1. Home
  2. |Insights
  3. |CMMC 2.0 Scoping Guidance Limits the Scope of Cybersecurity Assessments

CMMC 2.0 Scoping Guidance Limits the Scope of Cybersecurity Assessments

Client Alert | 1 min read | 12.23.21

The Department of Defense (DoD) recently released the initial guidance documents for Version 2.0 of its Cybersecurity Maturity Model Certification (CMMC) program, including its much-anticipated Scoping Guidance.  While the guidance documents generally adhere to the current requirements for the protection of Federal Contract Information (FCI) and Controlled Unclassified Information (CUI), the Scoping Guidance includes notable developments.  Chief among them is the introduction of two asset categories — “Specialized Assets” and “Contractor Risk Managed Assets” — that could potentially limit the scope of a contractor’s CMMC assessment, as well as the number and types of assets to be assessed against the applicable CMMC practices.

  • Specialized Assets include government property; internet of things (IoT) and industrial internet of things (IIoT) devices; operational technology; systems configured based entirely on government requirements and used to support a contract; and test equipment. 
  • Contractor Risk Managed Assets include computing resources that are capable of handling CUI but are prevented from doing so by the contractor’s security policies, procedures, and practices.

Contractors expecting to be subject to CMMC should carefully review the Scoping Guidance, as well as the other guidance documents, to determine whether and how they may wish to limit the scope of CMMC’s applicability.  

Contacts

Insights

Client Alert | 1 min read | 08.10.26

ASBCA Denies Government Motion to Dismiss, Providing Key Guidance on Contractor Claim Standards Post-ECC International

In Appeal of Bahadir (a C&M case), the Armed Services Board of Contract Appeals denied the government’s motion to dismiss in its entirety, ruling in favor of the contractor on both key issues raised by the government. The case arises from a contract for construction work at Al Udeid Air Base in Qatar, under which Appellant alleged government-caused delay and filed certified prolongation claims using a “windows analysis” methodology. The government moved to dismiss, arguing that Appellant failed to state a sum certain for each of what the government characterized as 38 distinct claims, and separately that four claims had not been properly presented to the Contracting Officer. ...

View All Insights