A laptop, a firewall, a production machine, and a guest Wi-Fi device do not necessarily receive the same treatment during a CMMC assessment. For CMMC Level 2, five asset categories help define what belongs in scope and how it is evaluated.
For a small business, the goal is to keep scope simple, small, and complete. Understand what each asset does before deciding which label fits.
Only need Level 1? Start with FCI
The five-category model below applies to Level 2. Level 1 focuses on systems that process, store, or transmit Federal Contract Information (FCI), with specific exclusions such as qualifying Specialized Assets. Do not add Level 2 classification and documentation requirements to a Level 1-only business. Read CMMC Scoping Explained for Small Businesses and confirm which level your contract requires.
The five CMMC Level 2 asset categories
| Category | What it means | Level 2 assessment treatment |
|---|---|---|
| CUI Assets | Process, store, or transmit Controlled Unclassified Information | In scope; assessed against all Level 2 requirements |
| Security Protection Assets | Provide security functions for the assessment scope | In scope; assessed against requirements relevant to their capabilities |
| Contractor Risk Managed Assets | Can handle CUI, but policies, procedures, and practices establish that they are not intended to | In scope; SSP review, with limited checks when documentation or findings raise questions |
| Specialized Assets | Qualifying assets capable of handling CUI that cannot be fully secured | In scope; SSP review of risk-based management rather than assessment against other requirements |
| Out-of-Scope Assets | Cannot handle CUI, provide no security protection for CUI Assets, and are physically or logically separated | Outside assessment; be ready to justify the exclusion |
The first four categories remain in scope. Source: 32 CFR 170.19, Table 3.
Separate VLANs and CMMC Level 2: what stays in scope?
A separate VLAN does not automatically make an asset out of scope. Classification depends on what information the asset handles, what security functions it provides, and whether separation actually prevents CUI handling. A device can be separated from the CUI network and still access CUI through cloud email, SharePoint, a VPN, or another transfer path.
CRMA means Contractor Risk Managed Asset. These assets can handle CUI but are not intended to do so under established security policies, procedures, and practices. CRMAs remain in scope; physical or logical separation from CUI Assets is not required. They receive different assessment treatment from CUI Assets.
| Asset or situation | Likely category | Why / what to verify |
|---|---|---|
| Backup server on a separate backup VLAN storing CUI backups | CUI Asset — in scope | Storing CUI keeps it in scope regardless of the VLAN. |
| Laptop on an office VLAN opening CUI in cloud email or SharePoint | CUI Asset — in scope | Cloud access still processes CUI. Blocking local server access does not block every CUI path. |
| Firewall on a management VLAN enforcing the CUI enclave boundary | Security Protection Asset — in scope | It protects the assessed environment even if it stores no CUI. |
| SIEM or security monitoring server on a separate security VLAN | Security Protection Asset — in scope, when providing protection without handling CUI | Its security role keeps it in scope. If collected content includes CUI, evaluate CUI handling as well. |
| General office workstation capable of receiving CUI, with established workflows prohibiting that use | Potential CRMA — in scope | Policies, procedures, and actual practices must support the classification. A policy statement alone does not establish out-of-scope status. |
| Qualifying production controller using CUI on an OT VLAN | Potential Specialized Asset — in scope | Verify that it meets the Specialized Asset definition and document its risk-based treatment. An OT VLAN alone does not qualify it. |
| Visitor device on internet-only guest Wi-Fi | Potential Out-of-Scope Asset | Verify separation, inability to handle the organization’s CUI, and absence of a security protection role. Check cloud access and remote access as well as local routing. |
| Printer on a separate printer VLAN receiving CUI print jobs | CUI handling — in scope; evaluate whether Specialized Asset treatment applies | A separate printer network does not remove the protected information it receives or prints. |
| Camera or access-control system on a separate security VLAN | Depends on its role | If it provides security protection for CUI Assets, evaluate it as a Security Protection Asset. If it handles no CUI and provides no such protection, evaluate the out-of-scope criteria. |
| Endpoint used only for a restricted VDI session | Conditional Out-of-Scope Asset exception | The rule recognizes an endpoint configured to allow no CUI processing, storage, or transmission beyond keyboard/video/mouse interaction. Verify the actual configuration; installing a VDI client is insufficient. |
These examples apply the Level 2 scoping rules to common situations; they are not automatic classifications for every implementation.
What becomes automatically out of scope on a separate VLAN?
