In the context of CMMC scoping, assets are categorized to identify the assessment boundary. The question lists servers, laptops, databases, and applications, which are all forms of hardware and software used to store, process, or transmit Federal Contract Information (FCI). According to official CMMC scoping guidance, these items are classified under the "Technology" asset category. The IT manager is correctly identifying the technological components that make up the CMMC assessment scope for the Level 1 Self-Assessment.

A. ESP: This refers to External Service Providers, which are third-party entities providing services, not the internal hardware or software assets themselves.

B. People: This asset category includes the personnel (e.g., employees, contractors) who interact with FCI and the systems, not the systems themselves.

C. Facilities: This category refers to the physical locations, such as buildings or data centers, where the technology assets are located and operated.

1. U.S. Department of Defense

"CMMC Scoping Guidance Level 1

" Version 2.0

December 2021.

Page 3

Section 2

"Scoping CMMC Level 1": This section explicitly defines the asset categories for scoping: "Assets are categorized as: People

Technology

Facilities

and External Service Providers (ESPs)." The items listed in the question (servers

laptops

databases

applications) are quintessential examples of the "Technology" category.

2. U.S. Department of Defense

"CMMC Scoping Guidance Level 2

" Version 2.0

December 2021.

Page 4

Section 2.1

"Asset Categories": This guide provides further clarification

stating

"Technology includes all information systems

system components

and other information technology or operational technology assets..." This definition directly encompasses the assets mentioned in the question.