CMMC ADVISORY SERVICES
Limited Scoping Engagement
The first step of CMMC is knowing your CUI scope
Many federal contractors don’t know if they have CUI, or how it flows in their environment. That’s where we come in.
25
✓ Delivered remotely by a CMMC Certified Professional (CCP)
✓ We guide your team through structured discovery and analysis to find the people, technology, and facilities that interact with your CUI
✓ Advisory approach: we inform, and your organization’s Affirming Official defines and attests to the final scope.
✓ Three client-owned deliverables at completion
Overview
Before gap assessments, documentation work, or certification can begin, your organization must answer one foundational question: where does your CUI actually live, and what does your assessment boundary include?
For many DIB organizations, that question has never been formally answered, and the absence of a defined CUI scope is one of the most common reasons organizations stall or fail heading into a CMMC Level 2 assessment and risk losing their DoD contracts.
The Limited Scoping Engagement changes this. In 25 structured advisory hours, delivered remotely by a CMMC Certified Professional, Redspin works alongside your team to map your CUI environment, review the evidence that supports your boundary decisions, and produce three client-owned deliverables your leadership can stand behind and your assessor will recognize.
Redspin’s role is advisory throughout. We inform and guide the process, but your organization’s OSC Affirming Official defines and attests to the final scope, keeping accountability and defensibility exactly where they belong.
Our team meets you where you are and guides you every step of the way.
THE CHALLENGE
How do I know if I have CUI? And if I do, how do I scope it?
This is the question at the center of every CMMC Level 2 engagement. Many organizations working on DoD contracts can’t answer it with confidence. The top three scoping challenges we hear most:
"We handle DoD contracts, but we've never formally identified what qualifies as CUI."
Not everything you work with is CUI. The NARA CUI Registry lists 125 categories across 20 groupings, and what actually qualifies is more specific than most organizations assume. Until you’ve verified what you have, you can’t define a meaningful scope, and you can’t build a defensible compliance program on top of it.
"We've been treating our entire IT environment as in scope. Is that right?"
Probably not, and that assumption is costing you. Your CMMC assessment boundary is defined by the systems that store, process, or transmit CUI, not your entire network. Over-scoping inflates your compliance burden and assessment cost, while increasing the perimeter for required incident reporting to the DoD.
Under-scoping means undetected gaps and potentially not reporting security incidents that should be made to the DoD. The right scope starts with a documented, defensible CUI boundary.
"We know we need to do something, but we don't know where to start or what this is actually going to cost us."
Assessment paralysis is one of the most common reasons DIB organizations delay CMMC compliance. Without a defined scope, you can’t accurately estimate your compliance program, your remediation investment, or your timeline to certification. The Limited Scoping Engagement gives you the foundation everything else is built on, so the path forward stops feeling like a guess.
If any of these sound familiar, you’re not alone, we hear them from DIB contractors every day. The Limited Scoping Engagement is built for exactly this moment. Before readiness, before certification, before anything else, you need to know what you’re protecting and where it lives. That’s what we help you answer.
WHAT YOU GET
Three deliverables
Every output from the Limited Scoping Engagement belongs to your organization, built for your OSC Affirming Official to review, validate, and carry into your CMMC program.
1
Analysis Matrix Reporting Output
A domain-level readiness heatmap produced from your ERL item scores. Every finding traces to a specific evidence item — no assumptions. Shows strengths, at-risk areas, and direct control failures in an executive-ready format.
2
Limited Scoping Worksheet
A structured document cataloging the people, technology, and facilities that form your CUI assessment boundary. Includes documented rationale for every scoping decision, designed for your OSC Affirming Official to review and formally attest to.
3
Outbrief + Path Forward
A live walkthrough of your readiness heatmap and CMMC domain findings, with honest options for what comes next: self-directed remediation, targeted advisory, or the Redspin Ready Managed Services Program.
WHY REDSPIN
The First. Most experienced. Most trusted.
Our team includes former DoD cybersecurity professionals, military veterans, and former defense contractors who have navigated the same compliance challenges you’re facing now. We don’t just assess, we advise from experience.
We Know What It's Like to Be the OSC
Our advisors have sat on your side of the table. We understand the pressure of scoping decisions, the weight of the Affirming Official role, and what it takes to build a program that holds up under a real C3PAO assessment.
One of the First C3PAOs
Redspin has conducted more Assessments than any other C3PAO and has led CMMC Level 2 assessments since the program’s inception, giving us a direct line of sight into what assessors actually look for.
DIB Focused
We work with large primes, subcontractors, small businesses, research institutions, and service providers.
With you at Every Step
From scoping through certification, to managed compliance, Redspin provides end-to-end support, so you don’t have to figure out what comes next on your own.
WHAT COMES NEXT
Redspin supports the entire CMMC life cylce
Once your scope is defined, Redspin guides you through every step that follows, from building your NIST 800-171 foundation to passing your formal CMMC Level 2 certification assessment.
NIST 800-171 Assessment
The building block for CMMC compliance. A thorough assessment gives you a clear expectation for your SPRS score and an actionable roadmap to federal compliance.
CMMC Readiness
Expert guidance to help you prepare with confidence. Redspin’s readiness services include gap assessments, mock assessments, documentation enhancement, and remediation prioritization.
CMMC Certification
The gold standard for cybersecurity in the DIB. CMMC Certification assessments began January 4, 2025, and requirements are now appearing in federal contracts and solicitations.
Outcome
A defensible scope. A clear path forward.
An understanding of what your CUI environment actually includes, who is accountable for attesting to it, and what your compliance picture looks like across all 14 CMMC domains. Your OSC Affirming Official has the structured worksheet they need to stand behind the boundary. Your leadership has a readiness heatmap they can act on. And for the first time, your team has an honest, specific answer to the question that’s been holding everything else back.
That foundation is what every step that follows, readiness, remediation, certification, depends on.