CMMC Scoping Guide: Level 2 Asset Categories

For a Level 2 CMMC assessment, the CMMC Assessment Scope is the set of assets that will be assessed, and it is built from five asset categories defined in 32 CFR 170.19. Three are assessed in some form, one is only documented, and one is out of scope. This guide walks the categories in the order a lab or research computing group would test an asset against them, then covers the documentation each category needs and how outside service providers are scoped. Everything below comes from the regulation text, checked on 2026-10-29.

What CMMC scoping is and who runs it

CMMC is the Department of Defense’s cybersecurity certification program for contractors, set out in 32 CFR Part 170. Section 170.19 is the scoping section. It says the CMMC Assessment Scope “must be specified prior to assessment” and defines that scope as the set of all assets in the organization seeking assessment’s (OSA’s) environment that will be assessed against CMMC security requirements. The OSA, meaning the university, institute or company, writes the scope; an assessor then tests against it.

The program-level picture (levels, clauses, who must comply) is covered in CMMC compliance for research institutions and DFARS 252.204-7021. This page stays on one question: how each asset is classified.

Eligibility: when the five-category model applies

Section 170.19(c) states that before a Level 2 self-assessment or a Level 2 certification assessment, the OSA must specify the CMMC Assessment Scope, and that the Level 2 scope “is based on the specification of asset categories and their respective requirements” in Table 3. Level 1 uses a simpler rule: systems that process, store or transmit Federal Contract Information (FCI) are in scope, and the OSA specifies the scope before its self-assessment (see CMMC Level 1 self-assessment). Level 3 has its own table in paragraph (d), which this page does not cover.

What Table 3 requires: the five Level 2 asset categories

Table 3 splits assets into those inside the Level 2 scope and those outside it. The descriptions and assessor treatments below are quoted from the regulation.

Category	Description in 32 CFR 170.19	How an assessor treats it
CUI Assets	“Assets that process, store, or transmit CUI”	“Assess against all Level 2 security requirements.”
Security Protection Assets	“Assets that provide security functions or capabilities to the OSA’s CMMC Assessment Scope”	“Assess against Level 2 security requirements that are relevant to the capabilities provided.”
Contractor Risk Managed Assets	“Assets that can, but are not intended to, process, store, or transmit CUI because of security policy, procedures, and practices in place”	Review the System Security Plan (SSP); if sufficiently documented, “do not assess against other CMMC security requirements, except as noted.”
Specialized Assets	“Assets that can process, store, or transmit CUI but are unable to be fully secured”	“Review the SSP.” and “Do not assess against other CMMC security requirements.”
Out-of-Scope Assets	“Assets that cannot process, store, or transmit CUI; and do not provide security protections for CUI Assets”	“None.”

Controlled Unclassified Information is explained in the CUI dictionary entry, and the 110 requirements a CUI Asset is assessed against come from NIST SP 800-171.

Compliance steps: scoping a Level 2 assessment

The regulation does not prescribe a numbered procedure, but the table supports a decision sequence. Ask the questions below for each asset, stopping at the first yes.

Does it process, store or transmit CUI? Then it is a CUI Asset and is assessed against all Level 2 requirements. Lab examples: the workstation where a controlled dataset is analysed, the file share that holds it.
Does it provide security functions to the assessment scope? Then it is a Security Protection Asset, assessed against the requirements relevant to what it does. Examples in this category would be identity providers, endpoint management consoles and log servers that serve the in-scope environment.
Can it handle CUI but is it unable to be fully secured? The regulation names Internet of Things and Industrial IoT devices, Operational Technology, Government Furnished Equipment, Restricted Information Systems and Test Equipment. Then it is a Specialized Asset. A bench instrument controller that cannot take a managed security agent is the typical research case, and Test Equipment is named in the text.
Can it handle CUI, but policy and practice keep it from being used for CUI? Then it is a Contractor Risk Managed Asset, provided the SSP documents that treatment. A general campus system that the lab’s policy says must never receive CUI would be argued here.
Is it none of the above? Then it is out of scope, and the OSA must be prepared to justify why it cannot process, store or transmit CUI. The regulation gives one example: an endpoint hosting a VDI client configured to allow nothing beyond keyboard, video and mouse traffic is out of scope. It also states that an asset in any in-scope category cannot be treated as out of scope.

The classification is the OSA’s own determination, recorded in the SSP. The categories are not a lookup by device type; the same model of PC can be a CUI Asset in one lab and out of scope in another.

