Scoping tool · §170.19

Scoping Map — define & equip the assessment surface

CMMC Step 1: identify every asset and place it in a §170.19 category. The category an asset lands in determines how much of the assessment touches it — so this is the step that sizes the whole engagement. Then switch to Equip to see which vendors cover the surface you scoped.

⚠️

Descriptive, not prescriptive. Starting categories are hypotheses to discuss, not determinations. The same asset can be a CUI Asset or a CRMA depending on whether CUI actually flows to it. Confirm final scope with your authorized C3PAO.

Not sure whether you even have CUI, what kind, or where it lives? Start with CUI discovery — it determines your level, traces your CUI flow, and opens this map pre-seeded.

Hybrid (partial segmentation). Clearly-CUI systems are in scope as CUI Assets; general productivity is risk-managed (CRMA). A common middle posture.

IT-only contractor. No operational-technology environment, so OT/ICS assets are Out-of-Scope (network IoT like printers stays a managed CRMA).

DATA 9

Customer PII

Personally identifiable information including names, SSNs, addresses, and payment details stored across CRM, ERP, and cloud databases.

To review

coversMicrosoft PurviewVaronisCloudflare DLP+4 more

Financial Records

General ledger, accounts payable/receivable, payroll data, and tax records maintained in ERP and accounting systems.

To review

coversVaronisNetwrixBigID+4 more

IP & Trade Secrets

Product designs, source code repositories, proprietary algorithms, and strategic plans stored in document management and version control systems.

To review

coversMicrosoft PurviewZscaler CASBCloudflare CASB+8 more

Employee HR Data

Personnel records, benefits information, performance reviews, and compensation data in HRIS platforms like Workday or BambooHR.

To review

coversVaronisOneTrustCloudflare Access

Cloud Object Storage

AWS S3 buckets, Azure Blob Storage, and GCP Cloud Storage containing backups, media assets, logs, and application data.

To review

coversWizPrisma CloudCloudflare R2+13 more

Databases (SQL/NoSQL)

Production databases including PostgreSQL, MySQL, MongoDB, and Redis instances hosting application state and business-critical data.

To review

coversImpervaHashiCorp VaultAWS RDS IAM+1 more

Email & Messaging

Corporate email archives, Slack/Teams message history, and attached files containing sensitive business communications.

To review

coversProofpointMimecastCloudflare Email Security+3 more

Logs & Telemetry

Security logs, application telemetry, network flow data, and audit trails aggregated in SIEM and observability platforms.

To review

coversSplunkCrowdStrike LogScaleDatadog+10 more

Process & Telemetry Data

Time-series tag data, batch records, recipe libraries, and process logs — the operational truth and the regulatory record of plant behavior.

To review

coversOSIsoft PI Asset FrameworkHoneywell UniformanceAVEVA PI System

APPLICATIONS 10

ERP (SAP/Oracle)

Enterprise resource planning system managing finance, supply chain, HR, and operations — the operational backbone of the enterprise.

To review

coversCyberArkOnapsisPalo Alto ZTNA+8 more

CRM (Salesforce)

Customer relationship management platform containing sales pipeline, customer contacts, deal history, and marketing data.

To review

coversOktaSalesforce ShieldCloudflare Access+8 more

Google Workspace

Productivity suite including Gmail, Drive, Docs, Sheets, and Meet used daily by every employee for collaboration and communication.

To review

coversGoogle BeyondCorpCloudflare CASBNetskope+8 more

Custom Web Apps

Internal line-of-business applications, customer portals, and microservices built in-house and deployed on cloud infrastructure.

To review

coversCloudflare WAFSnykPalo Alto Prisma Cloud+2 more

DevOps (GitHub/CI)

Source code repositories, CI/CD pipelines, container registries, and infrastructure-as-code tools forming the software delivery chain.

To review

coversGitHub Advanced SecurityHashiCorp VaultSnyk+1 more

HR Platform

Human resources information systems (Workday, BambooHR) managing employee lifecycle, payroll processing, and benefits administration.

