What is a cybersecurity risk assessment?

A cybersecurity risk assessment is a structured evaluation of your organization's security environment. It identifies vulnerabilities, threats, and risks, then provides clear recommendations to close the gaps. Our assessments are aligned to frameworks like NIST CSF 2.0.

What does a vCISO do?

A virtual CISO (vCISO) provides executive-level cybersecurity leadership without requiring a full-time hire. This includes security strategy, executive-ready reporting, risk oversight, vendor evaluation, and program development — tailored to your organization's size and maturity.

How is Seven Vector different from an MSSP?

MSSPs focus on security operations and tooling. Seven Vector runs the security program — assessment against the framework, readiness, risk and remediation planning, policy and documentation, evidence organization, and executive reporting. Client teams and providers retain responsibility for technical operations and system changes.

What compliance frameworks do you support?

We support readiness across federal, regulated-industry, enterprise, and privacy frameworks. Each engagement is scoped to the client’s applicable requirements.

What industries do you serve?

We work with organizations across defense contracting, healthcare, technology, financial services, and critical infrastructure — any organization that requires structured cybersecurity consulting and clear security direction.

CMMC Level 2 Scoping Guide for Defense Suppliers

Draw a CMMC Level 2 assessment boundary by tracing CUI, classifying assets, and documenting the evidence behind each scoping decision.

To apply this CMMC Level 2 scoping guide for defense suppliers, trace where controlled unclassified information (CUI) is processed, stored, or transmitted, and identify the assets that protect it. Classify assets into five categories: CUI assets, security protection assets, contractor risk managed assets, specialized assets, and out-of-scope assets.

CMMC Level 2 uses the 110 security requirements in NIST SP 800-171 Rev. 2. The asset categories and their assessment treatment come from 32 CFR 170.19 and the CMMC Level 2 Scoping Guide. Your boundary must describe actual operations, not just the network segment labeled “CUI.”

Where should a defense supplier start CMMC Level 2 scoping?

Start with one contract and one real information flow. Your contracts lead identifies the applicable clauses and customer information requirements. Your program lead explains what information arrives, what your team creates, and what leaves. Resolve unclear CUI designations with the contracting activity or customer rather than treating every sensitive business record as CUI.

Next, have the information owner and IT lead trace a representative drawing, specification, or technical report through its actual use:

Receipt: How does the file arrive, and who opens it?
Use: Where is it viewed, edited, printed, or transferred to production equipment?
Storage: Where do working copies, temporary files, archives, and backups reside?
Exit: How is it shared with customers and subcontractors, returned, or destroyed?
Protection: Which identity, monitoring, administration, and physical access systems protect those activities?

Record the assets, owners, locations, connections, and external services involved. Include remote work, removable media, paper records, and recovery operations. A backup restored outside the intended boundary can undo an otherwise sound design.

Your security lead then checks the proposed boundary against the system security plan (SSP). NIST SP 800-171 Rev. 2 requirement 3.12.4 calls for an SSP describing system boundaries, operating environments, implemented requirements, and relationships with other systems.

How do you classify assets in a CMMC Level 2 assessment boundary?

The first four categories remain within the assessment scope, but they receive different assessment treatment. For each asset, record its category and the facts supporting that decision. Resolve overlapping functions before finalizing the inventory.

CUI assets: ordinary assets that handle CUI

CUI assets process, store, or transmit CUI. Examples include engineering workstations, file servers, backup storage, and printers used for controlled drawings. These assets are assessed against the applicable CMMC Level 2 security requirements.

Have the asset owner demonstrate actual use. Evidence can include access permissions, data locations, configuration records, transfer paths, and backup settings. A purchasing label such as “business laptop” means little if an engineer downloads CUI to it.

Encryption protects CUI; it does not by itself make the asset storing that CUI out of scope. Likewise, a remote viewing arrangement needs review of local storage, redirection, printing, screenshots, and the endpoint’s actual processing role.

Security protection assets: systems that protect the boundary

Security protection assets provide security functions to the assessment scope, whether or not they handle CUI. Examples include identity services, network filtering devices, centralized security monitoring, and administrative systems used to enforce security settings.

They are assessed against requirements relevant to the protection they provide. The security lead should document those functions, the protected assets, administrative access, and supporting configurations. Preserve evidence of operation, such as access reviews and monitoring records.

Check security records for CUI. A monitoring system that captures controlled document contents requires more analysis than one collecting security events without CUI.

Contractor risk managed assets: able to handle CUI, but not intended to

Contractor risk managed assets can process, store, or transmit CUI but are not intended to do so because your security policies, procedures, and practices establish otherwise. This category is not shorthand for “everything outside the CUI network.”

