CMMC Scoping Boundary Builder

Step 1 — CUI handling

CUI is received or sent via email (e.g., controlled drawings, specs, technical data) CUI is stored in file shares, SharePoint, or a document management system CUI appears in ERP, MES, or business systems (part numbers, program data linked to controlled work) CUI is opened or edited in CAD/CAM or design software CUI is printed or handled as hard copy CUI is stored or processed in a cloud service (SharePoint, OneDrive, Box, etc.)

Step 2 — Access and remote work

Users access CUI systems remotely via VPN or remote desktop CUI may be accessed from mobile devices (phones or tablets) External collaborators (customers, primes, subcontractors, suppliers, or consultants) access your CUI systems or receive CUI files An MSP or IT service provider has admin access to systems that process CUI

Your Draft Scope Boundary Summary

Email me a result follow-up

Systems likely IN SCOPE

Systems likely in scope as Security Protection Assets

External relationships to document

Scope reduction opportunities to evaluate

Documentation you must produce

Recommended next steps

Recommended next step

What this result means Your answers create a draft boundary hypothesis. Use it to confirm CUI flows, inherited service roles, and scope-reduction options before remediation spend.

Recommended package Compare CMMC packages and start with the Scope Sprint path when the boundary is still uncertain.

Related asset CUI Scoping Pack gives you inventory prompts and boundary memo structure. Request it by email.

Related article CMMC Scoping and Boundary Guide explains the asset categories behind this result.

Talk to us Book a scope call to review the draft boundary before remediation.

Reviewed: July 2026 by Velocity CMMC.

Updated: July 21, 2026.

Sources: DoD CMMC Level 2 Scoping Guide; 32 CFR Part 170; NIST SP 800-171 Rev. 2; Cyber AB role distinctions.

The tool provides planning guidance and does not determine official assessment status or replace legal/compliance review.

Your actual assessment boundary must be documented in an SSP and reviewed against your contracts, CUI flows, and service-provider responsibilities.