CMMC scoping decides how big a San Antonio subcontractor’s Level 2 project gets. Every asset lands in 1 of 5 categories under 32 CFR 170.19, and only CUI Assets face all 110 requirements. Your MSP, your security tools, and any cloud holding CUI sit inside the line too. ITAR adds a question CMMC never asks. Start with the drawings and the data flow. Buy tools last.
CMMC scoping for a San Antonio defense subcontractor is the documented decision about which systems, people, and providers can touch CUI, sorted into the 5 asset categories in 32 CFR 170.19. Get that line right and the 110 requirements land on a few machines instead of the whole company.
Scoping sits upstream of everything we do in cybersecurity services in San Antonio, so it’s the part I’d get right first. I’m Uprite’s CTO. Useful CMMC questions aren’t about control numbers. They’re about a laptop.
Does the estimator’s machine count? Shop floor PCs? And the help desk that resets passwords from somewhere else? Each answer moves money. A boundary drawn around 12 engineering seats and a single file share is a different project, with a different bill, from one drawn around 60 users, 3 buildings, and every cloud app anyone ever signed up for.
Scope is the multiplier.
What does CMMC scoping actually decide?
CMMC scoping is the step, required by 32 CFR 170.19 before any self-assessment or certification assessment, where a contractor defines its CMMC Assessment Scope, the set of assets that will be checked against CMMC security requirements. For Level 2, that means placing every asset in 1 of 5 categories, each with its own paperwork and its own assessment rule.
Asset is a broad word. Its definition in 32 CFR 170.4 reaches past hardware and software to people, facilities, and services. A managed service provider’s technician can be an asset. So can your office building.
Some limits come built in. Classified systems are out, according to the Department of War’s CMMC Scoping Guide for Level 2, version 2.13 from September 2024. So are Federal information systems that contractors operate on behalf of the Government, under 32 CFR 170.3(b). Hold onto that second one. Given how much of Bexar County’s defense money buys services, it comes up a lot.
Where does San Antonio’s defense money actually go?
We pulled fiscal 2025 Department of Defense prime contract data for Bexar County from the USAspending.gov API, contract award types only, place of performance in the county, covering October 2024 through September 2025. Net obligations came to $4.96 billion, spread across 1,505 recipients with positive totals.
Median recipient total? Just $196,206. Of those 1,505, a total of 801, or 53.2%, took less than $250,000. Small checks. Lots of them. That’s the population with the least IT staff to spare for a 110-requirement program.
By buyer, the Department of the Air Force awarded $1.66 billion of it, 33.4%, and the Defense Logistics Agency $1.43 billion, 28.9%. Third came the Defense Health Agency, at $879.3 million or 17.7%, then the Army at $645.1 million. What they bought matters more.
| What DoD bought in Bexar County, FY2025 | Net obligations | Share of county total | The scoping question it raises |
|---|---|---|---|
| Refined fuel (NAICS 324110) | $1.19B | 24.0% | Usually FCI at most. Is any CUI on your systems at all? |
| Computer services (4 NAICS 5415 codes) | $1.01B | 20.4% | Whose system holds the CUI, yours or the government’s? |
| Engineering services (NAICS 541330) | $332.1M | 6.7% | Which CAD seats and file shares open marked drawings? |
| Aircraft, engine, and parts manufacturing (NAICS 336411, 336412, 336413) | $221.1M | 4.5% | Which test equipment and shop systems count as Specialized Assets? |
| Physical and engineering research (NAICS 541715) | $133.3M | 2.7% | Does the lab network share anything with the office network? |
Figures are net obligations from the USAspending.gov API for award types A through D, October 1, 2024 through September 30, 2025, pulled in October 2026. That right-hand column is our framing, not a government classification.
Houston looks nothing like this. When we ran the same pull for our Houston CMMC scoping guide, fuel was 61% of Harris County’s defense money. In Bexar it’s 24%, and computer services alone is 20%. Strip fuel out entirely and professional, scientific, and technical services, NAICS sector 54, make up 47.9% of what’s left.
That shifts the first question. A Houston valve shop’s first question is whether it holds CUI at all. A San Antonio IT or engineering services firm asks something harder, and it asks it about specific machines. Where does the CUI actually live, on our equipment or on theirs? Sometimes both.
