This question deals withasset categorizationduring aCMMC Level 1 Self-Assessment. The organization is manufacturingspecialized partsfor the DoD, butLevel 1of CMMC only concernsFederal Contract Information (FCI)—notControlled Unclassified Information (CUI). Therefore, asset categorization should follow theCMMC Scoping Guidance for Level 1.
✅Step 1: Understand CMMC Level 1 and FCI
Level 1 Objective:
Implement basic safeguarding requirements as perFAR 52.204-21.
Applies to systems thatstore, process, or transmit FCI.
Self-assessments are permitted and required annually.
Source Reference:
CMMC Scoping Guidance – Level 1 (v1.0)
https://dodcio.defense.gov/CMMC
✅Step 2: What is an “In-scope Asset”?
CMMC Scoping Guidance – Level 1definesIn-scope assetsas:
“Assets that process, store, or transmit FCI or provide security protection for such assets.”
In this scenario:
The machining company isperforming contract work(manufacturing DoD parts).
Thetesting is done internally, implying the systems and equipment used in testing and documentation aredirectly supporting the contract.
These systems likely handleFCIsuch as technical specifications, purchase orders, or test reports.
➡️Therefore, the equipment and systems used in testing are consideredIn-scope Assetsunder Level 1.
❌Why the Other Options Are Incorrect
A. CUI Asset
✘Incorrect forLevel 1:
CUI is only in scope atCMMC Level 2 and Level 3.
Level 1 is concerned withFCI, not CUI.
C. Specialized Asset
✘Incorrect definition:
Specialized assets(defined inCMMC Level 2 Scoping) include IoT, OT, ICS, GFE, and similar types of non-enterprise assets that may require alternative treatment.
This classification isnot used in Level 1 Scoping.
D. Contractor Risk Managed Asset
✘Incorrect:
Also defined underCMMC Level 2 Scopingonly.
These are assets that are not security-protected but are managed via risk-based decisions.
This term isnot applicableforCMMC Level 1 assessments.
✅Step 3: Alignment with Official Documentation
According to theCMMC Scoping Guidance for Level 1:
“The assets within the self-assessment scope are those that process, store, or transmit FCI. These assets are considered ‘in-scope.’”
No other asset categorization (such as CUI asset, specialized asset, or contractor risk managed asset) is used atLevel 1.
BLUF (Bottom Line Up Front):
For aCMMC Level 1 Self-Assessment, theonlyasset category officially recognized is theIn-scope Asset— any asset that handles or protects FCI. Since the company's internal testing operations are part of fulfilling the DoD contract, the systems and staff involved arein scope.
