CMMC Scoping Questionnaire: Documented Assessment Boundaries for Levels 1, 2, & 3

Most CMMC failures don't begin during assessment — they begin earlier, when assessment boundaries are defined inconsistently, FCI and CUI exposure isn't fully understood, or scope decisions have no documented rationale behind them. By the time your assessor arrives, your boundary is effectively set. Correcting scope mistakes after that point can expand remediation work, add cost, and delay certification.

CMMC Scoping Questionnaire delivers 6 interconnected modules covering scope definition, level evaluation, exposure mapping, multi-environment management, and assessor-ready reporting.

What's Inside

• Structured Scoping Workflow: Documents every scope decision with supporting rationale across 41 guided questions in 8 sections covering contract boundaries, FCI and CUI exposure, system categorization, network segmentation, external service providers, and personnel scope.

• Guided Level Evaluation: Suggests a likely CMMC level — L1, L2, or L3 — based on your inputs, referencing public regulatory criteria including 32 CFR §170.19 and DFARS 252.204-7012, with the key factors behind the suggestion shown alongside it.

• Assessor-Ready Scoping Report: Exports a structured report covering your assessment boundary, identified FCI and CUI exposure points, scope gaps, and a validation statement aligned to the DoD CMMC Scoping Guide v2.13.

• Multi-Scope Architecture: Manages multiple contracts or environments as independent, versioned scopes — built for consultants and multi-site organizations who can't track scoping in one flat file.

• Built-In Scoping Governance: Flags potential FCI or CUI exposure as you work and includes a searchable CMMC glossary, reducing inconsistency across scoping decisions.

• Offline-First Deployment: Runs as a single self-contained file with no login or cloud dependency, exporting directly to PDF.

How It Works

1. Enter your organizational context, contract scope, and proposed environment definition to establish your starting boundary.

2. Work through the eight guided sections covering FCI and CUI exposure, system boundaries, network segmentation, external dependencies, and personnel scope — the tool flags inconsistencies as you go.

3. Export your completed scoping report for internal review, consultant collaboration, or pre-assessment alignment with your C3PAO.

Defense contractors, CISOs and compliance leaders, and CMMC consultants or RPOs managing multi-client scoping engagements ahead of Level 1–3 assessment.

Walk into your first assessor conversation with a clearly documented assessment boundary and a recorded rationale behind every scoping decision.

FAQ

Is this an official DoD or C3PAO tool?
No. This is an independent decision-support tool that helps organizations structure and document CMMC scoping decisions. It is not affiliated with, endorsed by, or certified by the Department of Defense, C3PAOs, or DCMA/DIBCAC. Final certification determinations are made exclusively by authorized assessment bodies.

Does this work offline?
Yes. The tool runs entirely as a single self-contained HTML file in modern browsers. No installation, login, or cloud dependency is required. All processing happens locally, and reports export directly to PDF.

What does the license cover?
Single-organization use. You can run the tool across multiple assessment boundaries and environments within your organization, and share generated outputs with authorized assessors, consultants, or compliance partners. The tool itself may not be resold or redistributed as a standalone product or service.

How is this different from a template or checklist?
A static template records answers; this tool applies structured logic to those answers to surface scope dependencies, inconsistencies, and potential exposure areas as you complete the workflow. It supports documentation and consistency in scoping decisions — it does not replace professional judgment, formal assessment, or regulatory review.