CMMC Scope – Understanding the Sprawl

This report provides guidance on CMMC scope for defense contractors, defining FCI vs. CUI, detailing which assets fall in- and out-of-scope across CMMC Levels 1–3, and explaining asset categories (CUI Assets, Specialized Assets, Contractor Risk Managed Assets, Security Protection Assets) and the role of External Service Providers; it also discusses scope minimization strategies to reduce compliance cost and disruption.