Scoping, Asset Categorization, and Boundary Definition
Scope determines the assessment
Scoping answers one question: which assets, networks, and people does the assessment cover? The scope must be documented in the System Security Plan (SSP), an asset inventory, and a network/data-flow diagram. Contractors may reduce scope by segregating CUI into an enclave - but only if the isolation is real, enforced, and documented.
Five asset categories
A candidate must be able to place any asset into one of these buckets:
- CUI Assets - process, store, or transmit CUI. In scope; assessed.
- Security Protection Assets - do not handle CUI but protect assets that do (SIEM, antivirus consoles, authentication servers, boundary firewalls). In scope; assessed against the requirements relevant to the protection they provide.
- Contractor Risk Managed Assets - can but are not intended to process, store, or transmit CUI. Not assessed, but must be inventoried, documented in the SSP, and covered by risk-management policy.
- Specialized Assets - OT/IIoT, test equipment, embedded devices, some government-furnished equipment that cannot be fully secured. Documented in the asset inventory and SSP; generally not assessed.
- Out-of-Scope Assets - cannot process, store, or transmit CUI and do not protect anything that does. Excluded.
Traps
The classic error is treating "must be documented" as "must be assessed." Specialized assets and contractor risk managed assets are documented, not assessed. Another trap is assuming the entire corporate network is in scope by default, or forgetting that security protection assets (which hold no CUI) are nonetheless assessed.
Rule of thumb
Ask three questions in order: Does it touch CUI? Does it protect something that touches CUI? Could it touch CUI if misconfigured? Yes/yes/yes → in scope and assessed; documented-but-not-assessed applies to the risk-managed and specialized middle ground.