How One Shop Built Its CMMC Asset Inventory in a Week

"Document in the asset inventory." That line appears in four of the five rows of the CMMC rule's scoping table.

That inventory is the whole team's job, and the scope it sets is the owner's decision. Each person in the shop knows a piece of where the contract's data goes. Our example follows one shop's team through the week the prime asked for a scope.

What does CMMC scoping require?

You specify your own CMMC scope before any assessment and write it down. Every asset sorts into five categories in the CMMC rule. Each in-scope asset goes into your asset inventory, your system security plan (SSP), and a network diagram. Its category decides how the assessor treats it, from testing against every requirement to a review of your SSP.

A CMMC asset inventory is the list of every asset in your scope, the category each one falls into, and what you keep on file for it. It is one of the three documents the rule names for every in-scope category.

The binding text is 32 CFR 170.19. The DoD Scoping Guide for Level 2 explains it in plainer terms.

Scope decides where the requirements apply. It never shortens the list. A CUI Asset is assessed against all 110 requirements of NIST SP 800-171 Revision 2, the version DoD still assesses.

As of October 2026, DoD has suspended the move to CMMC Phase 2 while it reviews the program. In the meantime, new solicitations may require only Level 1 (Self) or Level 2 (Self). You still specify your scope for a self-assessment, so everything below applies either way.

Scope is a business decision, so the owner makes it

Scope decides what you have to protect, what you buy to protect it, and what the assessor tests. When CUI spreads to more machines, more of them face every requirement.

A tight scope keeps that bill in check. To see how scope shapes the budget, read what CMMC Level 2 costs.

So the owner decides the scope, and the team documents it. In our method, the owner also signs off on the finished list before anyone enters it in SPRS.

Why the team builds the inventory before the SSP and the diagram

Table 3 of the rule names the same three documents for each in-scope category, but it does not set an order.

In our example, the prime's request came in on a Monday. The shop had an old network sketch and a blank SSP template. The owner chose to build the inventory first.

That order is our method too. The SSP boundary section and the diagram get written from the inventory's rows. When one list feeds the other two, the three cannot drift apart.

The boundary section itself comes from requirement 3.12.4 of NIST SP 800-171 Revision 2. It asks for an SSP that describes system boundaries and connections to other systems.

For a self-assessment, you enter your CMMC Assessment Scope in SPRS as a required field. The inventory is the record behind that entry.

For a certification assessment, the Certified Third-Party Assessment Organization (C3PAO) follows The Cyber AB's CMMC Assessment Process (CAP). In CAP Phase 1, the C3PAO reviews your SSP for completeness, accuracy, and consistency, and the lead assessor validates your scope. These CAP phases are separate from the suspended CMMC rollout.

That SSP review checks the paperwork, not whether your controls work. Any disagreement about scope gets settled before the assessment moves past Phase 1.

If the C3PAO finds you are not ready, it cannot advise you on the fix. That work happens before the assessment, and a clean inventory, like the sample below, is where it starts.

The week one aerospace electronics shop built its inventory

The shop in our example builds circuit boards for an avionics prime. Its team is the owner, an in-house IT person, an engineering lead, an office manager, and an outside IT provider. Every detail is invented for teaching.

On Monday morning, the owner read the prime's request and called the team together. Each person took the assets they knew best. The owner kept one job back, the final say on scope.

That afternoon, the IT person started where the prime's drawings first arrived, the cloud email tenant. The engineering laptops came next, because every engineer opened those drawings on one.

On Tuesday, the engineering lead walked one drawing through the shop. It went from a laptop to the PCB CAD workstation, then to the file share that held layouts and fabrication files. The office manager added the ERP, since its travelers carried controlled part data.

On Wednesday, the engineering lead reached the test station in the corner of the lab. It ran tests built from the prime's own procedures, so it handled CUI. It could not be locked down like a laptop, which made it a Specialized Asset.

Walking back, the engineering lead passed the multifunction copier by the engineering door. It scanned drawings straight to the engineering share. Nobody had thought of it as a computer, so it had no row until that afternoon.

Thursday was for the gear that protects everything else. The IT person added the edge firewall and the tenant admin account. The outside IT provider confirmed what its remote management tool reaches.

The office manager listed the front-office printer and the guest Wi-Fi. On Friday, the owner led a review, and after the fixes below, the inventory looked like this.

Asset	What it does with CUI	Category	Who owns the row	Segment and what the entry must show
Cloud email tenant	Receives and sends the prime's drawings	CUI Asset	IT person	Cloud. The tenant, its provider, and the matching lines in the provider's responsibility matrix
Engineering laptops	Open, edit, and store drawings	CUI Asset	IT person	Engineering VLAN and remote. Asset tag, assigned user, and where each one connects from
PCB CAD workstation	Turns the prime's drawings into board layouts	CUI Asset	Engineering lead	Engineering VLAN. Asset tag, assigned user, and local storage
Engineering file share	Stores drawings, layouts, and fabrication files	CUI Asset	Engineering lead	Engineering VLAN. Share path and the groups with access
ERP	Holds travelers that carry controlled part data	CUI Asset	Office manager	Server VLAN. Which modules and users touch contract data
Multifunction copier	Scans drawings to the engineering file share	CUI Asset	Engineering lead	Engineering VLAN. Asset tag and the share it scans to
Tenant admin account	Manages users and settings in the email tenant	Security Protection Asset (our example)	IT person	Cloud. Who holds it and what it can change
Automated test station	Runs board tests built from the prime's test procedures	Specialized Asset	Engineering lead	Test VLAN. The risk-based policy that governs it
Edge firewall	Separates the VLANs and filters traffic	Security Protection Asset (our example)	IT person	All segments. The rules that wall off the engineering and test VLANs
IT provider's remote management tool	Pushes patches and opens remote sessions on engineering devices	Security Protection Asset (our example)	Outside IT provider	Reaches the engineering VLAN. A matching line in the provider's responsibility matrix
Front-office printer	None, by written policy	Contractor Risk Managed Asset	Office manager	Office VLAN. The policy section that keeps CUI off it
Guest Wi-Fi	None	Out-of-Scope Asset	Office manager	Guest VLAN. Why it cannot reach CUI

