Define the smallest defensible scope for your CUI.
Most contractors work backwards — secure everything first, then try to work out what was in scope. This workbook does the opposite. Your NIST SP 800-171 obligations apply to the systems that touch CUI, so where you draw that boundary is the single biggest lever on what compliance costs you.
Scope first. Then controls.
Get the workbookA complete scoping methodology, not a checklist.
Every page earns its place. This is what you work through, in the order you work through it — ending with a boundary you can actually defend to a prime, an assessor, or your own leadership.
The scoping philosophy
Four principles that separate a defensible scope from a bloated one — and why “we’ll just secure everything” is the most expensive decision on the table.
CUI asset categories reference
All five categories — CUI Asset, Security Protection Asset, Contractor Risk Managed Asset, Specialized, and Out-of-Scope — with how each gets treated and where teams routinely misclassify.
CUI inventory with worked example
A ten-row fillable inventory, plus a complete sample showing how a small engineering firm documented its actual CUI footprint.
Boundary sketch and segmentation
Space to draw your enclave, the technical controls an assessor will probe, and the three shared services that quietly break most boundaries.
Flow-down and third-party scoping
How DFARS 252.204-7012 extends your scope to subcontractors and external service providers, with a worksheet to map every third party that touches your CUI.
Red flags and readiness gates
Six things we hear right before a scope falls apart — plus the documentation gates to clear before you affirm, and before anyone external looks at it.
From the workbook · page 2
“Every asset you add to scope multiplies your documentation, your monitoring, and your assessment burden. Contractors who cut scope by half routinely cut their first-year cost by more than that.”
Scope is leverage — use it.
Download your copy.
A fillable PDF — print it, share it with your team, or work through it on screen. You’ll get a download link immediately and a copy in your inbox within two minutes.
Built by practitioners, not marketers
Greypike is a veteran-founded firm working exclusively with government contractors, led by a Cyber AB Registered Practitioner Advanced.
No sales calls unless you ask
We send the workbook and add you to our scoping series. What happens after that is entirely your call.
Yours to keep
Use it with any advisor, any assessor, or entirely on your own. It’s designed to stand alone.
Send me the workbook
We’ll email the PDF and a download link right after you submit.
We don’t share your information with third parties. Privacy policy.