Nothing solely because it is on a different VLAN. For the general Out-of-Scope Asset category, verify all of the following:
- The asset cannot process, store, or transmit the organization’s CUI.
- It does not provide security protection for CUI Assets.
- It is physically or logically separated from CUI Assets.
- It does not meet an in-scope asset category.
Review and test relevant firewall rules, inter-VLAN routing, identity permissions, cloud applications, VPN access, and file-transfer paths. Retain a practical explanation and validation results to support the boundary. A VLAN name or a “no CUI allowed” policy does not establish these conditions.
Which devices are always out of scope?
There is no blanket exemption by device type. Personal laptops, guest phones, cameras, printers, and production equipment must be evaluated by capability, use, security role, and separation. The restricted VDI endpoint provision above is an explicit conditional exception, not a general exemption for remote-access devices.
For the four in-scope categories, maintain the asset inventory, document asset treatment in the System Security Plan (SSP), and include the assets in the assessment-scope network diagram. In scope does not mean every category receives the same assessment treatment.
Official reference: 32 CFR 170.19(c), Table 3 — CMMC Level 2 asset categories and associated requirements. These examples address Level 2; Level 1 and Level 3 have different scoping rules.
1. CUI Assets: where protected information travels
Illustrative example: An estimator opens a CUI drawing on a laptop, saves a copy to a project repository, and prints it. Investigate the laptop, repository, print path, and paper handling. Do not stop at the original file location.
A personal phone opening CUI email is not exempt because the employee owns it. An encrypted work container is a protection layer, not an automatic exemption for the underlying device. Read our BYOD guidance.
2. Security Protection Assets: what protects the environment
Illustrative example: A security service collects alerts from the company’s CUI workstations. Investigate its role even if its logs contain no CUI. Review security administrators and supporting services as well as appliances.
Security Protection Data can include configurations, vulnerability information, logs, and access credentials. “We only send logs to that provider” does not settle the scope question. For provider examples and assessment responsibilities, read our CMMC External Service Provider guide for MSPs and MSSPs.
3. Contractor Risk Managed Assets: capable, but not intended
Illustrative example: A general office workstation is technically capable of receiving CUI, but established workflows prohibit that use. It may qualify as a Contractor Risk Managed Asset rather than an Out-of-Scope Asset. Actual use and safeguards must support the classification.
This category is not permission to ignore the workstation. It remains in the inventory, scope diagram, and SSP treatment. Physical or logical separation from CUI Assets is not required for this category.
4. Specialized Assets: equipment with distinct constraints
Qualifying types include IoT/IIoT, Operational Technology, Government Furnished Equipment, Restricted Information Systems, and Test Equipment.
Illustrative example: A manufacturer should investigate a production controller using protected specifications. Determine whether it meets the Specialized Asset definition and how its risks are managed. An ordinary laptop does not become specialized simply because replacing or securing it is inconvenient.
5. Out-of-Scope Assets: a defensible separation
Illustrative example: A guest tablet on a separate network may be a candidate if it cannot reach or handle CUI and provides no security protection to the assessed environment. Verify account access, cloud services, and data-transfer paths as well as network rules.
A VLAN name or handbook statement alone does not demonstrate exclusion. The guide also has a narrow VDI endpoint exception for keyboard/video/mouse-only interaction; unrestricted downloads, clipboard transfers, or drive redirection require further review.
What should you document?
For the four in-scope categories, maintain an asset inventory, document treatment in the System Security Plan (SSP), and include the assets in the scope network diagram. Out-of-Scope Assets have no formal documentation requirement under this scoping guidance, but keeping a short explanation and validation results is useful practice.
These category details and assessment distinctions come from the DoD Level 2 Scoping Guide. Level 1 uses its own scoping guide.
A practical starting point for a small business
Walk through one contract workflow from receipt to disposal. List the people, devices, applications, storage, backups, print paths, and providers involved. For each candidate asset, record its owner, purpose, data handled, proposed category, and reason. Resolve uncertainty before finalizing the boundary.
Limit where protected information needs to go, then protect every part of that workflow. Keeping scope manageable starts with business decisions about access and handling.
Need help organizing your CMMC scope?
Business Communication Solutions helps businesses map information flows, review asset classifications, and plan practical safeguards. Explore our CMMC consulting services.
Austin: 512-257-1433
Houston: 281-815-8784
Lampasas: 512-865-4000