The Laptops and Badge System the OSA Wants to Exclude
An OSA is preparing for a CMMC Level 2 assessment. Its CUI is processed in a bounded enclave: 35 Windows endpoints, two file servers, and a SIEM, all on a dedicated VLAN. The company also has: (a) 12 engineering laptops that connect to the enclave through a VPN to review CUI drawings about twice a month; (b) a corporate Microsoft 365 tenant used for email and scheduling, which the OSA says never contains CUI; (c) a facilities team that administers the badge-access system on the same VLAN as the enclave; and (d) a managed service provider that patches the enclave servers using a shared administrative console. The OSA wants to exclude the 12 laptops and the badge system because they are 'not primarily CUI systems.'
1. Categorize the assets and determine what is in the Level 2 assessment scope. Address each of (a) through (d).
Read the worked answer
Conclusion: Do not accept the OSA's exclusion. The laptops and the badge system require evidence-based scoping decisions.
- (a) 12 engineering laptops: These are CUI assets when they access CUI drawings through the VPN. 'Not primarily CUI' is not a scoping category. If they can reach CUI, they are in scope unless the OSA proves access is blocked and the laptops are only contractor risk managed assets.
- (b) Microsoft 365 tenant: If it truly never processes, stores, or transmits CUI and does not provide security protection for CUI, it may be outside the CUI scope. Verify with mail-flow, DLP, data-flow, and interview evidence; do not accept the assertion. If it provides identity or MFA for the enclave, it becomes a security protection asset.
- (c) Badge system: Treat as a specialized asset if it can affect the confidentiality, integrity, or availability of CUI or shares Layer 2 with the enclave. On the same VLAN, it is presumed in scope until segmentation is proven.
- (d) MSP console: A security protection asset because it can administer and patch enclave servers. The MSP relationship also needs to be examined as an external service provider arrangement.
2. What must the assessor require and document before accepting any exclusion of the laptops or badge system?
Read the worked answer
Scope is determined by evidence, not by the OSA's preference.
Require:
- SSP scope narrative and asset inventory that list each asset and its CUI role.
- Network diagrams showing VLANs, inter-VLAN routing, ACLs, and VPN termination.
- Data-flow diagrams for the laptops and the badge system.
- Configuration evidence: VPN client policy, firewall rules, switch configurations, and badge-system network settings.
- A walkthrough or observation showing whether the laptops can reach CUI and whether the badge VLAN can reach the enclave.
Document:
- The inclusion or exclusion decision, the evidence relied on, and the rationale.
- Any residual uncertainty as an assessment issue, not as a silent assumption.
- If an exclusion is not supportable, include the asset and sample from the corrected population. An assessor cannot certify an artificially narrow scope.