To review

coversOktaCyberArkCloudflare Access+11 more

Accounting (NetSuite)

Financial management application handling invoicing, expense tracking, financial reporting, and regulatory compliance (SOX).

To review

coversCyberArkOktaNetwrix+8 more

Slack / Teams

Real-time messaging and collaboration platforms where sensitive discussions, file sharing, and integrations create invisible data flows.

To review

coversNetskopeCloudflare CASBNightfall AI+8 more

VPN / Remote Access

Legacy VPN concentrators and modern ZTNA solutions providing remote workforce access to internal applications and resources.

To review

coversCloudflare ZTNAZscaler Private AccessPalo Alto Prisma Access+8 more

SCADA / HMI

Supervisory control and data acquisition platforms plus human-machine interfaces operators use to monitor and command the process.

To review

coversInductive Automation IgnitionAVEVA System PlatformSiemens WinCC

ASSETS 11

Laptops & Desktops

Employee workstations (Windows, macOS, Linux) used for daily operations — the primary endpoint attack surface in most enterprises.

To review

coversCrowdStrike FalconMicrosoft DefenderTanium+8 more

Mobile (iPhone/Android)

Company-owned and BYOD smartphones and tablets accessing corporate email, apps, and data through MDM-managed profiles.

To review

coversMicrosoft IntuneJamfVMware Workspace ONE+5 more

Network (Cisco/Meraki)

Routers, switches, wireless access points, and SD-WAN appliances forming the physical and logical network infrastructure.

To review

coversCisco ISEAristaCloudflare Magic WAN+6 more

Firewalls (Palo Alto)

Next-generation firewalls at network perimeter and internal segmentation points enforcing traffic policies and threat prevention.

To review

coversPalo Alto NGFWFortinet FortiGateCloudflare Magic Firewall+2 more

Cloud (AWS/Azure)

IaaS and PaaS resources including EC2 instances, Lambda functions, Kubernetes clusters, and managed services across multi-cloud environments.

To review

coversWizPrisma CloudLacework+13 more

Servers (On-Prem)

Physical and virtual servers in on-premises data centers running legacy applications, Active Directory, and file shares.

To review

coversIllumioCrowdStrike FalconCyberArk+1 more

Printers & IoT

Network printers, smart displays, conference room systems, HVAC controllers, and badge readers — often unmanaged and unmonitored.

To review

coversArmisForescoutCloudflare Gateway+2 more

USB & Removable Media

USB drives, external hard disks, and removable media that bypass network controls and can introduce malware or exfiltrate data.

To review

coversCrowdStrike Device ControlMicrosoft DefenderCoSoSys Endpoint Protector+7 more

Engineering Workstation

OEM engineering workstation used to program PLCs and modify control logic — typically Windows-based with vendor toolchains (RSLogix, TIA Portal, ControlBuilder).

To review

coversCrowdStrike Falcon (OT mode)Honeywell Forge CybersecurityClaroty Secure Remote Access+9 more

IT-OT DMZ / Industrial Firewall

Boundary-enforcing firewall (or data diode / unidirectional gateway) between the IT enterprise zone and the OT cells — the Purdue Level-3.5 DMZ.

To review

coversWaterfall Unidirectional GatewayOwl Cyber Defense DiodeFortinet FortiGate Rugged+1 more

PLCs / ICS Controllers

Programmable logic controllers and safety-instrumented systems running the physical process — the closest layer to operational impact.

To review

coversRockwell ControlLogixSiemens SIMATIC S7Schneider Modicon

SERVICES 10

DNS & Domain

Domain name resolution services — the first query in nearly every network connection. DNS is both critical infrastructure and an attack vector.

To review

coversCloudflare GatewayCisco UmbrellaInfoblox BloxOne+7 more

Identity (Okta/Entra)

Identity provider services including SSO, MFA, directory sync, and lifecycle management — the control plane of Zero Trust.