Is it FCI or CUI, and how do you tell?
Federal Contract Information puts you at Level 1, the 15 basic safeguarding requirements in FAR 52.204-21. Controlled Unclassified Information puts you at Level 2, the 110 requirements in NIST SP 800-171 Revision 2. Scope sets that budget.
Paper is the fastest tell. NARA’s CUI Registry says Controlled Technical Information is marked with distribution statements B through F under DoD Instruction 5230.24, with the banner CUI//SP-CTI. Export Controlled material, ITAR technical data included, carries CUI//SP-EXPT. San Antonio’s medical defense work brings a third, Health Information, banner CUI//SP-HLTH.
Find where those markings land. A marked print on the shop office desk, a PDF sitting in a project manager’s inbox, a drawing someone synced to a phone. All of it counts. Each of those systems is a CUI Asset the moment the file touches it, and the regulation’s definition of process, store, or transmit covers paper documents in a filing cabinet too.
Encrypting it changes nothing. Encrypted CUI keeps the control designation of its plain text version until it’s formally decontrolled, according to the Department of War’s CMMC FAQ. Ciphertext is still CUI.
How do the 5 asset categories sort a San Antonio shop?
Level 2 sorts assets into CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets, and Out-of-Scope Assets. Two get tested against requirements. Two get reviewed mostly through your System Security Plan. One just needs a justification.
| Asset in a typical San Antonio subcontractor | Likely category | What the assessor does with it |
|---|---|---|
| Engineering laptops and the file share that hold marked drawings | CUI Asset | Assesses it against all Level 2 requirements |
| Your MSP’s remote management tool, the SIEM, and the people who run them | Security Protection Asset | Assesses the requirements relevant to the security function it provides |
| Front office PCs that could reach CUI but are barred by written policy | Contractor Risk Managed Asset | Reviews the SSP, with a limited check if the documentation raises questions |
| CNC controllers, engine test equipment, and government furnished laptops | Specialized Asset | Reviews the SSP and doesn’t assess other requirements |
| A guest Wi-Fi network firewalled off from everything that handles CUI | Out-of-Scope Asset | Nothing, as long as you can justify why it can’t touch CUI |
Likely, because the facts decide. Every in-scope category carries the same base paperwork under Table 3 of 32 CFR 170.19(c)(1). Each asset goes in the asset inventory, its treatment goes in the SSP, and the whole boundary appears on a network diagram of the CMMC Assessment Scope, which the scoping guide says is there to drive the pre-assessment conversation.
Read the Security Protection Asset examples closely. Examples in the scoping guide include consultants who provide cybersecurity service, managed service provider personnel who implement system maintenance, hosted VPN services, security operations centers, and the office building you work out of. Physical security is part of the boundary whether or not anyone drew it on the diagram. Doors count.
Where do Contractor Risk Managed Assets save money?
Read that row slowly. These are assets that can touch CUI but aren’t intended to, because of the security policy, procedures, and practices you have in place. And the rule says plainly that they don’t have to be physically or logically separated from CUI Assets. No second network required.
For a 30-person San Antonio firm that can’t afford a second network, that’s the whole game. Your assessor reviews the SSP. If it’s sufficiently documented, those assets aren’t assessed against the other requirements, and if something raises questions, the assessor can run a limited check that the regulation says shall not materially increase the assessment’s duration or cost.
Documentation is the catch. A CRMA that isn’t written up isn’t a CRMA. It’s a CUI Asset with missing paperwork.
What counts as a Specialized Asset?
Five types qualify. Government Furnished Equipment, IoT and IIoT devices, Operational Technology, Restricted Information Systems, and Test Equipment, which the scoping guide illustrates with oscilloscopes, spectrum analyzers, power meters, and special test equipment.
Picture an engine shop near Port San Antonio, where, by the Port’s own count, more than 80 tenant customers employ 19,000 people across the 1,900-acre Tech Port campus on the old Kelly Air Force Base. Its test benches, the controllers on its CNC machines, and a fielded system replica built to a government configuration are all Specialized Assets. They stay in scope. You document them in the SSP, show they’re managed under your risk-based policies, and the assessor doesn’t test them against the rest of the requirements.
