Worksheet
Do your CMMC scoping homework before you call a provider
Providers quote on the scope you describe. If two of them hear two different versions of your environment, their prices cannot be compared. This worksheet gives you one written version to hand to each of them.
What does the worksheet ask you?
- Where controlled unclassified information comes into your business, and which people handle it.
- What each computer, cloud service, device and person does, so it can go in one of five categories.
- Which outside companies hold your CUI or your security data.
- What you plan to leave out of scope, and how it is kept separate.
What do you bring to the provider call?
A list of assets sorted into categories, a count for each category, and a list of your outside providers. Ask every provider the same questions with our provider questions checklist, and their answers line up side by side.
Not sure you need Level 2 at all? The CMMC level finder takes three questions.
Where do the categories come from?
The five asset categories are defined in 32 CFR 170.19, the CMMC program rule, and explained in the DoD scoping guide for Level 2. Treat it as a planning tool rather than legal advice. Its last tab covers the in-kind gap assessments Cyber Grants Alliance offers, at no cost to you.