- Scope reasoning starts with the relevant information and asset functions.
- An asset can matter because it protects another asset, even when it does not hold the project file.
- A diagram should show unresolved facts rather than hide them behind a neat boundary.
Learning objectives
This lesson applies the scope-boundaries foundation to a deliberately small fictional environment. You will trace information, identify security relationships, and distinguish a supported classification from a question requiring investigation. The exercise uses selected Level 2 concepts to teach reasoning; it is not a complete scoping methodology or an assessment determination for a real organization. Use the applicable current guidance when undertaking actual scoping work.
- Trace where the fictional information is processed, stored, or transmitted.
- Recognize that an asset's security function can affect its treatment.
- Explain which facts are needed before treating an asset as outside the relevant scope.
Read the puzzle before drawing the boundary
Imagine a training company with four invented components: an engineering workstation, a project storage service, a security gateway, and a visitor network. The workstation and storage service handle synthetic files representing CUI for the exercise. The gateway provides security functions for them. The visitor network is described as separate, but the exercise initially gives no evidence about its actual connections or capabilities.
The Level 2 categories in 32 CFR 170.19 distinguish CUI assets, security protection assets, and other asset treatments. Do not reduce that framework to a rule that only devices containing a file matter. The exercise's task is to identify the relevant questions, then use the supplied facts carefully. An appealing diagram or a department label cannot establish how an asset actually functions.
Trace information and protection separately
Draw one set of arrows for the fictional file's movement and another for security services supporting the environment. Label each arrow with what the exercise says, not what you assume. Then list missing facts: where temporary copies are created, who can access the service, whether a component manages security settings, and what separation means in practice. Treat these as questions rather than silently completing the design from experience.
Next, explain each proposed asset treatment in a sentence. The engineering workstation handles the relevant information; the gateway has a security function; the visitor network's treatment requires facts about its capability and separation. This approach makes the reasoning reviewable. The goal is not to force every component into a category immediately, but to identify what supports the category and what must still be established.
Worked fictional example: the gateway nobody counted
Fictional learner Ben initially draws a boundary around the engineering department because its staff use the project files. He leaves out the gateway because it belongs to another department and does not appear in the project folder. Another learner points to the puzzle's statement that the gateway supplies security functions for the workstation and storage service. Ben revises his reasoning to consider the gateway's role rather than its administrative owner.
Ben also refuses to label the visitor network out of scope merely because its name includes visitor. He asks for evidence of the relevant capabilities and separation. In the next round, the facilitator supplies additional facts about its configuration, and the class discusses how those facts affect the analysis. The improvement is a better-supported explanation, not the claim that one classroom drawing establishes an organization's actual assessment boundary.
Add a change to test your model
Introduce a fifth fictional component: a troubleshooting service that receives selected diagnostic information. Ask what the service receives and whether it provides security functions before deciding how to treat it. Do not assume that a service is irrelevant because it does not receive the main project document. Equally, do not assign a category solely from the word support. The needed facts concern actual data and service functions.
Have a peer challenge one boundary assumption and explain what evidence would resolve it. Keep a short list of confirmed facts and open questions beside the diagram. This teaches learners to separate a working model from a completed determination. For real environments, qualified reviewers must apply the full relevant framework, including specialized assets and external service considerations omitted from this intentionally limited puzzle.
Self-check and answer
Question: A component never stores the fictional project file, so a learner declares it irrelevant to scoping. Which additional question should be asked?
Answer: Ask whether the component processes or transmits the relevant information or provides security functions for assets in the environment. The absence of stored files is only one fact. Its function, capabilities, and connections may still matter under the applicable framework. A strong answer identifies the missing facts and avoids a universal conclusion. It also recognizes that the exercise simplifies a larger scoping process and cannot settle the treatment of a real component without its actual context.
Sources & further learning
Use primary sources and the current requirements relevant to your situation. This guide is a learning resource, not a contract-specific or assessment determination.
Understand what an assessment boundary describes
Build on this guide with a connected concept, then explain how the two ideas fit together.
Continue learningWhen the concept becomes a practical question
Evaluate a readiness tool for organizing scope questions and supporting references; qualified review is still needed to determine the actual boundary.
Explore CMMC Pulsar for readiness planningSelf-checks are educational reflection activities. They do not confer a credential, demonstrate compliance, or establish certification. Read our editorial approach.