FS-OLD on Day Two

The assessor may not do: leave a CUI-bearing asset outside the documented scope because the client finds the schedule inconvenient. Scope integrity is a core assessor responsibility - accepting a knowingly incomplete boundary corrupts the result and misrepresents the organization's status to DoD and to its primes.

The obligation, in order of operations:

1. Verify the facts first. Confirm FS-OLD holds CUI, confirm connectivity, confirm the absence from inventory. Do not act on a supervisor's recollection alone - examine the file system, share configuration, routing, and network evidence. The finding must be evidenced, not reported.
2. Notify the client's point of contact in writing that a potential scope change has been identified, and what it means for the assessment.
3. Assess the impact. FS-OLD touches asset inventory and configuration management, access control, media protection, audit, risk assessment, and vulnerability/patch management - and possibly incident response if the unpatched server was ever compromised. These are not one finding; they are a cluster across practices.
4. Escalate within your C3PAO per procedure before agreeing to any path forward. The lead assessor does not unilaterally absorb a scope change, and does not unilaterally abandon a scheduled assessment either.

'The client asked me to downgrade it' is not a defensible basis for a scoping decision, and 'it's temporary' is a claim about the future, not a fact about the assessment period.

Documentation

• Record the discovery in the assessment record: what was found, how it was found (which interview, which artifact), the evidence collected, the date and time, and the client personnel involved.
• Log the scope change itself as a formal event - original scope, revised scope, approving parties on both sides, and the effect on sampling and interviews already performed.
• Re-open or extend sampling for the practices FS-OLD affects. Evidence gathered before day two is not invalidated, but it is incomplete.

Outcome paths - the assessor does not choose the convenient one:

• If FS-OLD is added to scope and the affected practices fail, those practices are unmet. Whether they can be placed on a POA&M depends on current program rules, which limit POA&M eligibility to certain requirements; some must be fully met at assessment. Do not assume everything can be deferred to a POA&M - check the current list before advising the client.
• If the scope change is material enough that remaining assessment activities cannot be completed credibly in two days, the correct outcome is to pause and re-plan, not to compress and hope. A conditional or deferred result reached through an unexamined boundary is worse than a rescheduled assessment.
• The client retains the right to remediate and return; the assessor's job is to make the record accurate, not to make the client's quarter.

Message to the client (substance, not tone)

• 'FS-OLD is used to store CUI and is reachable from your enclave, so it belongs in the assessment scope. We cannot record it as an observation; observations are for things outside the requirements, not for in-scope assets we chose not to examine.'
• 'Retirement next quarter does not change the assessment period. If you want it excluded, the path is to remove the CUI and the connectivity now, and show us evidence that has been operating.'
• 'Here are the two realistic options: extend the assessment and assess it, or pause, remediate, and reschedule. We will support either; we will not support a boundary that excludes it.'
• Confirm the conversation in writing to the client's authorized representative.

Professional-conduct risks

• Undue pressure. Schedule and fee anxiety is the most common source of compromised judgement. Recognize it explicitly.
• Objectivity. Having already issued some favorable conclusions, an assessor is tempted to protect the earlier work. The record must change if the facts change.
• Independence. The client may later ask for help fixing FS-OLD; that is remediation consulting and is constrained for the assessed organization - route it away from the assessment team.
• Documentation integrity. Whatever is agreed verbally must appear in the record. An undocumented scope change is indistinguishable from a concealed one.