 6

**Hrs:** 3

**Lic:** 0

**Note:** OT, risk based plan

**Totals:**

#### Total assets

**Key:** qty

**Agg:** sum

**Format:** integer

#### Documentation hours

**Key:** ext_hrs

**Agg:** sum

**Format:** number

#### Annual tool cost

**Key:** ext_cost

**Agg:** sum

**Format:** currency

**Summary:**

#### Average documentation hours per asset

**Key:** avg_hrs

**Expr:** sum_ext_hrs / sum_qty

**Format:** decimal

#### Average annual tool cost per asset

**Key:** avg_cost

**Expr:** sum_ext_cost / sum_qty

**Format:** currency

**Primary:** true

**Notes:** The five categories follow the CMMC scoping guidance for Level 2: CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets and Out-of-Scope Assets. Confirm category rules in the current official scoping guide. Filter by category in Excel to compare what moving an asset out of scope would save.

## Content

**Intro:** Scoping decides how many assets an assessor will test, and so most of your cost. This worksheet lists your assets by CMMC category and adds the documentation hours and tool cost that follow from each, so scope decisions become numbers.

**Sections:**

#### How to use it

**Body:** List asset groups rather than serial numbers: engineering laptops, file servers, firewalls, cloud services, CNC controllers, printers. Pick the category using the data flow. Assets that process, store or transmit CUI are CUI Assets. Assets that provide security functions for them, such as identity, logging and firewalls, are Security Protection Assets. Assets that could touch CUI but are not protected as such are Contractor Risk Managed Assets. Operational technology and similar are Specialized Assets. Everything else, with a defensible boundary, is Out-of-Scope. Enter quantity, effort and tool cost, and read the totals.

#### Why scoping is a cost decision

**Body:** Every in scope asset needs a baseline configuration, patching, logging, malware protection and evidence. Moving 25 office PCs out of scope with proper segmentation can save more than any single tool. Likewise, a CUI enclave can reduce the number of CUI Assets to a handful. The worksheet totals help compare alternatives: duplicate the sheet, change categories, and compare hours and cost. The goal is a smaller, well drawn boundary that the network diagram and SSP both show.

**Bullets:**

- Draw the boundary on the network diagram first
- Document data flows for CUI in and out
- Record why each out of scope asset cannot reach CUI
- Keep Specialized Assets on a risk based plan

#### Common mistakes

**Body:** The most frequent mistake is calling an asset out of scope because it is unimportant, when the real test is whether it can process, store or transmit CUI or provide security protection. Another is forgetting people and facilities: personnel with CUI access and the physical spaces where CUI is handled are assessed too. Finally, many teams omit external service providers and cloud services from the inventory, which then surface in the shared responsibility discussion with the assessor.

**Cta:** If your asset list is spread across the CMDB, ERP asset module and spreadsheets, we can help reconcile it on your own infrastructure.

**Faq:**

#### Do I list every individual device?

**Answer:** The inventory behind your SSP should be complete, but for planning you can group identical assets. Keep a detailed list elsewhere, and make sure grouped counts match it exactly.

#### Are CNC machines in scope?

**Answer:** If they hold or process CUI, such as controlled technical drawings or programs, they can be CUI Assets or Specialized Assets depending on how they are used. Document the data flow and the compensating controls, and verify with current guidance.

#### What is a Contractor Risk Managed Asset?

**Answer:** An asset that can, but is not intended to, handle CUI because it is not separated from CUI Assets. You document it in the SSP and manage it by your own risk based policies, and an assessor may spot check it.

#### Can scope change between assessments?

**Answer:** Yes, and you must update the SSP, diagrams and inventory when it does. Keep a dated record of the changes so the assessor sees how the boundary evolved.

## Search terms

cmmc asset inventory template, cmmc scoping worksheet, cmmc asset categories, cui asset security protection asset, contractor risk managed asset, cmmc scope reduction, cmmc network diagram inventory, cmmc level 2 scoping excel

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json