Some can also be an Enduring Exception. Under the 32 CFR 170.4 definition, Specialized Assets and GFE may be, documented in the SSP with no operational plan of action required. Good news for a 1990s engine test controller nobody can patch.
Do you need an enclave, or just a cleaner boundary?
Separation is required only for Out-of-Scope Assets. An enclave is one way to get there, a smaller CUI boundary that can still inherit enterprise tools, but encryption by itself doesn’t create the separation.
Both definitions are short. Logical separation stops data transfer between connected assets using non-physical means, such as firewalls, routers, VPNs, and VLANs. Physical separation means no connection at all, wired or wireless, so data only moves by hand. Think USB drive. Then the FAQ closes the loophole people try first. Encryption alone doesn’t create logical separation, it says, because it doesn’t stop data transfer or enforce the boundary.
An enclave doesn’t have to rebuild everything inside it, either. According to the scoping guide, requirements can be met by people, processes, or technology that serve the whole enterprise, and it uses a central anti-malware tool as its example. That tool can come in. So can the IT staff who maintain it and its management server. The rest of enterprise IT doesn’t come in automatically.
Two FAQ answers shrink a boundary legitimately. If CUI is properly encrypted before it leaves an otherwise logically separated enclave, the enterprise network gear it crosses stays out of scope. And a laptop reaching a virtual desktop can be Out-of-Scope when the VDI passes only keyboard, video, and mouse data, blocks copy, paste, file transfer, and printing, and uses multifactor authentication that’s separate from the unmanaged device, such as a hardware token. That last part matters.
For an engineering firm with people working from home in Schertz, Boerne, or New Braunfels, that VDI route can cost less than hardening every home laptop. It can also fail quietly. Let the session map a local drive and that laptop is a CUI Asset again. Check the settings twice.
Are your MSP, your SOC, and your cloud in scope?
They are, whenever they store, process, or transmit your CUI or your Security Protection Data. Any provider doing that is an External Service Provider. Its services land inside your assessment scope, while a cloud provider holding CUI is held to FedRAMP Moderate or an equivalent standard instead.
Table 4 of 32 CFR 170.19(c)(2) sorts them into 4 cases.
- A cloud provider that holds CUI has to meet the FedRAMP requirements in DFARS 252.204-7012.
- An MSP holding CUI on its own non-cloud systems gets assessed as part of your assessment, and the FAQ says it doesn’t need its own certification.
- Logs, scans, configs, passwords. That’s Security Protection Data, and any provider handling it is assessed as a Security Protection Asset.
- Your payroll SaaS? Usually not an ESP at all, since the scoping guide says HR and accounting apps typically touch neither CUI nor security data.
That includes us. If Uprite runs your help desk and an MSSP runs your security tools, the FAQ says both qualify as ESPs and get assessed inside your scope, even if neither ever sees a CUI file. Same for a SOC watching your logs, our own managed security services in San Antonio included. Ask every provider, us too, for a customer responsibility matrix that says who owns each requirement, because 170.19(c)(2)(ii) expects the relationship documented in your SSP and described in the provider’s own service description and matrix.
Cloud rules are stricter than they sound. DFARS 252.204-7012 makes you require any cloud provider storing covered defense information to meet security requirements equivalent to the FedRAMP Moderate baseline. A December 21, 2023 DoD CIO memo then defines equivalent narrowly, as 100% compliance with the latest FedRAMP Moderate baseline, verified by a FedRAMP-recognized third party assessor, with no open plan of action items left from that assessment. And the FAQ shuts the obvious workaround. A cloud that isn’t FedRAMP Moderate or equivalent can’t store your CUI even when it’s encrypted.
So check which Microsoft cloud you’re actually on. Microsoft’s own DFARS compliance page lists GCC, GCC High, and DoD in its applicability table. A commercial tenant, the kind that comes with a standard Microsoft 365 Business plan, isn’t on that list. Check yours. An enclave sitting beside a commercial tenant only works if the CUI lives in a cloud that clears that bar. So the first question about any enclave product is simple. Whose cloud holds the encrypted files, and where’s its FedRAMP listing or its equivalency body of evidence?
Your side of the connection still counts. Under 32 CFR 170.16, the on-premises gear that connects to the cloud offering is part of your assessment scope, and the provider’s customer responsibility matrix has to be documented or referenced in your SSP.