The category names come straight from Table 3 of the rule. The assets in each row and the owner column are our illustration. Each row has one role next to it, so no row falls between two people.

Reading the finished inventory, row by row

1. Email tenant through the copier. These six rows are CUI Assets. The rule treats "process, store, or transmit" as one defined term. Each of these assets does at least one of the three. The assessor tests them against every Level 2 requirement.
2. Automated test station. The rule names test equipment among Specialized Assets, which can handle CUI but cannot be fully secured. Your entry shows the station runs under your risk-based security policies. The assessor reviews the SSP and does not test it further, but it stays in scope.
3. Tenant admin account, edge firewall, and the remote management tool. These are our examples of Security Protection Assets, because each one provides security functions to the scope. The assessor checks them only against the requirements that fit what they provide.
4. The email provider and the IT provider. Document every outside provider in your own SSP. The provider describes its side in its customer responsibility matrix. Match each SSP line to a line there.
5. Front-office printer. It earns the Contractor Risk Managed label only because written policy and daily practice keep CUI off it. A printer that does print drawings processes CUI and becomes a CUI Asset. The assessor reviews the SSP and may run a limited check if your paperwork raises questions.
6. Guest Wi-Fi. It sits on its own guest VLAN and cannot reach CUI, so it is out of scope. The assessor does not assess it, but keep the justification ready.

The Friday review that caught six weak entries

On Friday, the owner had the team read every row the way an assessor would. Each pair below shows a weak entry from earlier in the week and the fix that went in.

1. The scanner nobody listed. Until Wednesday, the inventory had no row for the copier that scans drawings to the engineering share. The engineering lead's row lists it as a CUI Asset on the engineering VLAN.
2. A risk-managed label with nothing behind it. Thursday's printer row said Contractor Risk Managed and stopped there. The office manager wrote the policy that keeps CUI off the printer, and the row now names that section.
3. An out-of-scope line with no reason. The first Wi-Fi row said "Guest Wi-Fi, out of scope." The office manager added the reason, naming the guest VLAN and the firewall rule the IT person confirmed.
4. Test equipment with no proof of management. Wednesday's station row said "Specialized." The engineering lead's fix points to the procedure for who uses the station, how it connects, and how test data leaves it.
5. A provider tool that appears nowhere. The remote management tool reached every laptop but showed up only in its own row. The IT person added an SSP line, and the outside IT provider confirmed the match in its matrix.
6. Three documents that disagree. The old network sketch had no test VLAN, though the inventory listed one. The IT person rebuilt the diagram and the SSP boundary from the same rows. Then the SSP holds up when the C3PAO checks it for completeness, accuracy, and consistency in CAP Phase 1.

With the six fixes in, the owner read the scope once more and signed off. Every row had a category, a reason, and one role behind it.

Run the same week at your shop

1. The owner picks one CUI contract as the thread, starting with the drawings and specs one prime sends. Then the owner hands each part of the shop to one person.
2. The IT person and the engineering lead list every device, account, share, and tool that contract's data touches, one row each.
3. The IT person adds the assets that protect those rows, such as the firewall, admin accounts, and remote management tools.
4. The whole team sorts each row with one question. Does it process, store, or transmit CUI? That first test is our method, built on the rule's definition.
5. The office manager writes the policy behind each risk-managed row and the reason for each out-of-scope row.
6. The outside IT provider confirms each tool it runs and the matching lines in its customer responsibility matrix.
7. The IT person draws the network diagram and writes the SSP boundary section from the same rows.
8. The owner reviews every row on Friday, settles any scope question, and signs off.

Your shop may split these roles another way. A fractional IT person might take the IT rows, or the owner might also run the office. Keep one role per row either way.

The scope you enter in SPRS comes from these rows

When the rows are done, they become the scope statement you enter in SPRS for a self-assessment.

In our example, the scope went into SPRS the next Monday, after the owner's sign-off. The SSP boundary and the redrawn diagram already matched it, because all three read from the same rows.

That is the work behind the rule's short instruction, "Document in the asset inventory." Five words in a federal rule, and one week of a whole team walking the shop.

InterSec is a Registered Practitioner Organization. The Cyber AB describes an RPO as a consultative firm that does not conduct certified assessments. We prepare you, and the C3PAO assesses. The rule bars any CMMC ecosystem member who consulted to prepare you from taking part in your certification assessment within 3 years.

For more on that split, see what a CMMC consultant can help with.

This article provides general information about CMMC scoping requirements. It is not legal advice. Consult your compliance or legal team for final interpretation of how these requirements apply to your organization.