CUI Scoping for CMMC Enclaves: Find Your CUI First

CUI scoping means finding out where your Controlled Unclassified Information actually lives, and who touches it, before you draw your CMMC boundary. If your plan is an enclave, scoping decides whether that plan works. An enclave only shrinks your assessment scope if the CUI is inside it and nowhere else.

That is why FirstCall Federal has partnered with a CUI discovery technology provider whose platform is built to find CUI and other covered defense information across Microsoft 365, file shares and endpoints. We are now offering CUI scoping engagements that pair our CMMC preparation work with automated CUI discovery, so your boundary is based on evidence instead of interviews and best guesses.

What is CUI scoping, and what does CMMC require?

Before a Level 2 self-assessment or certification assessment, you have to specify your CMMC Assessment Scope (32 CFR § 170.19). The DoD's Level 2 Scoping Guide sorts every asset into one of five categories:

• CUI Assets: process, store or transmit CUI. Assessed against all Level 2 requirements.
• Security Protection Assets: provide security functions to the scope, such as identity, SIEM, firewalls and the people who run them. Assessed against the requirements relevant to what they do.
• Contractor Risk Managed Assets: can handle CUI but are not intended to, because of your policies and practices. Documented in the SSP; an assessor can run a limited check.
• Specialized Assets: IoT, OT, government-furnished equipment, restricted systems and test equipment. Documented and managed under your risk-based policies.
• Out-of-Scope Assets: cannot process, store or transmit CUI, provide no security protection, and are physically or logically separated from CUI Assets.

Every in-scope asset goes into your asset inventory, your System Security Plan and a network diagram of the scope. All of that rests on one question most companies answer from memory: where is our CUI? If you are still sorting out what counts as CUI, start with CUI Explained: The Most Confusing Part of CMMC.

Why does scoping matter so much for an enclave?

An enclave is a separate CUI security domain: a GCC High tenant, a dedicated file system or a locked-down virtual desktop where CUI work happens. The Scoping Guide supports this. Separation is how you limit scope.

But the enclave doesn't take anything out of scope by itself. To call your commercial tenant, file server or engineering laptops out of scope, those systems must not be able to process, store or transmit CUI, and you have to be ready to justify that. If a controlled drawing is sitting in a commercial SharePoint site, that site isn't out of scope. It's a CUI Asset you didn't document.

The same places come up again and again:

• Email attachments received before the enclave existed, still sitting in the commercial mailbox.
• CAD files and drawings on engineering workstations and shared drives.
• Old project folders on on-premises file servers.
• Scanned documents and images, which keyword searches can't read.
• OneDrive or desktop sync copies of files that were "moved" to the enclave.

Each one either pulls a system back into scope or weakens the out-of-scope justification an assessor will ask for. The enclave boundary is a claim. The location of your CUI is the evidence. Our post on misdefining your CMMC scope covers what happens when the two don't match.

CMMC Phase 2 is paused. Does scoping still matter?

Yes. On July 13, 2026, the Department of War suspended CMMC Phase II, which would have required C3PAO assessments for Level 2 starting November 10, 2026. Phase I requirements remain in place. Level 2 (Self) still means a self-assessment every three years, an annual affirmation and results entered in SPRS. DFARS 252.204-7012 still requires you to protect CUI.

A self-assessment score is only as good as the scope behind it. If CUI sits outside the boundary you assessed, the score you affirm doesn't describe your real environment. And if you ever have a cyber incident, one of the first questions is whether CUI was on the affected systems. For how to build a Level 2 self-assessment that holds up, see CMMC Level 2 Self-Assessment: A Score You Can Defend.

What does automated CUI discovery add?

Manual scoping relies on interviews and memory. Generic data loss prevention tools tend to bury teams in false positives. The discovery platform we use is built for defense data. It:

• Scans Microsoft 365 (Exchange, SharePoint, OneDrive), on-premises file shares and Windows endpoints.
• Reads the file types CUI actually lives in: PDFs, Office files, CAD, Visio, images, scanned documents, archives and email.
• Looks at markings, distribution statements, headers, footers and cover pages, not just keywords, and rates each finding high, medium or low.
• Runs inside your environment. Scanning agents analyze data in place, so your CUI isn't sent to an outside platform.
• Keeps a scan history and supports scheduled rescans to catch CUI that drifts outside the enclave later.

What does a CUI scoping engagement with FirstCall include?

The platform finds the data. FirstCall turns the findings into a boundary you can document and defend. A typical engagement runs in five steps:

1. Contract and data review. Which contracts carry CUI requirements, what CUI you receive and create, and who handles it.
2. Discovery scans. The discovery platform deployed inside your environment against the repositories we agree to review.
3. Validation. We review findings with your team and confirm what is and isn't CUI.
4. Boundary and enclave design. CUI data flows, asset categories, and a clear call on what has to move into the enclave and what can be documented as out of scope.
5. Cleanup and monitoring plan. A list of misplaced files to move or remove, a spillage procedure and a rescan schedule.

Our team is led by a Lead Certified CMMC Assessor who has worked on more than 30 C3PAO assessments. We prepare you for assessment; we don't assess you. Your Level 2 self-assessment is yours, and certification assessments are performed by independent C3PAOs.

Enclave scoping checklist: can you answer these today?

• Do we have a list of every contract that involves CUI?
• Can we name every system where CUI is stored today, including email and laptops?
• Was that list built from a scan, or from what people remember?
• Is any CUI still in the environment our enclave is meant to exclude?
• Are our Security Protection Assets, and the people who run them, in the asset inventory and SSP?
• Could we justify each out-of-scope system to an assessor?
• Do we have a way to catch CUI that lands outside the enclave next month?

If you answered "no" or "not sure" to two or more, scope first, then build or expand the enclave.

Book a CUI scoping call with Travis. We'll look at your contracts, your current or planned enclave and your SPRS score, then scope what a CUI scoping engagement would cover.

FAQ

What is CUI scoping?

Identifying where CUI is stored, processed and transmitted, and who handles it, so you can define your CMMC Assessment Scope and put each asset in the right category.

Does an enclave automatically reduce our CMMC scope?

No. Systems outside the enclave are out of scope only if they can't process, store or transmit CUI, provide no security function to the scope, and are physically or logically separated. CUI left outside the enclave pulls those systems back in.

Does the discovery scan send our data outside our environment?

No. The scanning agents run inside your environment and analyze data in place, so your data isn't sent to an external platform.

With Phase 2 paused, do we still need to do this?

Yes. Level 2 self-assessments still require you to specify your scope, and DFARS 252.204-7012 still applies. An accurate scope is what makes the score you affirm accurate.

Does FirstCall perform our assessment?

No. FirstCall prepares you. Level 2 self-assessments are performed by your organization, and certification assessments by independent C3PAOs.

Sources: DoD CIO, CMMC Scoping Guide – Level 2, Version 2.13 (September 2024); 32 CFR § 170.19, CMMC scoping; DoD CIO, About CMMC (Phase II suspension notice), dodcio.defense.gov/CMMC/about. Reviewed: October 30, 2026.