To review

coversOktaMicrosoft Entra IDCloudflare Access+7 more

CDN & Edge

Content delivery and edge compute services accelerating web applications while providing DDoS protection and bot management.

To review

coversCloudflare CDNAkamaiFastly+1 more

Email Security

Email filtering, anti-phishing, and email authentication services (SPF/DKIM/DMARC) protecting the #1 attack vector.

To review

coversCloudflare Email SecurityProofpointAbnormal Security+2 more

SIEM / XDR

Security information and event management services correlating alerts across the entire protect surface for detection and response.

To review

coversCrowdStrike Falcon XDRMicrosoft SentinelSplunk+10 more

Backup & DR

Backup, disaster recovery, and business continuity services ensuring data survivability against ransomware and catastrophic events.

To review

coversVeeamRubrikAWS Backup

Secure Web Gateway

Web traffic inspection and filtering services enforcing acceptable use policies and blocking malicious content at the network edge.

To review

coversCloudflare GatewayZscaler Internet AccessNetskope SWG+7 more

Privileged Access Mgmt

Privileged access management services controlling and auditing admin access to critical systems — a cornerstone of Zero Trust.

To review

coversCyberArkDelineaHashiCorp Boundary+8 more

Process Historian

Asset and process record-keeper that captures the time-series of every PLC tag and HMI event — the durable record OT operations and incident response both depend on.

To review

coversOSIsoft PI HistorianAVEVA HistorianGE Proficy Historian

OT IDS / Anomaly

Signature- and anomaly-based intrusion detection for ICS protocols (Modbus, S7, DNP3, OPC) deployed on SPAN/TAP at the IT-OT boundary and inside cells.

To review

coversClaroty xDomeNozomi NetworksDragos Platform+2 more

Scope summary

0 of 40 categorized · 0 confirmed

Assets in assessment boundary0

Fully assessed (CUI + SPA)0

Out of scope0

Relative assessment effort illustrative

0% of the theoretical maximum (every asset a CUI Asset). Shrinking the CUI footprint via separation is the single biggest lever on assessment cost.

§170.19 categories

CUI Asset (CUI)

Processes, stores, or transmits CUI. Document in asset inventory + SSP + network diagram. Assessed against ALL L2 security requirements.

Assessment: All 110 L2 requirements

§170.19(c)(1) Table 3 — CUI Assets

Security Protection Asset (SPA)

Provides security functions to the assessment scope (SIEM, hosted VPN, MSSP-administered EDR, security consultants). Assessed against L2 reqs relevant to the capability provided.

Assessment: Relevant security-function controls

§170.19(c)(1) Table 3 — Security Protection Assets

Contractor Risk-Managed Asset (CRMA)

Capable of, but not intended to, handle CUI; managed via risk-based policy. Limited check at L2: review SSP; deeper assessment only if documentation raises questions. NOTE: at L3, CRMAs become CUI Assets.

Assessment: Limited check (SSP review)

§170.19(c)(1) Table 3 — CRMA + §170.19(d)(1) Table 5

Specialized Asset (Specialized)

Closed list: IoT / IIoT / OT / Government-Furnished Equipment / Restricted Information Systems / Test Equipment. May handle CUI but cannot be fully secured. Review SSP only at L2.

Assessment: SSP review only (L2)

§170.4 + §170.19(c)(1) Table 3

Out of Scope (OOS)

Cannot handle CUI and provides no security protection for CUI Assets. Be prepared to justify the inability to handle CUI. Not part of the assessment. Separation techniques govern the in/out-of-scope line.

