OAK CITY CYBERCMMC 2.0 · CUI boundary decision aidSTART
Before the gap assessment
Your CUI boundary should not be a guessing exercise.
Scoping is where many defense subcontractors stall. Answer seven focused questions to map the systems, people, and data flows that are likely to matter in a CMMC Level 2 assessment.
- 7 QUESTIONSAbout five minutes
- SPECIFICBuilt around CUI flows
- ACTIONABLESystem-by-system summary
No contract documents or sensitive data required.
DATA FLOW / SYSTEM SCOPE
Prime contract + CUI markings
Email, file storage, ERP / QMS
User endpoints + identity services
GENERAL CORPORATE IT · potentially out of scope only when separation is defensible
Preliminary scoping determination
Your CUI environment is likely broader than one application.
Likely in scope
Probable in-scope environment
Turn this preliminary map into a defensible boundary.
In 30 minutes, we can pressure-test the systems, data flows, and separation decisions behind your result.
This decision aid provides a preliminary scoping hypothesis, not a C3PAO determination or legal advice. Final scope depends on contract requirements, data markings, actual data flows, asset configuration, and assessor judgment.