The Boundary Decision Is the Engagement
What actually happens
We map where Controlled Unclassified Information enters your business, where it moves, where it comes to rest and who touches it along the way. In a machine shop that usually means technical data packages, drawings, quotes, an FTP drop from a prime, an email attachment somebody saved to a shared drive four years ago, and a CAM workstation nobody thought of as in scope.
Then we draw the boundary. This is the consequential decision of the whole engagement, and it is a business decision as much as a technical one.
The deliverables
- CUI data flow map — where controlled information enters, moves and rests
- Asset and device inventory — categorized against CMMC asset types, including specialized and OT equipment
- Assessment boundary definition and architecture diagram — with out-of-scope systems documented and justified
- NIST SP 800-171 self-assessment — all 110 practices scored against your actual environment
- SPRS score — calculated and submitted, which is the artifact your customer is asking for
The narrow enclave question
Most providers will offer to build you a small CUI enclave, because it is the cheaper quote. It is often the more expensive answer.
Policing a partition means keeping CUI inside it, keeping everyone else out, and proving both on demand. That segregation is a business function you have to sustain every single day — not a technical control a provider can take off your hands.
When a partition is not sustained, spills follow, and a spill is a materially worse day than a wider boundary would ever have been. For most small and mid-sized manufacturers we recommend enterprise-wide scope, because it removes ongoing work from your team rather than adding it.
Why this phase stands alone
The boundary, the architecture and the score are yours when this phase ends, whoever you continue with. That is deliberate. A scoping engagement that only has value if you buy the next phase is a sales instrument, not an assessment.
Book a CMMC Readiness Call
Thirty minutes. We review your contract requirements, identify your top compliance gaps, and give you a realistic timeline to audit readiness. No pitch decks, no obligation.
Book Your Call →