CMMC Level 2 Scoping: Architecting ESP and Managed Cloud Boundary Isolation

The Contracting Mandate for Scoping Precision

With the full codification of the CMMC Program rule (32 CFR Part 170) and the accompanying Defense Federal Acquisition Regulation Supplement (DFARS 252.204-7021), CMMC compliance has transitioned from an aspirational milestone into a binary gating requirement. Defense Contracting Officers are legally prohibited from executing contract awards, options, or task orders without verifying that an offeror’s exact system boundary carries the required certification status within the Supplier Performance Risk System (SPRS).

For defense contractors and dual-use commercial firms, the most expensive mistake in CMMC compliance is failing to clearly define the assessment boundary. Attempting to certify an entire enterprise IT ecosystem against NIST SP 800-171 creates unmanageable compliance overhead, massive software licensing costs, and immense False Claims Act risk. The only financially and technically viable strategy is the construction of a hardened Controlled Unclassified Information (CUI) enclave paired with disciplined External Service Provider (ESP) boundary isolation.

Categorizing the CMMC Assessment Boundary

Under official DoD scoping guidance, assets within a defense contractor's environment fall into four distinct categories:

• CUI Assets: Systems that process, store, or transmit Controlled Unclassified Information. These assets are in full scope and must satisfy all 110 requirements of NIST SP 800-171.
• Security Protection Assets (SPAs): Systems that provide security functionality to CUI assets (e.g., identity providers, SIEM, vulnerability scanners, patch management). Even if an SPA never touches CUI, it is subject to the same compliance controls as CUI assets.
• Contractor Risk Managed Assets (CRMAs): Systems that are not intended to process CUI but have logical or physical pathways to CUI assets. They must be documented in the System Security Plan (SSP) alongside policies that prevent accidental CUI transit.
• Out-of-Scope Assets: Systems that have no physical, logical, or network connectivity to CUI assets. These require zero assessment controls, provided clear separation can be demonstrated.

Architecting the External Service Provider (ESP) Boundary

Many defense contractors outsource infrastructure management, cybersecurity monitoring, or helpdesk functions to Managed Service Providers (MSPs) and Managed Security Service Providers (MSSPs). Under 32 CFR Part 170, these organizations are classified as External Service Providers (ESPs).

If an ESP provides services within your CUI boundary or operates an SPA (such as a remote Security Operations Center monitoring your firewalls), the ESP itself falls directly under the CMMC scoping microscope:

[Corporate IT (Out-of-Scope)]
           │ (Air-Gapped / Deny-All Firewall)
           ▼
┌───────────────────────────────────────────────┐
│         CUI Cloud Enclave Boundary            │
│  - Azure Gov / AWS GovCloud (FedRAMP High)    │
│  - Identity & Access Management (FIPS 140-3)  │
│  - Encrypted Storage & Processing             │
└───────────────────────┬───────────────────────┘
                        │
       (FedRAMP High / CMMC L2 Validated Access)
                        ▼
         [External Service Provider (ESP)]
         - Dedicated Admin Bastion
         - Hardware MFA Enforcement
         - Validated SPRS Assessment Record

To ensure an ESP does not invalidate your CMMC Level 2 assessment:

1. Verify CMMC or FedRAMP Status: If the ESP stores, processes, or transmits CUI, it must possess a CMMC Level 2 certificate or meet the DoD FedRAMP Moderate Equivalency memo standards.
2. Isolate Administrative Vectors: Never grant MSP technicians standing domain-admin privileges across both corporate and CUI enclaves. All ESP connections into the CUI boundary must pass through dedicated, bastion-controlled jump boxes protected by FIPS-validated multi-factor authentication.
3. Map Responsibility Matrices: Every control shared with an ESP must be explicitly documented in a Customer Responsibility Matrix (CRM). A Certified Third-Party Assessment Organization (C3PAO) will fail an assessment if an SSP simply lists an MSP without a clear delineation of who operates each technical control.

Secure Cloud Hosting: Azure Government and AWS GovCloud

Deploying an enclave within dedicated sovereign clouds like Microsoft Azure Government or AWS GovCloud significantly accelerates CMMC Level 2 compliance. These dedicated cloud environments inherit physical security, biometric facility access, and underlying network hypervisor controls that already possess FedRAMP High authorizations.

However, contractors must remember that cloud providers operate under a shared responsibility model. While AWS or Azure handles infrastructure-level controls (physical security, virtualization isolation), the contractor remains 100% accountable for application-level data handling, key management, endpoint protection, and annual senior official affirmations in SPRS. By isolating your defense programs into specialized enclaves, you protect enterprise agility while maintaining an unassailable security posture.