Document these assets in the inventory, SSP, and network diagram. Prepare to justify the risk-based policies, procedures, and practices used to manage them. Their assessment treatment centers on the SSP and that justification, rather than automatically applying every requirement as if they were CUI assets.

An example might be a business workstation subject to an established no-CUI workflow. The business owner explains the permitted use; IT shows supporting restrictions; the security lead checks whether employees follow the rule. Routine CUI use contradicts the classification.

Specialized assets: defined asset types with distinct treatment

Specialized assets can handle CUI and include government furnished equipment, Internet of Things devices, industrial Internet of Things devices, operational technology, restricted information systems, and test equipment. A legacy server is not specialized simply because updating it is difficult.

Document specialized assets in the inventory, SSP, and network diagram, and manage them through risk-based security policies, procedures, and practices. The scoping guide directs assessment review of their documented treatment rather than treating them like ordinary CUI workstations.

Your engineering or production owner should explain operating constraints. Your security lead should document protections such as restricted connections, controlled administration, physical access restrictions, and monitored transfers. Retain evidence that those protections operate.

What falls outside a defense supplier’s CUI assessment scope?

Out-of-scope assets cannot process, store, or transmit CUI and provide no security protection for CUI assets. They must be physically or logically separated from CUI assets. An employee instruction alone does not establish that separation.

A separate visitor network may qualify. A shared identity service protecting CUI access does not qualify merely because its servers sit elsewhere. A business workstation that can handle CUI but is prohibited from doing so may fit the contractor risk managed category instead.

Have IT collect evidence supporting exclusion: network diagrams, filtering rules, routing restrictions, access settings, and checks of permitted connections. Although excluded assets are outside the assessment scope, keeping a record of the exclusion rationale helps explain the boundary.

Use NIST SP 800-171 Rev. 2 requirement 3.13.1 to examine how communications are monitored, controlled, and protected at external boundaries and key internal boundaries. A diagram supports the explanation; operating configurations show what the boundary actually allows.

How do shared services affect your CMMC Level 2 boundary?

A small CUI environment can depend on services used across the company. Follow each dependency: identity, remote administration, backups, monitoring, and physical access control. Classify each service by what it does, not by which department pays for it.

For each external service provider, your service owner should establish whether it handles CUI, supplies security protection, or both. Obtain a clear division of security tasks and identify the evidence available for assessment. Contract language alone does not demonstrate that a security requirement is implemented.

If an external cloud service processes, stores, or transmits CUI, check the FedRAMP Moderate authorization or equivalency requirements in the CMMC rules. DFARS 252.204-7012 also imposes cloud requirements when covered defense information is involved. Obtain supporting evidence rather than relying on a general compliance statement.

Check the boundary before scheduling the assessment

Run a boundary review in this order:

Program and contracts leads confirm the CUI flows and applicable contract requirements.
IT and asset owners reconcile the inventory with actual devices, services, storage, and connections.
The security lead checks category decisions against the SSP and network diagram.
Administrators verify access paths, backup destinations, printing, transfers, and separation controls through authorized checks.
Management reviews unresolved gaps, assigns owners, and approves the remediation plan.

For each gap, record the affected asset, missing evidence or protection, owner, and next action. Revisit scoping when contracts, information flows, shared services, or production equipment change. Boundary documentation should match the environment presented for assessment.

How Seven Vector helps

We use Assess, then Build, then Operate. We trace CUI flows and review asset classifications, help close gaps in policies and technical protections, and support ongoing evidence collection and boundary reviews. The work can include a gap assessment, SSP updates, and a remediation plan based on your environment.

Where a Level 2 self-assessment applies, we run the assessment and your senior official signs and submits it. Book a 30-minute initial consultation to discuss your CUI boundary and assessment needs.

Questions

Can we scope CMMC Level 2 to one department?

Yes, if the boundary captures that department’s CUI processing, storage, transmission, and security dependencies. Shared identity, backups, administration, and monitoring may bring assets outside the department into scope.

Are contractor risk managed assets out of scope?

No. They remain in scope with distinct documentation and assessment treatment. You must identify them and justify the policies, procedures, and practices that keep them from being used for CUI.

Does encrypting a backup remove it from scope?

Encryption alone does not remove a backup containing CUI from scope. Review the storage location, transfer path, access controls, restoration destination, and any external service involved.

Is all factory equipment a specialized asset?

Factory location alone does not determine the category. Operational technology and test equipment may qualify, while an ordinary workstation handling controlled drawings may be a CUI asset. Document the equipment’s function and classification rationale.

Call (888) 753-6725. Calls answered 24/7, 365 days a year.