CMMC Level 1 scoping: what your self-assessment covers
Before you assess anything, you decide which systems the assessment covers. The rule is 32 CFR 170.19(b), and the DoD CIO explains it in the CMMC Scoping Guide, Level 1, Version 2.13, published September 2024.
Level 1 scope is every information system that processes, stores or transmits federal contract information (FCI). Anything that never touches FCI is out of scope.
In scope, out of scope and specialized assets
The Scoping Guide defines the three verbs. Process means FCI is used on an asset: opened, entered, edited or printed. Store means it sits on the asset, including on paper. Transmit means it moves from one asset to another, by digital or physical means.
In scope
Systems that process, store or transmit FCI. You assess these against all 15 requirements in FAR 52.204-21.
Out of scope
Systems that do not process, store or transmit FCI. They are not part of the assessment. A virtual desktop endpoint set up so only keyboard, video and mouse signals reach it is also out of scope.
Specialized assets
Assets that can handle FCI but cannot be fully secured: internet of things and industrial IoT devices, operational technology, government-furnished equipment, restricted information systems and test equipment. The Scoping Guide says they are not part of the Level 1 self-assessment and are not assessed against CMMC requirements.
Where FCI usually lives in a small company
The rule tells you to consider the people, technology, facilities and external service providers that handle FCI.
- People: employees who work with drawings, specs or the contract folder, plus anyone outside the payroll with access, such as a part-time bookkeeper or your IT provider's technician.
- Technology: the laptops and desktops that open contract files, your email (Microsoft 365 or Google Workspace), shared drives and cloud storage, phones that get work email, the firewall and Wi-Fi those files cross, and printers or scanners that handle drawings.
- Facilities: the office, shop floor or home office where FCI is used or kept, including paper copies.
- External service providers: outside people, technology or facilities you use for IT or cybersecurity services, such as a managed IT provider.
Machine controllers and other specialized assets
In a machine shop, a CNC controller that loads a part program built from a government drawing holds FCI and usually cannot run antivirus or take regular updates. That is operational technology, a specialized asset, and you do not assess it in your Level 1 self-assessment.
The FAR 52.204-21 clause in your contract does not have the same exception. List these assets anyway, with the FCI each one holds and how you limit who can reach it, such as keeping it off the office network and restricting who can load programs.
Write the scope down before you assess
Level 1 has no scope documentation requirement, and a system security plan (SSP) is recommended but not required. Write one sentence that says what you assessed anyway, such as "All company laptops, our Microsoft 365 tenant and the front office, covering 14 employees," and keep the list of in-scope systems with it. SPRS asks for the assessing scope and the number of employees covered when you enter the result. Our SPRS guide covers that entry step by step.
Then test each in-scope system against the 15 requirements, using the assessment objectives in the CMMC Assessment Guide, Level 1. A requirement is MET only when every applicable objective under it is MET or NOT APPLICABLE. One NOT MET objective fails the whole requirement.
Scoping questions
Is a personal phone in scope if it gets work email?
Yes, if email carrying FCI lands on it, because the phone then stores FCI. Either bring the phone under your policies or keep work email off personal phones.
Do we have to document out-of-scope systems?
No. The Scoping Guide says Level 1 has no documentation requirements for in-scope, out-of-scope or specialized assets. A written scope still helps, because SPRS asks for it and primes ask about it.
Is paper in scope?
Yes, when it holds FCI. Printed drawings and contract documents from a government contract usually do. The physical protection and media protection requirements cover where you keep paper and how you destroy it.
When does a scope change mean a new assessment?
After significant architectural or boundary changes, such as expanding your network or a merger or acquisition. Adding or removing equipment inside the boundary you already assessed does not need a new assessment. The annual affirmation covers it.
Where is the official scoping guidance?
The rule is 32 CFR 170.19(b). The DoD CIO's CMMC Scoping Guide, Level 1, explains it and is on the DoD CIO CMMC documentation page with the CMMC Assessment Guide, Level 1.
Sources: 32 CFR 170.19, CMMC scoping; the DoD CIO's CMMC documentation page, which has the CMMC Scoping Guide, Level 1, and the CMMC Assessment Guide, Level 1 (both Version 2.13, September 2024); and FAR 52.204-21. Checked Nov. 1, 2026. This page summarizes public guidance and is not legal advice.
Templates for the self-assessment
You can do the scoping and the assessment from the DoD guides. If you would rather start from a draft, the CMMC Level 1 Policy Kit has a self-assessment workbook that starts with a scope worksheet, a records workbook with a sheet for specialized assets and seven Word policy templates covering all 15 requirements. It costs $99, and the templates guide you through the process but do not guarantee compliance.
The templates are Word and Excel files you download right after you pay.
Get the kit for $99.00