- Scope is grounded in the information, assets and activities involved.
- A diagram must agree with how work actually happens.
- An out-of-scope label needs support from the applicable scoping criteria.
Learning objectives
This lesson introduces the reasoning behind an assessment boundary. You will learn why a company name, office address or product logo cannot define the entire scope by itself. You will practice comparing a diagram with an actual workflow and identifying a connection that needs further review. The goal is to describe the environment accurately enough for responsible people to apply the relevant scoping criteria.
Work with an invented organization and simple boxes. You are learning how to ask and explain scope questions. You are not performing a formal scoping determination for a real assessment or declaring that a particular asset is exempt.
- Explain how information flows inform scope.
- Distinguish a boundary assertion from supporting facts.
- Identify changes that can make a scope description inaccurate.
A boundary describes relationships
A useful boundary identifies the relevant environment and explains its connections. Ask which assets process, store or transmit the information, which provide security functions, which users interact with them and which external services are involved. The applicable CMMC scoping rules contain categories and criteria; a learner should consult those criteria rather than assuming every connected asset has the same treatment.
An organizational chart answers who reports to whom. A network diagram describes technical connections. An assessment scope uses relevant facts about assets and information to establish the environment being evaluated. These views can inform one another, but they are not interchangeable. A department can use several systems, and one shared service can support more than one department.
Test the story against real work
A drawing with a neat line around a project workspace is only the start of an explanation. Ask users how they actually complete a task. Can they download material? Which device displays it? Where do generated outputs go? Who administers the service? Which tools protect it? Compare the answers with the diagram and supporting inventory. A mismatch should prompt investigation rather than a cosmetic change to the line.
Avoid treating scope reduction as a drawing exercise. An excluded asset needs to satisfy the applicable criteria in the real arrangement. If people regularly use it for relevant work, an “out of scope” label does not change that behavior. The educational skill is recognizing the difference between describing a desired architecture and supporting a claim about the current one.
Worked example: a room is not the boundary
In a hypothetical company, the project manager says the secure environment is “everything in the engineering room.” The team discovers that a remote engineer accesses the same workspace, an external provider administers accounts and a shared monitoring service supports security. A printer in the room is used only for unrelated public materials. The room's walls do not explain these different relationships.
The learner redraws the environment around activities and services, with unresolved categories clearly marked. The remote access path, provider relationship and security service need review under the applicable scoping rules. The printer's role also needs factual support rather than an assumption based on location. The revised picture is more useful because it explains what each asset does and what still needs determination.
Practice a boundary challenge
Draw a fictional workspace with two users, an administrative function, a storage service and a security service. Add a statement describing the information handled. Then introduce one change: a new analyst uses a different device, or an application exports a report to another service. Explain which part of the original scope description must be revisited and why.
Ask a partner to challenge one exclusion. Respond with facts about the asset's role and the applicable criteria rather than saying it is too expensive to include. If the scenario lacks enough information, state the missing facts. A defensible learning explanation distinguishes confirmed relationships, intended restrictions and unanswered questions instead of making the diagram appear more certain than the evidence allows.
Self-check and answer
A security service stores no project CUI, so a learner excludes it automatically from the assessment discussion. Is the reasoning complete? Explain which role the learner has overlooked and what should happen next.
Answer: the learner has overlooked that assets or services can provide security functions or handle security-protection data without storing the project's CUI. The applicable scoping framework addresses those roles. The responsible reviewer should examine what the service does and apply the relevant criteria. Absence of CUI storage alone does not answer every scope question. This is a prompt for a more complete analysis, not a statement that all external services receive identical treatment.
Sources & further learning
Use primary sources and the current requirements relevant to your situation. This guide is a learning resource, not a contract-specific or assessment determination.
Follow information through its whole lifecycle
Build on this guide with a connected concept, then explain how the two ideas fit together.
Continue learningWhen the concept becomes a practical question
After practicing the concept, explore whether CMMC Pulsar fits your team’s readiness organization and evidence workflow.
Explore CMMC PulsarSelf-checks are educational reflection activities. They do not confer a credential, demonstrate compliance, or establish certification. Read our editorial approach.