What's in the CMMC scoping workbook?

The 15-page workbook walks you through Greypike's complete scoping methodology in six sections: the scoping philosophy and four principles that separate defensible scopes from bloated ones; reference material on all five CUI asset categories; a 10-row fillable CUI inventory with a worked example; boundary sketch templates plus the three shared services that quietly break most boundaries; flow-down and subcontractor scoping based on DFARS 252.204-7012; and red flags plus pre-assessment readiness checks.

Is the workbook really free?

Yes — no cost, no credit card, no required sales call. Submit the form and we'll email the PDF within two minutes. The workbook is yours to use however you want — share it with your team, work through it with another consultant, or use it as your own planning document. We won't follow up with sales calls unless you explicitly ask for one.

Who should use this workbook?

Defense contractors who hold or pursue DoD contracts and need to define their CMMC assessment scope. It's particularly valuable for small and mid-sized contractors who want to avoid the most common scoping mistake: securing everything first, then trying to figure out what's actually in scope. If you're at the start of your CMMC journey or you've gotten vendor quotes that feel inflated, this workbook helps you build a defensible scope before spending a dollar on remediation.

How does proper scoping affect CMMC compliance costs?

Significantly. Every asset you add to scope multiplies your documentation, monitoring, and assessment burden. Contractors who reduce their scope by 50% routinely cut their first-year CMMC compliance cost by more than that — sometimes 60-70% — because reduced scope means fewer controls to implement, fewer systems to harden, less documentation to maintain, and a faster C3PAO assessment. Scope is the highest-leverage decision in your entire compliance journey.

What are the five CUI asset categories?

Under the CMMC scoping guide, assets fall into five categories: CUI Assets (process, store, or transmit CUI), Security Protection Assets (SPAs — provide security functions to CUI assets), Contractor Risk Managed Assets (CRMAs — capable of processing CUI but managed via policy), Specialized Assets (IoT, OT, government property), and Out-of-Scope Assets (no CUI access). Misclassifying assets in any of these categories is one of the most common pre-assessment errors.

Can I use this workbook with another consultant or assessor?

Absolutely. The workbook is designed to stand alone — bring it to any CMMC consultant, your in-house IT team, your RPO, or your C3PAO. We built it because every defense contractor benefits from a sharper scoping methodology regardless of who delivers their compliance program. If you decide afterward that you'd like Greypike to help build or audit your CMMC program, you can book a free scoping session, but there's no obligation tied to downloading the workbook.

Define the smallest defensible scope for your CMMC assessment.

Most contractors approach CMMC compliance backwards — they secure everything first, then figure out what’s in scope. This workbook walks you through the opposite approach, with the tips, pitfalls, and reference material you need to defend your scope to an assessor.

Scope first. Then controls.

What's inside

A complete scoping methodology — not a checklist.

Every page of the workbook serves a purpose. This is what you'll work through, in the order you'll work through it.

The scoping philosophy

Four principles that separate defensible scopes from bloated ones — and why "we'll just secure everything" is the most expensive mistake in CMMC.

CUI asset categories reference

All five categories — CUI Asset, SPA, CRMA, Specialized, Out-of-Scope — with how each gets assessed and where teams typically misclassify.

CUI inventory with worked example

A 10-row fillable inventory plus a complete sample showing how a small engineering firm documented its CUI footprint.

Boundary sketch & segmentation

Space to draw your enclave, plus the technical controls assessors actually probe — and the three shared services that quietly break most boundaries.

Flow-down & subcontractor scoping

How DFARS 252.204-7012 extends your scope to subs and ESPs, plus a worksheet to map every third party that touches your CUI.

Red flags & pre-assessment readiness

Six common scoping quotes we hear right before assessments fail — plus the documentation gates to clear before you book your C3PAO.

From the workbook · Page 2

"Every asset you add to scope multiplies your documentation, monitoring, and assessment burden. Contractors who reduce scope by 50% routinely cut their first-year CMMC cost by more than that."

Scope is leverage — use it.

Get the workbook

Download your copy.

Delivered as a fillable PDF — print it, share it with your team, or fill it out digitally. You'll receive a download link immediately, and a copy in your inbox within two minutes.

Built by CMMC Registered Practitioners. Greypike is a veteran-owned small business focused exclusively on the defense industrial base.

No sales calls unless you ask for one. We'll send the workbook, add you to our scoping series, and let you decide what happens next.

Yours to keep. Use it with any advisor, any assessor, or entirely on your own. Designed to stand alone.

Send me the workbook

We'll email you the PDF and a download link right after you submit.

We don't share your information with third parties. Privacy policy.

Define the smallest defensible scope for your CMMC assessment.

A complete scoping methodology — not a checklist.

The scoping philosophy

CUI asset categories reference

CUI inventory with worked example

Boundary sketch & segmentation

Flow-down & subcontractor scoping

Red flags & pre-assessment readiness

Download your copy.

Questions? Let’s talk.

Company

Services

Resources