Hi folks,

Long time reader, first time poster. First off, I'd like to thank all the contributors to this sub. You've been a tremendous source of information for our company.

We're a SPA in CMMC lexicon and are planning on acquiring L2 next year to support our current DIB customers and help our sales team get new ones. However, we don't process, store, or transmit CUI.

How would you scope this? Does this mean the scope of our CMMC certification is our entire organization? Do we guess at where CUI would reside if we did collect it? Can we create a small CUI enclave with no CUI?

Any thoughts you have would be greatly appreciated. Like all things CMMC, we've heard conflicting theories on this. :-)