One more distinction. If the tenant is licensed to your company, your MSP isn’t a cloud service provider even when it resells the licenses. If the MSP contracts with the cloud provider and modifies the service, the FAQ says it may be one, with the FedRAMP obligations that come with that.
Who is allowed to see an ITAR drawing?
US persons, and foreign persons only with an export authorization. Showing technical data to a foreign person inside the United States is a deemed export, and giving one a password that opens unencrypted technical data can count as a release.
Those rules are blunt. 22 CFR 120.50(a)(2) treats releasing technical data to a foreign person in the United States as an export. 22 CFR 120.56 says release includes using access information to let a foreign person view unencrypted technical data, and providing that access information needs authorization when it would enable that access, even if the file itself never leaves Texas. CMMC never asks. ITAR does.
Put that in IT terms. An admin password is access information. So is a decryption key, or the password vault your help desk opens every morning. If the people holding those credentials include foreign persons, your problem isn’t only CMMC scope anymore. It’s export control.
There’s a narrow carve-out. 22 CFR 120.54(a)(5) says sending, taking, or storing unclassified technical data isn’t an export if it’s secured with end-to-end encryption using FIPS 140-2 or successor modules, or something at least as strong as AES-128, and it isn’t intentionally sent to or stored in a country listed in section 126.1. The rule’s own definition of end-to-end adds that the means of decryption can’t be provided to any third party. A cloud that holds your keys doesn’t fit that. Keys decide it. None of this is legal advice, and classification and licensing calls belong with export counsel.
Microsoft’s ITAR compliance page lists only its GCC High and DoD environments, and says its ITAR commitments on where data is stored and on limiting access to US persons require an additional signed agreement. That’s the practical reason GCC High comes up whenever ITAR does. For the plant side of an ITAR shop, the controllers and the shop floor network, our manufacturing IT services in San Antonio page covers how that environment fits around the boundary.
Does CMMC cover the JBSA systems your staff work on?
No, not the government’s own systems. CMMC doesn’t apply to Federal information systems that contractors operate on behalf of the Government, but your company laptops, email, and file shares come back into scope the moment CUI lands on them.
That distinction does real work in a county where computer services drew $1.01 billion in a single year. Take a contractor whose staff administer an Air Force system on a government network at Joint Base San Antonio. That system runs under the government’s own security rules, outside CMMC. That boundary belongs to them. Its corporate Microsoft tenant, where a project manager saves a CUI-marked status report at 9 p.m., is CMMC territory. One employee can straddle both.
Government Furnished Equipment sits in between. By the scoping guide’s definition, GFE is equipment owned or leased by the government, including contractor-acquired equipment built to government specifications or configurations, and it’s a Specialized Asset when it sits in your environment.
Health work follows the same pattern. Of the Defense Health Agency’s $879.3 million in Bexar County, $573.0 million, or 65.2%, went to computer services, software, and hosting codes, against $108.1 million, or 12.3%, for hospital and health practitioner codes. So a DHA contractor faces the same split. Running a DoD health system for the government sits outside CMMC. Keeping CUI-marked Health Information on your own laptop doesn’t.
Staffing is the last wrinkle, and it cuts both ways. An ESP used purely as staff augmentation, where your company supplies all the processes, technology, and facilities, doesn’t need a CMMC assessment, per the scoping guide. If you place people with a prime, or bring people in from a staffing firm, know which side of that sentence you’re standing on.
What did the Phase 2 pause change about scoping?
Nothing in the scoping rules. July’s pause stopped third-party Level 2 and Level 3 assessments from being written into contracts, while Level 1 and Level 2 self-assessments, DFARS 252.204-7012, and the 32 CFR 170.19 scoping requirements all stayed exactly where they were.
A July 13, 2026 memo from the Department of War CIO suspended the Phase 2 transition that had been set for November 2026 and held pending CMMC milestones in abeyance. Its implementing memo told program managers to designate only Level 1 (Self) or Level 2 (Self), and said the Department would enforce NIST SP 800-171 Revision 2 through self-assessment and select government-led assessments. When we checked the DoW CIO’s CMMC page in October 2026, it still described implementation as paused in Phase 1. Our CMMC 2.0 timeline for Texas contractors tracks the rest.
