Who Is Actually Inside the Assessment Boundary?
Meridian Engineering is a 90-person firm with CUI in two places: a cloud PLM tool where customer design data lives, and the laptops of 40 engineers who occasionally download drawings. The PLM vendor holds a FedRAMP Moderate authorization. Meridian outsources all endpoint management - patching, EDR, administrative credentials, and help desk - to a 12-person managed service provider, Harbor IT, which operates from its own remote monitoring platform. Meridian's draft system security plan lists only its own 90 laptops and its file server as the assessment boundary, treating the PLM vendor and Harbor IT as out of scope because they are vendors. The consultant's draft boundary memo goes to the board next week; it argues the boundary is fine because FedRAMP covers the PLM tool and the MSP 'never stores CUI.' Meridian's C3PAO assessment is booked in 10 months.
1. Critique the proposed boundary. What must be in scope, and what evidence is needed for each external party?
Read the worked answer
The boundary is drawn around hardware instead of around CUI and the assets that protect it. Scope follows the data.
The PLM SaaS. CUI is stored there, so it is in scope unless Meridian can legitimately inherit the provider's coverage. FedRAMP Moderate is the right baseline - DFARS 252.204-7012 requires CSPs handling CUI to meet security requirements equivalent to FedRAMP Moderate - but a FedRAMP authorization is not, by itself, a CMMC scoping decision. Meridian needs: a current Moderate authorization covering the service actually used; a customer agreement carrying the 7012 obligations (72-hour incident reporting to DoD, US-persons access restrictions, data-location limits, no unauthorised disclosure); confirmation of which Meridian data the provider holds and where; and SSP language showing how each requirement is inherited. Inherited is not the same as ignored.
Harbor IT. Patching, EDR, help desk, and administrative credentials are security-protective services for CUI assets. Harbor IT's remote monitoring platform and its personnel are inside Meridian's boundary, or must hold their own coverage as an external service provider. 'They never store CUI' is not a scoping argument: administrative control of a CUI asset is enough to bring a provider into scope.
Internally, the 40 laptops that occasionally hold drawings, the file server, remote access paths, and every administrative account used to manage them are in scope.
2. Harbor IT refuses to be included in the assessment or to pursue its own coverage. What are Meridian's options and the decision rule?
Read the worked answer
Meridian must choose, and each option carries a real cost:
- Renegotiate. Many MSPs will accept a contractual security addendum - evidence obligations, audit rights, incident notification, restrictions on offshore support staff - even if they will not pursue their own certification. Cheapest path if Harbor IT will sign.
- Re-architect. Bring endpoint management in-house with new tooling and at least one dedicated FTE, so Harbor IT no longer holds administrative credentials or touches CUI assets. Expensive and slow, but clean, and it removes the dependency permanently.
- Replace the MSP with a provider accustomed to CMMC-scoped clients. Migration risk and downtime, but the evidence burden shifts to a party that expects it.
- Do nothing and let the assessor find it. With the assessment already booked in 10 months, that likely produces unmet requirements in the access-control and audit families - a POA&M at best, a failed assessment at worst, and in either case a second fee.
Decision rule: whoever holds administrative control over systems that process, store, or transmit CUI is either inside the assessment boundary or covered by its own assessment. If neither is true, the outcome is not in doubt.
The board memo should be rewritten this week, because the 10-month clock is the constraint and option 2 or 3 cannot be executed in a fortnight.