During a CMMC assessment, the CCAs, CCPs, and Lead Assessor validate the assessment scope provided by the OSC. They must review documents and records specific to the agreed-upon scope and boundaries of the assessment. There are several documents the Assessment Team may review or analyze; some are required, and others not. Which of the following documents is NOT required when scoping a CMMC Assessment for Level 2 maturity?

During the scoping phase of a CMMC Level 2 assessment, the Assessment Team must validate the CMMC Assessment Scope (CAS) defined by the Organization Seeking Certification (OSC). According to the CMMC Assessment Process (CAP), the OSC is required to provide a System Security Plan (SSP) and network topology diagrams. These documents are fundamental for defining the assessment boundary and understanding the CUI environment. A preliminary list of evidence may also be reviewed to gauge the OSC's readiness. However, "System Design documentation" is a broad category. While it includes required items like network diagrams, the entire set of design documents is not a standard requirement for the initial scoping activity. Detailed design documents are more typically reviewed as objective evidence for specific practices during the assessment itself.

A. Network diagrams: Incorrect. Network diagrams are explicitly required to visualize the assessment boundary, asset locations, and CUI data flows, which is a core activity of scoping.

B. System Security Plan (SSP): Incorrect. The SSP is a foundational document required by NIST SP 800-171 (3.12.4) and the CMMC CAP. It formally describes the system environment and the assessment scope.

C. Preliminary List of Evidence: Incorrect. While not a primary scoping document, this may be requested as part of the initial planning and readiness review to ensure the OSC is prepared for the assessment.

1. U.S. Department of Defense, CMMC Assessment Process (CAP) for CMMC Level 2, Version 2.1, December 21, 2022.

Section 2.3.1, Phase 1 – Plan and Prepare the Assessment: This section lists the key inputs from the OSC for the initial phase, which includes the "Assessment Scope," "System Security Plan (SSP)," and "Network topology diagram of the assessment scope." It does not list "System Design documentation" as a required input for this phase.

2. U.S. Department of Defense, CMMC Scoping Guidance Level 2, Version 2.0, November 2021.

Section 2.2, Step 2: Categorize Assets: States, "The OSC should use network and data flow diagrams to help identify where CUI is processed, stored, or transmitted and to identify assets that are part of CUI security protection." (Supports the requirement for Network Diagrams).

Section 2.3, Step 3: Determine the CMMC Assessment Scope: Notes that "The CMMC Assessment Scope is documented in the SSP..." (Supports the requirement for the SSP).

3. NIST Special Publication 800-171, Revision 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, February 2020.

Section 3.12.4 (System Security Plan): Explicitly requires organizations to "Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems." This makes the SSP a mandatory document.