2. Defining Scope

DEFINE SCOPING

This has four subcomponent steps to define the scope of the CMMC assessment boundary:

a) Create a Data Flow Diagram (DFD) that shows how CUI flows from the DoD all the way down to subcontractors;

b) Create a detailed asset inventory for all systems, applications and services for both in-scope and out-of-scope assets;

c) Create a detailed network diagram that includes where CUI is stored, transmitted and/or processed; and

d) Inventory Third-Party Service Providers (TSP) to determine TSP access to CUI and/or in-scope systems, applications and/or services.