Scope & CUI boundaries
Follow the information through people, systems, locations, and providers.
Find your next step
RSS feed9 guides
- Scope & CUI boundaries
Is my contract information FCI or CUI?
Marked, or named as CUI in the contract: Level 2, 110 requirements. Other nonpublic contract info is FCI: Level 1, 15. How to tell, and the email to send the prime.
Kyle Fahey - Scope & CUI boundaries
How do I set CMMC scope for a company under 150 people?
Scope is what touches CUI plus what protects it, sorted into five categories the rule defines. How to draw the line, and one 24-person shop's scope, asset by asset.
Kyle Fahey - Scope & CUI boundaries
Should my CMMC scope be an enclave or the whole company?
Build an enclave when a small team's whole CUI job fits inside it. Scope the company when drawings reach estimating, purchasing, and the floor every week.
Kyle Fahey - Scope & CUI boundaries
Does a shared Microsoft or Google tenant put the whole company in CMMC scope?
No, if finance can't reach the engineering files and your admins and apps are in scope. The 20-minute test, and the Sites.Read.All grant most teams miss.
Kyle Fahey - Scope & CUI boundaries
Can employees use personal devices for CUI work?
Yes, through a locked-down virtual desktop. Keyboard, video, and mouse only keeps the laptop out of scope under 32 CFR 170.19. The exact RDP settings.
Kyle Fahey - Scope & CUI boundaries
Which subcontractors, consultants, and MSPs belong in my CMMC scope?
Consultants on your laptops are users. Your MSP is assessed inside your scope. Cloud holding CUI needs FedRAMP Moderate. Subs holding CUI need their own level.
Kyle Fahey - Scope & CUI boundaries
Can one CMMC assessment cover multiple CAGE codes or entities?
Yes, when the entities share one environment run by the same people. SPRS lets you list every covered CAGE in your SAM hierarchy. Separate systems, separate assessments.
Kyle Fahey - Scope & CUI boundaries
How do I map CUI data flows before choosing security tools?
Walk one real job from the day a drawing arrives to the day it's destroyed. Write every hop as one line. Buy tools only for the hops that fail.
Andrew Erne - Scope & CUI boundaries
Can an identity or admin connection bring another system into CMMC scope?
Yes. Anything that can sign engineers in, grant access, or reset their MFA is a Security Protection Asset. The Entra screens to check and the numbers to hit.
Kyle Fahey