Assessment: Not assessed

§170.19(c)(1) Table 3 — Out-of-Scope + Scoping Guide L2

§170.19 asset categories

Category	Assessment burden	Definition	Source
CUI Asset	All 110 L2 requirements	Processes, stores, or transmits CUI. Document in asset inventory + SSP + network diagram. Assessed against ALL L2 security requirements.	§170.19(c)(1) Table 3 — CUI Assets
Security Protection Asset	Relevant security-function controls	Provides security functions to the assessment scope (SIEM, hosted VPN, MSSP-administered EDR, security consultants). Assessed against L2 reqs relevant to the capability provided.	§170.19(c)(1) Table 3 — Security Protection Assets
Contractor Risk-Managed Asset	Limited check (SSP review)	Capable of, but not intended to, handle CUI; managed via risk-based policy. Limited check at L2: review SSP; deeper assessment only if documentation raises questions. NOTE: at L3, CRMAs become CUI Assets.	§170.19(c)(1) Table 3 — CRMA + §170.19(d)(1) Table 5
Specialized Asset	SSP review only (L2)	Closed list: IoT / IIoT / OT / Government-Furnished Equipment / Restricted Information Systems / Test Equipment. May handle CUI but cannot be fully secured. Review SSP only at L2.	§170.4 + §170.19(c)(1) Table 3
Out of Scope	Not assessed	Cannot handle CUI and provides no security protection for CUI Assets. Be prepared to justify the inability to handle CUI. Not part of the assessment. Separation techniques govern the in/out-of-scope line.	§170.19(c)(1) Table 3 — Out-of-Scope + Scoping Guide L2

Assets & suggested starting category

DATA

Asset	Suggested category	Description
Customer PII	CRMA	Personally identifiable information including names, SSNs, addresses, and payment details stored across CRM, ERP, and cloud databases.
Financial Records	OutOfScope	General ledger, accounts payable/receivable, payroll data, and tax records maintained in ERP and accounting systems.
IP & Trade Secrets	To review	Product designs, source code repositories, proprietary algorithms, and strategic plans stored in document management and version control systems.
Employee HR Data	OutOfScope	Personnel records, benefits information, performance reviews, and compensation data in HRIS platforms like Workday or BambooHR.
Cloud Object Storage	To review	AWS S3 buckets, Azure Blob Storage, and GCP Cloud Storage containing backups, media assets, logs, and application data.
Databases (SQL/NoSQL)	To review	Production databases including PostgreSQL, MySQL, MongoDB, and Redis instances hosting application state and business-critical data.
Email & Messaging	To review	Corporate email archives, Slack/Teams message history, and attached files containing sensitive business communications.
Logs & Telemetry	SPA	Security logs, application telemetry, network flow data, and audit trails aggregated in SIEM and observability platforms.
Process & Telemetry Data	To review	Time-series tag data, batch records, recipe libraries, and process logs — the operational truth and the regulatory record of plant behavior.

APPLICATIONS

Asset	Suggested category	Description
ERP (SAP/Oracle)	To review	Enterprise resource planning system managing finance, supply chain, HR, and operations — the operational backbone of the enterprise.
CRM (Salesforce)	CRMA	Customer relationship management platform containing sales pipeline, customer contacts, deal history, and marketing data.
Google Workspace	CRMA	Productivity suite including Gmail, Drive, Docs, Sheets, and Meet used daily by every employee for collaboration and communication.
Custom Web Apps	To review	Internal line-of-business applications, customer portals, and microservices built in-house and deployed on cloud infrastructure.
DevOps (GitHub/CI)	To review	Source code repositories, CI/CD pipelines, container registries, and infrastructure-as-code tools forming the software delivery chain.
HR Platform	OutOfScope	Human resources information systems (Workday, BambooHR) managing employee lifecycle, payroll processing, and benefits administration.
Accounting (NetSuite)	OutOfScope	Financial management application handling invoicing, expense tracking, financial reporting, and regulatory compliance (SOX).
Slack / Teams	CRMA	Real-time messaging and collaboration platforms where sensitive discussions, file sharing, and integrations create invisible data flows.
VPN / Remote Access	SPA	Legacy VPN concentrators and modern ZTNA solutions providing remote workforce access to internal applications and resources.
SCADA / HMI	Specialized	Supervisory control and data acquisition platforms plus human-machine interfaces operators use to monitor and command the process.