Self-assessment makes scope more personal, not less. Your affirming official signs for the boundary you drew. In writing, every year. Under DFARS 252.204-7021, you may only process, store, or transmit FCI or CUI on contractor information systems that hold the required CMMC status, and the FAQ adds that any company system not represented by the CMMC unique identifiers in your proposal is considered non-compliant and can’t be used for FCI or CUI during the contract.
That makes your scope a fence in the contract, not just a drawing. Draw it carefully.
One version note. NIST withdrew SP 800-171 Revision 2 on May 14, 2024, when Revision 3 came out, yet DoD still assesses against Revision 2 under a class deviation. You can build to Revision 3 using DoD’s organization-defined parameters, the FAQ says. Your score is still kept against Revision 2.
What should a finished scope file contain?
A finished Level 2 scope is a short stack of documents, not a whiteboard photo. These are the pieces an assessor, a prime, or your own affirming official can reasonably ask to see.
- An asset inventory that tags every asset with 1 of the 5 categories.
- A network diagram of the CMMC Assessment Scope, showing the boundary and everything that crosses it.
- SSP text explaining how your Contractor Risk Managed Assets are kept away from CUI, and how each Specialized Asset is managed when it can’t be fully secured.
- Every ESP, listed with its customer responsibility matrix. For any cloud holding CUI, add its FedRAMP Moderate listing or its equivalency body of evidence.
- One sentence per Out-of-Scope Asset explaining why it can’t touch CUI.
- For ITAR work, a list of who holds admin and key access, and whether each person is a US person.
- A change trigger. The scoping guide says significant boundary changes, like a network expansion or an acquisition, require a new assessment.
Seven items. None of them is a firewall purchase.
When you’re ready to do the work rather than scope it, our page on CMMC compliance in San Antonio covers the gap assessment, the enclave build, and the documentation behind it. We’re a team of 42 with an office on Radium Street, and we build and run the environment. We’re not a C3PAO, and we don’t certify anyone.
Not sure which category your shop floor PC, your MSP, or your cloud drive belongs in? Talk it through with our San Antonio team before anyone buys a tool, starting with what’s in, what’s out, and what has to be written down.
Talk Through Your ScopeWhat San Antonio Subcontractors Ask About CMMC Scope
Is our MSP inside our CMMC scope even if it never sees CUI?
Yes, if it handles your Security Protection Data, which covers logs, configuration data, vulnerability status, and the admin passwords for in-scope systems. An MSP and an MSSP in that position are both ESPs under the DoW FAQ, assessed inside your scope without needing their own certification.
Can the front office stay out of scope without a separate network?
Not out of scope, but out of most of the testing. Front office PCs barred from CUI by documented policy can be Contractor Risk Managed Assets, which need no separation, and the assessor mainly reviews your SSP for them, with only a limited check if something raises questions. Write the policy down first.
We work on government computers at JBSA. Does CMMC cover those?
Those government systems sit outside CMMC under 32 CFR 170.3(b), because they’re Federal information systems you operate on behalf of the Government. Your company laptop, email, and file shares are different, and they come into scope as soon as a CUI file lands on them.
Does encrypting our files take the cloud drive out of scope?
It doesn’t. Encrypted CUI is still CUI, and the DoW FAQ says a cloud that isn’t FedRAMP Moderate or equivalent can’t store it.
Our shop machines ITAR parts. What changes in the scope?
Two things change, who can see the data and where it can sit. Under 22 CFR 120.50 and 120.56, showing technical data to a foreign person in the United States, or handing one an admin password or key that opens unencrypted technical data, can be an export or a release, so the scope has to track people as well as machines. Storage changes too. Commercial cloud only qualifies under the 120.54(a)(5) carve-out when the encryption is truly end to end with FIPS 140-2 compliant modules, and Microsoft lists only GCC High and DoD on its ITAR page, with a separate signed agreement for its US person commitments. Pull the drawings, list every account that can open them, and check each name before you design anything.
What happens to our scope if we open a second location or buy another shop?
Plan on a new assessment. Significant architectural or boundary changes require one, the scoping guide says, and it names network expansions and mergers and acquisitions as examples, while routine changes inside the existing boundary that follow your SSP can be carried by the annual affirmation.
