FCI & CUI Scoping Boundary Assessment

Tap to enlarge

Complete the Identity fields. Each value is validated against the schema before the next step unlocks.

• Scope Name (required)

  scopeName

  Name this assessment so your team can find it later — e.g. 'FY2026 CMMC L2 Assessment'.

• Organization Entity ID (required)

  entityId

  The organisation or system this record is about — lowercase with dashes, e.g. acme-corp-hq. Pick one you have used before, or type a new id to create it.

• Legal Organization Name (required)

  orgLegalName

  The legal name on the contract — not a trading or division name. It is stamped onto every control assessed under this scope.

• CAGE Code (required)

  cageCode

  The 5-character CAGE code from SAM.gov (NCAGE codes for non-US entities are also accepted).e.g. 5H1K2

• UEI (Unique Entity ID)optional

  uei

  The 12-character SAM.gov Unique Entity ID, if you have one.e.g. ABC123DEF456

• Organization Addressoptional

  orgAddress

  The assessed organization's registered address.

• Point of Contact (Name)optional

  pocName

  Who an assessor should contact about this scope.

• Point of Contact (Email)optional

  pocEmail

  Email for the point of contact.

• Your Addressoptional

  userAddress

  The address of the person preparing this assessment, if it differs from the organization address above.

• Target CMMC Level (required)

  targetLevel

  Pick your target level — it sets which practices, families, and CUI questions apply. L1 = 17 practices (FCI), L2 = 110 (NIST 800-171), L3 = 145 (+800-172).

• Assessment Type (required)

  assessmentType

  First assessment (initial), a yearly re-check (annual), or a change since the last one (delta)?

• Assessment Yearoptional

  assessmentYear

  The fiscal year this assessment covers.

• Assessment baselineoptional

  baselineId

  Enter assessment baseline.

• Baseline versionoptional

  baselineVersion

  Enter baseline version.

• Reviewed scope graphoptional

  scopeGraphRef

  Enter reviewed scope graph.

Tap to enlarge

Complete the Assets (CUI) fields. Each value is validated against the schema before the next step unlocks.

• Does this scope process CUI or FCI?optional

  hasCuiAssets

  Check this if the scope stores, processes or transmits CUI or FCI. It opens the data-type and boundary questions.

• CUI/FCI Data Types Processedoptional

  cuiDataTypes

  Add each CUI/FCI category you handle — e.g. CTI, ITAR, PII.

• In-Scope Network Segments (CIDR)optional

  networkSegments

  List the in-scope network ranges, one CIDR per line — e.g. 10.10.0.0/16.e.g. 10.10.0.0/16 192.168.50.0/24

• Enclave Boundary Descriptionoptional

  enclaveBoundaryDescription

  Describe how the CUI enclave is separated from the rest of the network.

Tap to enlarge

Complete the Data Sources fields. Each value is validated against the schema before the next step unlocks.

• Are SIEM Connectors configured? (required)

  hasSiemConnectors

  Choose Yes if a SIEM is wired up to feed evidence.

• SIEM Tool Nameoptional

  siemToolName

  Name the SIEM product — e.g. Splunk, Sentinel, Elastic.

• Are GRC Connectors configured? (required)

  hasGrcConnectors

  Choose Yes if a GRC tool is connected.

Tap to enlarge

Complete the Domain Mapping fields. Each value is validated against the schema before the next step unlocks.

• CMMC Domains In Scope (required)

  domainsInScope

  Select the control families in scope. L1 covers the 6 FCI families; L2/L3 cover all 14.

• Domain Ownersoptional

  domainOwners

  Assign an owner to each in-scope family — one per line, e.g. "AC — Jane Doe".

• Justifications for Excluded Domainsoptional

  exclusionJustifications

  Explain why each excluded family is out of scope. An assessor reads this before accepting the exclusion.

ScreenCMMC › Scope·step 5

Complete the Sign-Off fields. Each value is validated against the schema before the next step unlocks.

• I confirm the CMMC CUI boundary is accurate (required)

  cisoSignOff

  Confirm the boundary is accurate before submitting. This is the signed statement the assessment rests on.