Reconcile inventories by matching asset identities and investigating what each system actually does. An inventory label is a claim to test; it does not by itself establish the CMMC assessment boundary.
Learning objectives and ground rules
This paired exercise teaches you to separate identity matching from scope classification, ask about missing data flows and document an unresolved difference. Use fictional records only. One learner acts as the inventory owner and the other as the reviewer. The goal is a reasoned list of questions and corrections, not the fastest way to produce identical spreadsheets.
32 CFR 170.19 describes assessment scope and asset categories. For Level 2, the rule connects relevant asset categories with inventory, SSP and network-diagram treatment. Use the official text for the applicable level; this simplified exercise does not classify a real environment.
Prepare the two fictional lists
List A contains TRAINING-LAP-01, labeled 'employee laptop'; TRAINING-SRV-02, labeled 'project file server'; and TRAINING-SVC-03, labeled 'security monitoring.' List B contains LAPTOP-ONE with the same fictional serial number as LAP-01; SRV-02 marked 'out of scope'; and TRAINING-BAK-04, a backup service absent from List A.
Add a separate fictional workflow note: the file server handles project drawings, the backup job copies its data nightly, and the monitoring service receives security alerts. Do not label the drawings CUI unless the training scenario explicitly supplies that fact and its basis.
Resolve identity before classification
First identify the probable duplicate laptop using the serial number and a supporting record. Document the alias rather than deleting one row without explanation. Then record the server's conflicting labels as an open question. Ask what information it handles and why the lists differ. A confident-looking spreadsheet cell is not supporting evidence.
For the backup service, ask what it receives, where the copy is stored, who operates it and which systems provide the service. The workflow note is a lead for investigation. It should not silently become a complete description of the operating environment.
Write a reconciled result with uncertainty intact
The worked result has one laptop identity with an alias reference, one unresolved server classification, a newly identified backup dependency and a monitoring-service review question. It also lists the people and records needed to answer the open questions. That is a better learning outcome than choosing whichever list has the newer filename.
After adding confirmed facts, check whether the inventory, diagram and applicable SSP description tell a consistent story. Preserve the original lists and the reconciliation decisions. Avoid moving an asset out of scope just to make the diagram simpler or the expected review cheaper.
Self-check and useful next steps
What established the laptop match? A stable identity reference supported by context. What established the server's scope? Nothing yet; the conflicting labels need investigation. Why include the backup question? Because the information flow suggests a dependency missing from one inventory. These answers distinguish an observation, an inference and a verified conclusion.
CMMC Pulsar offers scope and evidence organization workflows that can support this kind of reconciliation. Federal Bid Partners provides advisory support when the business needs help planning readiness work. These affiliated commercial resources do not replace technical investigation or an official assessment. Completing the lab confers no certification or compliance result.
Sources & context
- 32 CFR 170.19: scope and asset treatment
- National Archives CUI Registry
- Related lesson: information and scope
The worked examples and internal registers are editorial teaching aids. Use current official guidance and the actual procurement documents for decisions.
Educational information; not a determination of compliance, award eligibility or certification. Our editorial approach and commercial relationships.