CUI Discovery
Six questions about where CUI arrives, where it lands, who handles it and where the paper goes. You answer them before you categorize anything.
Worksheet
Scope it before you secure it.
A CMMC Level 2 asset scoping worksheet for NIST SP 800-171. It sorts every system, service and person in your environment into one of five categories, and makes you say why for anything you leave out.
The categories come from 32 CFR 170.19 and the CMMC Level 2 Scoping Guide. You fill the shaded cells; the formulas and lists stay put.
Why scoping comes first
BEFORE CONTROL ONEScope decides what an assessor looks at. Draw it too wide and you pay to secure and assess systems that never touch CUI. Draw it too narrow and the assessor finds CUI somewhere your system security plan never mentions. Both mistakes are made before the first control is implemented, and both are cheaper to catch on a spreadsheet than in an assessment.
What the tabs do
6 WORKING TABSAsset Inventory
One row per asset. Four yes or no questions, then one category picked from a list. No miscellaneous, no other.
Decision Logic
The five placement steps, in order, ending with the rule that an asset fitting any in-scope category cannot be called out of scope.
External Service Providers
Which outside companies count as ESPs under 32 CFR 170.19(c)(2), and a cloud and non cloud decision matrix.
Out-of-Scope Justification
Mark an asset out of scope and its row stays red until you write down how it is separated.
Summary
Live counts by category, pulled from the inventory as you fill it in.
A Start Here tab sets out the five categories and what each one requires you to produce. The last tab covers the in-kind gap assessments Cyber Grants Alliance offers small defense suppliers, at no cost to them.
Download it
NO CALL REQUIREDWhat it will not do: decide your scope for you, or stand in for legal advice. If you want someone to check the result against all 110 requirements, that is what our CMMC Level 2 gap assessment is for.
Defense supplier under 25 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.