CMMC 2.0 Scoping Guidance Limits the Scope of Cybersecurity Assessments
Client Alert | 1 min read | 12.23.21
The Department of Defense (DoD) recently released the initial guidance documents for Version 2.0 of its Cybersecurity Maturity Model Certification (CMMC) program, including its much-anticipated Scoping Guidance. While the guidance documents generally adhere to the current requirements for the protection of Federal Contract Information (FCI) and Controlled Unclassified Information (CUI), the Scoping Guidance includes notable developments. Chief among them is the introduction of two asset categories — “Specialized Assets” and “Contractor Risk Managed Assets” — that could potentially limit the scope of a contractor’s CMMC assessment, as well as the number and types of assets to be assessed against the applicable CMMC practices.
- Specialized Assets include government property; internet of things (IoT) and industrial internet of things (IIoT) devices; operational technology; systems configured based entirely on government requirements and used to support a contract; and test equipment.
- Contractor Risk Managed Assets include computing resources that are capable of handling CUI but are prevented from doing so by the contractor’s security policies, procedures, and practices.
Contractors expecting to be subject to CMMC should carefully review the Scoping Guidance, as well as the other guidance documents, to determine whether and how they may wish to limit the scope of CMMC’s applicability.
Contacts
Senior Counsel
She/Her/Hers
Insights
Client Alert | 3 min read | 05.02.25
Supreme Court Hears Argument About Uninjured Class Members
On April 29, 2025, the Supreme Court heard oral argument in Laboratory Corporation of America Holdings, dba Labcorp, v. Luke Davis, et al., No. 22-55873. The Supreme Court had granted a petition for writ of certiorari in the case as to the following question: “[w]hether a federal court may certify a class action pursuant to Federal Rule of Civil Procedure 23(b)(3) when some members of the proposed class lack any Article III injury.” The Justices focused much of the oral argument on whether the case was moot, suggesting they may not reach the merits. And when soliciting argument on the merits, the Court appeared divided as to how to answer the question.
Client Alert | 2 min read | 04.29.25
President Trump Issues Executive Order Deprioritizing Disparate Impact Theory of Discrimination
Client Alert | 6 min read | 04.28.25
Client Alert | 3 min read | 04.28.25
