CMMC Asset Scoping and Categorization Worksheet
Scoping decides how many assets an assessor will test, and so most of your cost. This worksheet lists your assets by CMMC category and adds the documentation hours and tool cost that follow from each, so scope decisions become numbers.
| Asset or group | CMMC category | Type | Quantity | Documentation hours each | Annual tool cost each | Total hours | Total annual tool cost | Rationale | |
|---|---|---|---|---|---|---|---|---|---|
36 | $3,960 | ||||||||
16 | $1,200 | ||||||||
12 | $1,800 | ||||||||
10 | $7,200 | ||||||||
12.5 | $0 | ||||||||
18 | $0 |
The five categories follow the CMMC scoping guidance for Level 2: CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets and Out-of-Scope Assets. Confirm category rules in the current official scoping guide. Filter by category in Excel to compare what moving an asset out of scope would save.
Reconcile your asset inventory
Optional: we can look at how asset data from your ERP and IT tools could be merged into one scoped inventory.
Optional. The tool and every export work without this. No spam.
How to use it
List asset groups rather than serial numbers: engineering laptops, file servers, firewalls, cloud services, CNC controllers, printers. Pick the category using the data flow. Assets that process, store or transmit CUI are CUI Assets. Assets that provide security functions for them, such as identity, logging and firewalls, are Security Protection Assets. Assets that could touch CUI but are not protected as such are Contractor Risk Managed Assets. Operational technology and similar are Specialized Assets. Everything else, with a defensible boundary, is Out-of-Scope. Enter quantity, effort and tool cost, and read the totals.
Why scoping is a cost decision
Every in scope asset needs a baseline configuration, patching, logging, malware protection and evidence. Moving 25 office PCs out of scope with proper segmentation can save more than any single tool. Likewise, a CUI enclave can reduce the number of CUI Assets to a handful. The worksheet totals help compare alternatives: duplicate the sheet, change categories, and compare hours and cost. The goal is a smaller, well drawn boundary that the network diagram and SSP both show.
- Draw the boundary on the network diagram first
- Document data flows for CUI in and out
- Record why each out of scope asset cannot reach CUI
- Keep Specialized Assets on a risk based plan
Common mistakes
The most frequent mistake is calling an asset out of scope because it is unimportant, when the real test is whether it can process, store or transmit CUI or provide security protection. Another is forgetting people and facilities: personnel with CUI access and the physical spaces where CUI is handled are assessed too. Finally, many teams omit external service providers and cloud services from the inventory, which then surface in the shared responsibility discussion with the assessor.
Frequently Asked Questions
Do I list every individual device?
The inventory behind your SSP should be complete, but for planning you can group identical assets. Keep a detailed list elsewhere, and make sure grouped counts match it exactly.
Are CNC machines in scope?
If they hold or process CUI, such as controlled technical drawings or programs, they can be CUI Assets or Specialized Assets depending on how they are used. Document the data flow and the compensating controls, and verify with current guidance.
What is a Contractor Risk Managed Asset?
An asset that can, but is not intended to, handle CUI because it is not separated from CUI Assets. You document it in the SSP and manage it by your own risk based policies, and an assessor may spot check it.
Can scope change between assessments?
Yes, and you must update the SSP, diagrams and inventory when it does. Keep a dated record of the changes so the assessor sees how the boundary evolved.
If your asset list is spread across the CMDB, ERP asset module and spreadsheets, we can help reconcile it on your own infrastructure.
Related Tools
CMMC Practice Evidence Tracker Worksheet
One row per practice: objectives, objectives met, evidence items, owner and weight. The sheet computes percent complete, points at risk and an estimated score.
Compliance & ContractsCMMC Shared Responsibility Matrix Worksheet for MSPs and Cloud Providers
Record who implements each practice, where the evidence lives and what share is yours. Useful when an MSP, MSSP or cloud service provider runs part of your CUI environment.
Costing & FinanceDefense Supplier Compliance Hours and Staffing Calculator
Add up the recurring work behind NIST 800-171: log review, access reviews, training, scanning, patching, POA&M and assessor prep. See hours, FTE and loaded labor cost.
Aerospace & DefenseCUI Enclave vs Enterprise Scope Cost Calculator
Model whether a dedicated CUI enclave is cheaper than bringing every user into scope, with a break-even CUI headcount and a what-if chart.
More Compliance & Contracts tools
See all- SPRS Score Recovery Timeline Calculator
- CUI Banner and Dissemination Control Marking Reference
- ITAR Technical Data Handling Procedure Template
- CMMC C3PAO Assessment Day Prep Checklist
- CMMC Level 2 Checklist Worksheet
- CMMC Level 1 Checklist (15 Practices) with Evidence Tracker
- SAP SoD Residual Risk Score Calculator
- SAP Firefighter ID Usage Review Log
- IBM i (AS/400) User Profile Access Review Worksheet
Keep exploring
Free tools
- CMMC Level 1 ChecklistTick through every CMMC Level 1 practice for Federal Contract Information, see example evidence for each, and finish with the annual affirmation steps.
- CMMC Level 2 Checklist WorksheetAn editable CMMC Level 2 tracking sheet with real NIST SP 800-171 practice IDs, status, evidence, owner and due date, exportable to Excel.
- Cost of CMMC Level 2 Third-Party Certification CalculatorEstimate one-time and yearly cost of CMMC Level 2 certification including the C3PAO assessment, readiness consulting and remediation.
ERP fixes and how-tos
- On-Prem vs Cloud ERP AI for Regulated ManufacturersHow CIOs at ITAR, CMMC, and export-controlled manufacturers should weigh on-prem versus cloud AI for their ERP, including what actually needs to stay on-prem and what does not.
- JD Edwards Fixed Assets: Setup, Depreciation and the Account Ledger FlowHow JD Edwards EnterpriseOne Fixed Assets works: asset master setup, ledger types, depreciation runs and how asset cost and depreciation flow to the general ledger.
- Costpoint Cloud or On-Prem for a Contractor Handling CUI?Deciding between Deltek Costpoint cloud and self-hosted for a defense contractor with CUI: scope, shared responsibility, cost, control, what to verify.
Guides
- CMMC 2.0 for Small ManufacturersCMMC 2.0 for small manufacturers explained: Level 1 vs Level 2, the 110 NIST SP 800-171 practices, scoping your shop floor, and where ERP and CAD data fit.
- Building a CUI Enclave for Defense ManufacturingHow to build a CUI enclave for defense manufacturing: scope NIST SP 800-171 and CMMC boundaries, isolate ERP and engineering data, and cut assessment cost.
- AI-Powered Defense Manufacturing ComplianceEnsure defense manufacturing compliance with AI. Automated ITAR, DFARS, CMMC, and export control management for defense contractors and subcontractors.
AI on your ERP
- CMMC Level 2 AI for ERP Without Blowing Up Your ScopeHow to deploy AI inside your CMMC 2.0 Level 2 assessment boundary without expanding CUI scope. Enclave architecture a CISO can defend to a C3PAO.
- On-prem AI for Costpoint inside a CMMC Level 2 enclaveDeploy AI beside Deltek Costpoint inside a CMMC Level 2 enclave: what to check before adding any AI tool, and how on-prem inference avoids new CUI flows.
Integrations
- How to build an MCP server for Infor VISUALHow to build a Model Context Protocol server for Infor VISUAL: tool design, SQL Server access, stdio vs HTTP, permission scoping and audit for any MCP client.
- How to build an MCP server for SAP Business OneBuild a Model Context Protocol server for SAP Business One: tools to expose, Service Layer auth, stdio versus HTTP, permission scoping and audit logging.