Most CMMC Level 2 projects go wrong at the very first step: scope. If you don't know which systems handle Controlled Unclassified Information (CUI), you can't know which systems need the 110 NIST SP 800-171 requirements.

Start with the contract

CUI reaches you through a contract. Look for DFARS 7012, flow-down clauses from your prime, and CUI markings on the documents you receive. Those tell you what data you're protecting.

Follow the data

Once you know what the CUI is, trace where it goes:

Where it arrives (email, file share, a prime's portal)

Where it's stored

Who and what can access it

Where it leaves

Sort your assets

The CMMC Level 2 scoping guidance puts assets into five groups:

CUI assets that store, process, or transmit CUI

Security protection assets that protect those systems, like your firewall, identity provider, or SIEM

Contractor risk managed assets that could reach CUI but are kept from it by policy and controls

Specialized assets such as IoT, OT, test equipment, and government…