CMMC Scoping Toolkit : Guide-Grounded Questionnaire for Levels 1, 2, & 3

Define your CMMC assessment boundary before your assessor does.

The CMMC Scoping Questionnaire is a standalone, browser-based tool built directly from the DoD CMMC Scoping Guide v2.13 (September 2024): Level 1, Level 2, and Level 3 editions. It guides you through the complete scoping process, derives your applicable CMMC level from your answers, and generates a structured, assessor-aligned scoping report with a guide citation on every finding.

Here's what's inside:

• 41 scoping questions across 8 sections: contract and data classification, CUI asset identification, asset category mapping, network separation, external service providers, people and facilities, Level 2 readiness, and Level 3-specific requirements

• Automatically derived CMMC level (L1, L2, or L3) from a structured Data Determination Gate: not assumed, derived from your answers with rationale and CFR citations shown

• Full scoping report including asset scope classification, findings and gaps, documentation readiness checklist, assessor review checklist scaled to your level, key assessor questions, and an Accuracy and Scope Authority Statement

• Scope-first architecture supporting multi-scope organizations: each run defines one proposed assessment boundary, with Save and Open functionality for handoff across sessions and team members

• Built-in guidance: 31-term searchable glossary, contextual help on every question, validation mode banners, and scope expansion alerts when answers indicate boundary adjustments are needed

• Works completely offline: single HTML file, no installation, no login, no subscription, no server

How It Works:

1. Define your proposed assessment scope in the intake screen: name the boundary, describe it, and enter organization details

2. Work through 8 sections: Section 1 is the Data Determination Gate; subsequent sections validate the boundary and surface indirect CUI exposure

3. Generate your scoping report, print to PDF, or save the in-progress scope as a file for later use or team handoff

Perfect for: RPOs and CMMC consultants managing multi-client scoping engagements, defense contractors preparing for C3PAO or DIBCAC assessment, CISOs and CIOs defining assessment boundaries before engaging a third party, and C3PAO assessors conducting pre-assessment scoping reviews.

Get instant access and walk into your pre-assessment scoping conversation with a documented, guide-grounded scope boundary your assessor can work from on day one.

FAQ

• Is this an official DoD or C3PAO assessment tool? No. This is a decision-support resource grounded in the DoD CMMC Scoping Guide v2.13 (Level 1, Level 2, and Level 3 editions), 32 CFR §170.19, and DFARS 252.204-7012. Final certification determinations remain the exclusive responsibility of authorized C3PAOs (Level 2) and DIBCAC via DCMA (Level 3).

• Does this cover all three CMMC levels? Yes. The tool covers Levels 1, 2, and 3. Sections and questions are conditionally shown based on your answers: L3-specific content only appears when Level 3 is applicable to your scope.

• Can I use this for multiple clients or scopes? Yes. Each run applies to one proposed assessment scope. Licensed per purchase. Not for resale or redistribution.

• What format is the file? A single HTML file that runs in any modern browser with no internet connection required. The scoping report prints directly to PDF from the browser.

• Is this updated for the current guide version? Yes. Grounded in DoD CMMC Scoping Guide v2.13, September 2024: the current version at time of publication.