The assessment team is discussing the pre-assessment scope with an OSC.

If an OSC wishes to separate environments that process FCI from those that process CUI, they may pursue two separate CMMC certifications (Level 1 for FCI and Level 2 for CUI). A single certification cannot cover both environments unless all requirements for the higher level are met across the entire enterprise.

Exact Extracts:

CMMC Assessment Guide: “An OSC may choose to undergo multiple CMMC certification activities if they wish to limit scope between FCI and CUI environments.”

“Level 1 applies to safeguarding FCI, while Level 2 applies to CUI; separate certifications may be pursued if the OSC chooses to segregate these environments.”

Why the other options are not correct:

A: A single certification would require all assets to meet Level 2 controls, which may not be the OSC’s intent.

C: Defining scope for FCI only aligns with Level 1, but this does not meet Level 2 certification requirements for CUI.

D: A self-assessment scope only applies to Level 1 assessments, not Level 2 third-party certification.