Scoping is where a Level 2 effort is won or lost. Every system inside the boundary must meet the requirements and be examined; every system honestly outside it does not. The instinct to say "the whole company is in scope" feels safe and is one of the most expensive decisions a small shop can make.
The test
An asset is in scope when it stores, processes, or transmits CUI — or when it provides security protection for something that does. Applied to a typical shop:
- The CAD/CAM workstation that opens the customer's marked drawing: in scope, almost always, and usually the first one people forget.
- The file share where the engineering folder lives: in scope.
- The ERP or MRP system, if government purchase orders, marked specifications, or technical data live in it: in scope. If it only holds commercial job data, potentially not.
- The CNC control that receives a toolpath derived from a CUI drawing: often in scope, and often the awkward one, because it may not support modern authentication.
- Your firewall, identity provider, and backup system: in scope as security protection assets even though CUI may never sit on them.
- The break room laptop for lunch orders and the quoting PC that never sees a marked drawing: out of scope, if you can show the separation is real.
The lever nobody uses early enough
You are allowed to change the answer. If CUI currently lands anywhere anyone saves it, the boundary is your whole network. If you move CUI into one controlled enclave — a defined set of systems, with access limited to the people who need it — the boundary shrinks to that enclave, and so does the cost of every subsequent step.
Redrawing where CUI is allowed to live is nearly always cheaper than bringing every system in the building up to standard. Do it before you buy tooling, not after.
Legacy machines that cannot comply
Nearly every shop has one: a control running an operating system that has not been supported for a decade, attached to a machine that will outlive all of us. The scoping guidance recognises specialized assets and the answer is not always "replace it". Isolation, documented compensating measures, and an honest entry in your plan are legitimate — provided they are documented and real, and not just a hopeful sentence.
Getting this right is a conversation about your actual shop, not a checklist. It is the first thing our intake interview works through, because everything downstream is priced by it.