CMMCDocs.comHome / Glossary / Out of Scope
Out of Scope
Also known as: OOS ยท Out-of-Scope asset
An asset that has no role in handling, protecting, or supporting the in-scope CUI environment. Out-of-scope assets are not assessed under CMMC Level 2.
Out-of-Scope (OOS) assets are systems, networks, or facilities that have no role in handling, protecting, or supporting the in-scope Controlled Unclassified Information environment. They are excluded from the CMMC Level 2 authorization boundary and are not assessed by the C3PAO.
For an asset to be legitimately out of scope, the contractor must demonstrate: (1) the asset cannot reach the in-scope environment over the network; (2) it does not share infrastructure with in-scope assets; (3) it does not provide supporting services to the in-scope environment; and (4) there is no path by which a compromise of the OOS asset could affect CUI.
Many contractors carve their CMMC scope down by establishing a logically isolated CUI enclave (often a separate Microsoft 365 GCC High tenant or a dedicated network segment) and declaring the rest of the corporate environment out of scope. This is a common and effective scoping strategy.
Stop Googling. Start working.
CMMCDocs has all 110 NIST SP 800-171 Rev 2 requirements built in — with the language, the templates, and the evidence vault you need. Spin up a free demo workspace and click around the way an assessor would.
Get my demo account