thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Advanced

CMMC Asset Categories

Scoping categories for CMMC Level 2: CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets, and Out-of-Scope Assets.

Definition

CUI Assets process, store, or transmit CUI. Security Protection Assets provide security functions such as SIEM or identity providers. Contractor Risk Managed Assets can but are not intended to handle CUI and are managed by policy. Specialized Assets include IoT, OT, GFE, restricted information systems, and test equipment. Out-of-Scope Assets cannot handle CUI and are physically or logically separated.

Example

The company's SIEM is a Security Protection Asset and must meet relevant requirements.

Exam tip

Specialized Assets are documented in the SSP but not assessed against all requirements at Level 2.

Related terms