CMMC Scoping Questionnaire: Documented Assessment Boundaries for Levels 1, 2, & 3

Define your CMMC assessment scope before your assessor asks about it.

Most CMMC scoping problems don't begin during assessment. They begin earlier, when a boundary is defined inconsistently, when CUI turns up somewhere nobody documented, or when a scope decision has no rationale behind it. By the time your assessor arrives, the boundary is effectively set. Fixing it after that point tends to mean more remediation work, more cost, and a delayed certification.

The CMMC Scoping Questionnaire is a standalone tool built from the DoD CMMC Scoping Guide v2.13 (September 2024), covering Level 1, Level 2, and Level 3. Instead of a checklist, it walks you through your actual environment, using the guide's own scoping logic, and gives you a documented, citable rationale for every scope decision you make.

What's Inside

• Guided questionnaire: 43 questions across 8 sections covering contract and data classification, CUI asset identification, asset category mapping, network separation, external service providers, people and facilities, and Level 2 and Level 3 readiness

• Level determination: Works out which CMMC level applies to your contract, based on your actual data classification, with the reasoning and guide citations shown alongside each answer

• Scoping report: Compiles your asset scope, findings and gaps, a documentation readiness checklist, a review checklist matched to your level, and questions to expect from an assessor

• Built-in reference: A 32-term glossary and contextual help on every question, so you're not cross-referencing the guide separately

• Save-and-reload scopes: Each engagement's answers save to its own file. Reopen any saved scope to continue, revise, or regenerate its report, and hand the file to a teammate to pick up where you left off

It runs completely offline, with no account, subscription, or internet connection required once downloaded.

How It Works

1. Name and describe your proposed assessment boundary and enter your organization details.

2. Work through the 8 sections. The first section sorts out your data classification; later sections check the boundary and surface anything that might expand it.

3. Generate your report, then use your browser's Print function to save it as a PDF or send it to a printer.

Who It's For

Defense contractors preparing for a C3PAO or DIBCAC assessment, CISOs and compliance leads who need a documented boundary before bringing in a third party, and CMMC consultants or RPOs managing scoping across multiple client engagements.

Walk into your next scoping conversation with your boundary documented and every decision cited back to the guide.

FAQ

Is this an official DoD or C3PAO tool?
No. This is an independent decision-support tool that helps you document your proposed scope using the DoD CMMC Scoping Guide v2.13, 32 CFR §170.19, and DFARS 252.204-7012 as reference points. It is not affiliated with, endorsed by, or certified by the Department of Defense, C3PAOs, or DCMA/DIBCAC. Only an authorized C3PAO (Level 2) or DIBCAC (Level 3) can issue an actual certification.

Does this work offline?
Yes. The tool runs entirely as a single self-contained HTML file in your browser. No installation, login, or internet connection is required once downloaded. Reports are generated on the report screen and saved as a PDF through your browser's Print function.

What does the license cover?
Single-organization use, or use by a single consultant across their own client engagements. You can run the tool across as many scopes as you need under your license and share generated reports with your assessor, consultants, or compliance partners. The tool itself may not be resold or redistributed.

How is this different from a template or checklist?
A static template records answers. This tool walks you through the guide's own scoping logic as you answer, so later sections check your boundary against what you entered earlier and surface anything that might expand your scope. It supports documentation and consistency in your scoping decisions. It does not replace professional judgment, a formal assessment, or regulatory review.