The separation question: are Contractor Risk Managed Assets walled off?

The regulation answers this directly: Contractor Risk Managed Assets “are not required to be physically or logically separated from CUI assets.” The cost of that flexibility is documentation and exposure. These assets must still be in the asset inventory, described in the SSP and shown on the network diagram, and the OSA must prepare to be assessed against Level 2 requirements. If the documentation or other findings raise questions, the assessor “can conduct a limited check to identify deficiencies.” That check “shall not materially increase the assessment duration nor the assessment cost,” and it is assessed against CMMC security requirements.

Do Specialized Assets escape assessment?

Not entirely. The assessor reviews the SSP and does not assess the asset against the other security requirements, but the OSA must “show these assets are managed using the contractor’s risk-based security policies, procedures, and practices,” and must document the asset in the inventory, the SSP and the network diagram. For comparison, under Level 1 Specialized Assets are not part of the assessment scope at all.

Typical timeline phases

The regulation fixes an order, not a calendar. Scope is specified before the self-assessment or certification assessment begins. Assets are then inventoried and classified, treatment is written into the SSP, the network diagram is drawn to match, and only then does assessment against the requirements proceed.

What each category must document

Category	Asset inventory	SSP treatment	Network diagram
CUI Assets	Yes	Yes	Yes
Security Protection Assets	Yes	Yes	Yes
Contractor Risk Managed Assets	Yes	Yes	Yes
Specialized Assets	Yes	Yes	Yes
Out-of-Scope Assets	No documentation listed; prepare to justify why the asset cannot process, store or transmit CUI

External service providers and cloud providers

Table 4 of section 170.19(c)(2) covers external service providers (ESPs). The OSA must consider whether the ESP is a cloud service provider (CSP) and whether it processes, stores or transmits CUI, Security Protection Data (SPD), or both.

CSP handling CUI: “The CSP shall meet the FedRAMP requirements in 48 CFR 252.204-7012.” See NIST SP 800-171 and CUI in university research for how institutions place CUI in a separate environment.
Non-CSP ESP handling CUI: its services are in the OSA’s scope and are assessed as part of the OSA’s assessment.
Handling SPD without CUI: the services are in scope and assessed as Security Protection Assets, whether or not the provider is a CSP.
Neither CUI nor SPD: the provider “does not meet the CMMC definition of an ESP.”

In every case, the use of an ESP, its relationship to the OSA and the services provided must be documented in the OSA’s SSP and described in the ESP’s service description and customer responsibility matrix.

Common mistakes

Treating “not separated” as “not allowed.” Contractor Risk Managed Assets need not be physically or logically separated from CUI assets. The mistake is leaving them undocumented, which removes the basis for the reduced treatment.
Calling an in-scope asset out of scope. The text is explicit that an asset falling into any in-scope category cannot be an Out-of-Scope Asset.
Leaving ESPs out of the SSP. The regulation requires the relationship and services to be documented.

Related scoping rules and pages

Topic	Where it is covered
Level 1 scope (FCI systems; Specialized Assets not in scope)	32 CFR 170.19(b); CMMC Level 1 self-assessment
Level 2 assessment types, scoring and POA&M rules	CMMC Level 2 assessment
Self-assessment score reporting for NIST SP 800-171	SPRS score and NIST 800-171 self-assessment
Program-level obligations for research institutions	CMMC compliance for research institutions

FAQ

Are Contractor Risk Managed Assets separated from CUI assets?

No separation is required. Section 170.19 states they are “not required to be physically or logically separated from CUI assets,” but they must be documented in the inventory, SSP and network diagram, and an assessor may run a limited check if the documentation raises questions.

Do Specialized Assets get assessed?

They are reviewed through the SSP but not assessed against the other CMMC security requirements. The OSA must show they are managed under its risk-based policies, procedures and practices.

How are cloud providers scoped?

A CSP that handles CUI must meet the FedRAMP requirements in 48 CFR 252.204-7012. A provider that handles only Security Protection Data is assessed as Security Protection Assets. A provider that handles neither is not an ESP under the CMMC definition.

Sources

32 CFR 170.19, CMMC scoping, including Tables 3 and 4, on the Electronic Code of Federal Regulations, checked 2026-10-29.
Cornell Legal Information Institute mirror of 32 CFR 170.19, checked 2026-10-29.

CMMC Scoping Guide: The Five Level 2 Asset Categories