What the campaign does—and does not—change
The official campaign promotes practical IT and operational-technology security habits. For CMMC, your contract and the applicable rules still determine the required assessment. Level 1 has 15 FAR safeguarding requirements; Level 2 uses 110 NIST SP 800-171 Rev. 2 requirements. Picking a few basics does not satisfy the remaining objectives.
The official CMMC resources page reports Phase II requirements suspended on 13 July 2026 while Phase I self-assessment requirements continue. That rollout change does not remove NIST SP 800-171, DFARS or SPRS obligations. See the dated CMMC status tracker; this guide does not predict a restart date.
1. Trace a real CUI workflow
Choose one contract workflow. Identify who provides the CUI, how it arrives, who opens it, where it is edited and stored, and how it leaves. Confirm its category using the contract and NARA CUI Registry; do not label every business file CUI or assume missing markings prove it is not CUI.
- Include receiving portals, email, endpoints, shared storage, backups, printers and removable media when they handle CUI.
- Record the people, services and external organizations involved at every handoff.
- Keep uncertain flows on a review list. An unresolved destination is not evidence of exclusion.
2. Classify assets using the Level 2 rule
32 CFR 170.19 and the Level 2 Scoping Guide distinguish five categories. These are asset categories, not five CMMC domains or levels.
- CUI Assets
- Process, store or transmit CUI. Include them in scope and evaluate applicable Level 2 requirements.
- Security Protection Assets
- Provide security functions or capabilities to the assessment scope. Include them even when they do not handle CUI; assess applicable requirements.
- Contractor Risk Managed Assets
- Can, but are not intended to, handle CUI because of policies, procedures and practices. Document them in the inventory, SSP and network diagram and manage the risk. A policy label alone does not prove the boundary works.
- Specialized Assets
- Include OT, IoT, government-furnished equipment and test equipment where applicable. Document and manage them using the rule's specialized treatment; they are not automatically exempt.
- Out-of-Scope Assets
- Cannot process, store or transmit CUI, do not protect CUI assets, and meet the required separation criteria. Keep a defensible rationale for excluding them.
3. Follow the security dependencies
A small enclave can depend on identity administration, endpoint protection, logging, firewalls and an MSP's remote-management service. Ask what each dependency can do to the CUI environment—not only whether its operator opens CUI files.
For each provider, retain a shared responsibility matrix, the exact service boundary and evidence for inherited responsibilities. A cloud service that handles CUI must meet the applicable FedRAMP Moderate or equivalent requirement in DFARS 252.204-7012(b)(2)(ii)(D); a product name alone does not establish that.
Worked example: a 12-person engineering contractor
Fictional preparation example—not verified scope. Four engineers receive CUI drawings through a customer portal and use four managed workstations plus one engineering file service. Eight office laptops are used for other business work.
Customer portal → 4 engineering workstations → 1 engineering file service
Security dependencies: identity service · endpoint protection · firewall/logging service
Separate business environment: 8 office laptops—exclusion still needs evidence
The five engineering assets are CUI Assets. The three listed security services are candidate Security Protection Assets, subject to review of their actual functions and boundaries. The eight office laptops are not automatically out of scope: first test access paths, synchronization, printing and administration. If they can handle CUI but are not intended to, review Contractor Risk Managed Asset treatment instead.
Finding a backup copy of the drawings on a business file share adds a CUI destination. Finding MSP remote access adds a security dependency to examine. The lesson is not “five assets means compliance”—it is that one overlooked path can invalidate a tidy diagram. All 110 Level 2 requirements still need assessment in the applicable scope.
4. Retain evidence that can survive a scope challenge
- Asset inventory: identifiers, owners, categories, locations and the reason for each decision.
- Network and data-flow diagrams: boundaries, trust connections, CUI paths and security dependencies.
- SSP: boundary narrative, service descriptions, responsibilities and relevant implementation statements.
- Actual enforcement records: access settings, separation configurations and dated tests showing that intended exclusions hold.
- Review record: who checked the scope, when, what remains uncertain, and which change requires another review.
Map supporting records to the applicable assessment objectives using the Level 2 Assessment Guide. A diagram exists; settings may support it; a tested access restriction helps defend it. Those are different evidence states. Use the evidence library to investigate weak or missing support.
Limits and your next step
This guide does not establish your contract's required status, verify evidence, assign a final asset category, calculate an official SPRS result or grant certification. Athena Consulting Group, LLC provides preparation—not a C3PAO certification assessment. Public scope-tool results are self-reported drafts.
Run the free Scope Check with non-sensitive asset descriptions. Do not enter CUI. Bring the resulting inventory and unresolved decisions to the person responsible for your assessment boundary.
Source review
Sources checked 21 October 2026: official campaign and launch announcement (1 October 2026); 32 CFR 170.19; Level 2 Scoping and Assessment Guides, version 2.13 (September 2024); DFARS 252.204-7012 and NARA's CUI Registry. Attribution: Doug Majewski, President, Athena Consulting Group, LLC. Next scheduled source review: 21 November 2026, or sooner after an official change.