ASSETS

Asset	Suggested category	Description
Laptops & Desktops	CRMA	Employee workstations (Windows, macOS, Linux) used for daily operations — the primary endpoint attack surface in most enterprises.
Mobile (iPhone/Android)	CRMA	Company-owned and BYOD smartphones and tablets accessing corporate email, apps, and data through MDM-managed profiles.
Network (Cisco/Meraki)	SPA	Routers, switches, wireless access points, and SD-WAN appliances forming the physical and logical network infrastructure.
Firewalls (Palo Alto)	SPA	Next-generation firewalls at network perimeter and internal segmentation points enforcing traffic policies and threat prevention.
Cloud (AWS/Azure)	To review	IaaS and PaaS resources including EC2 instances, Lambda functions, Kubernetes clusters, and managed services across multi-cloud environments.
Servers (On-Prem)	CRMA	Physical and virtual servers in on-premises data centers running legacy applications, Active Directory, and file shares.
Printers & IoT	To review	Network printers, smart displays, conference room systems, HVAC controllers, and badge readers — often unmanaged and unmonitored.
USB & Removable Media	CRMA	USB drives, external hard disks, and removable media that bypass network controls and can introduce malware or exfiltrate data.
Engineering Workstation	Specialized	OEM engineering workstation used to program PLCs and modify control logic — typically Windows-based with vendor toolchains (RSLogix, TIA Portal, ControlBuilder).
IT-OT DMZ / Industrial Firewall	SPA	Boundary-enforcing firewall (or data diode / unidirectional gateway) between the IT enterprise zone and the OT cells — the Purdue Level-3.5 DMZ.
PLCs / ICS Controllers	Specialized	Programmable logic controllers and safety-instrumented systems running the physical process — the closest layer to operational impact.

SERVICES

Asset	Suggested category	Description
DNS & Domain	SPA	Domain name resolution services — the first query in nearly every network connection. DNS is both critical infrastructure and an attack vector.
Identity (Okta/Entra)	SPA	Identity provider services including SSO, MFA, directory sync, and lifecycle management — the control plane of Zero Trust.
CDN & Edge	OutOfScope	Content delivery and edge compute services accelerating web applications while providing DDoS protection and bot management.
Email Security	SPA	Email filtering, anti-phishing, and email authentication services (SPF/DKIM/DMARC) protecting the #1 attack vector.
SIEM / XDR	SPA	Security information and event management services correlating alerts across the entire protect surface for detection and response.
Backup & DR	To review	Backup, disaster recovery, and business continuity services ensuring data survivability against ransomware and catastrophic events.
Secure Web Gateway	SPA	Web traffic inspection and filtering services enforcing acceptable use policies and blocking malicious content at the network edge.
Privileged Access Mgmt	SPA	Privileged access management services controlling and auditing admin access to critical systems — a cornerstone of Zero Trust.
Process Historian	Specialized	Asset and process record-keeper that captures the time-series of every PLC tag and HMI event — the durable record OT operations and incident response both depend on.
OT IDS / Anomaly	SPA	Signature- and anomaly-based intrusion detection for ICS protocols (Modbus, S7, DNP3, OPC) deployed on SPAN/TAP at the IT-OT boundary and inside cells.

Rendered from the ZeroTrustAtlas engine: protect-surface/defense-cmmc (40 assets, 4 layers, vendor coverage with tiers) joined to the §170.19 five-asset-category model in frameworks/cmmc-v2. Regulatory framing: CMMC 2.0 · NIST SP 800-171 · DFARS 252.204-7012. Category definitions sourced to 32 CFR Part 170 and the CMMC L2 Scoping Guide (v2.13). Asset-to-category baselines and vendor coverage are illustrative starting points, not determinations.