CMMC Assessment Process (CAP) Planning and Scoping
Purpose of the phase
Planning and scoping decide what will be assessed before a single artifact is requested. The CAP expects an assessment agreement, a defined and credentialed team, an assessment plan, a documentation request list, and a validated scope. The OSC defines the scope using CMMC scoping guidance; the assessment team validates it. The assessor confirms a boundary - the assessor does not author it.
Asset categories (Level 2)
CUI Assets (process, store, or transmit CUI), Security Protection Assets (they protect CUI assets - firewalls, SIEM, MFA, scanners - and are assessed against the practices that apply to them), Contractor Risk Managed Assets (capable of handling CUI but not intended to; documented and monitored, not fully assessed), Specialized Assets (OT, IoT, test equipment, medical devices), and Out-of-Scope Assets. Every asset must be assigned a category and justified.
Traps
Under-scoping is the classic failure: an "out of scope" laptop that syncs to a CUI share is in scope, and finding CUI or FCI in an excluded asset invalidates the boundary. Over-scoping wastes effort but is not a finding. Watch for diagrams presented as truth - verify segmentation with configuration evidence, not a drawing. Check that the assessment plan, the network documentation, and the policy set name the same systems; drift between them signals an unvalidated scope. Changes discovered mid-assessment require re-planning, not silent acceptance.
Rule of thumb: if an asset processes, stores, transmits, or protects CUI - or can reach it across an unevidenced boundary - it is in scope.