CMMC Scoping Questionnaire: Guide-Grounded Toolkit for Levels 1, 2 & 3

Defense contractors and consultants don't lose CMMC assessments on controls. They lose them on scope. Missing assets, undocumented ESPs, and incorrect boundary claims are the findings assessors surface first — before a single control is tested.

The CMMC Scoping Questionnaire is a standalone, browser-based tool built directly from the DoD CMMC Scoping Guide v2.13 (September 2024) — Level 1, Level 2, and Level 3 editions. It guides you through the complete scoping process, derives your applicable CMMC level from your answers, and generates a structured, assessor-aligned scoping report with a guide citation on every finding.

Here's what's inside:

• 41 scoping questions across 8 sections: contract and data classification, CUI asset identification, asset category mapping, network separation, external service providers, people and facilities, Level 2 readiness, and Level 3-specific requirements

• Automatically derived CMMC level (L1, L2, or L3) from a structured Data Determination Gate: not assumed, derived from your answers with rationale and CFR citations shown

• Full scoping report including asset scope classification, findings and gaps, documentation readiness checklist, assessor review checklist scaled to your level, key assessor questions, and an Accuracy and Scope Authority Statement

• Scope-first architecture supporting multi-scope organizations: each run defines one proposed assessment boundary, with Save and Open functionality for handoff across sessions and team members

• Built-in guidance: 31-term searchable glossary, contextual help on every question, validation mode banners, and scope expansion alerts when answers indicate boundary adjustments are needed

• Works completely offline: single HTML file, no installation, no login, no subscription, no server

How It Works:

1. Define your proposed assessment scope in the intake screen: name the boundary, describe it, and enter organization details

2. Work through 8 sections: Section 1 is the Data Determination Gate; subsequent sections validate the boundary and surface indirect CUI exposure

3. Generate your scoping report, print to PDF, or save the in-progress scope as a file for later use or team handoff

Perfect for: RPOs and CMMC consultants managing multi-client scoping engagements, defense contractors preparing for C3PAO or DIBCAC assessment, CISOs and CIOs defining assessment boundaries before engaging a third party, and C3PAO assessors conducting pre-assessment scoping reviews.

Get instant access and walk into your pre-assessment scoping conversation with a documented, guide-grounded scope boundary your assessor can work from on day one.

FAQ:

Is this an official DoD or C3PAO assessment tool? No. This is a decision-support resource grounded in the DoD CMMC Scoping Guide v2.13 — Level 1, Level 2, and Level 3 editions — 32 CFR §170.19, and DFARS 252.204-7012. It supports scoping preparation and documentation. Final certification determinations remain the exclusive responsibility of authorized C3PAOs (Level 2) and DIBCAC via DCMA (Level 3).

Does this cover all three CMMC levels? Yes. The tool covers Levels 1, 2, and 3. Sections and questions are conditionally shown based on your answers: L3-specific content only appears when Level 3 is applicable to your scope.

Can I use this for multiple clients or scopes? Yes. Each run applies to one proposed assessment scope. Use the Save function to export a JSON file per scope and Open to reload any saved scope at any time. There are no seat limits or usage restrictions.

What format is the file? A single HTML file that runs in any modern browser with no internet connection required. The scoping report prints directly to PDF from the browser.

Is this updated for the current guide version? Yes. The tool is grounded in the DoD CMMC Scoping Guide v2.13, September 2024 — Level 1, Level 2, and Level 3 editions, the current versions at time of publication.