The scenario describes systems that are contractor-owned, configured based on specific government requirements, and used to support a particular contract. According to the official CMMC Level 2 Scoping Guide, this is the precise definition of a "Restricted Information System." This category is a type of Specialized Asset, which may have limited CMMC assessment requirements if it cannot be fully configured to meet all CMMC practices. The key identifiers are the government-mandated configuration and its dedicated use for a contract, distinguishing it from general corporate IT assets.

A. IoT: These are non-traditional computing devices (e.g., sensors, smart appliances). The systems described are used for business network transactions, which implies more traditional IT infrastructure.

C. Test equipment: This category is for systems used to test products or components. The systems in the question are used to perform the actual contract work, not for testing purposes.

D. Government property: This refers to assets owned by and furnished by the government for contract performance. The question explicitly states the systems are "contractor-owned."

---

1. Cybersecurity Maturity Model Certification (CMMC) Scoping Guide

Level 2

Version 2.0

December 2021.

Page 8

Section 2.3

"Specialized Assets": Lists "Restricted Information Systems" as one of the five categories of Specialized Assets.

Page 9

Section 2.3

"Specialized Assets": Defines Restricted Information Systems as "systems that are configured based on government requirements (e.g.

security or privacy) and are used to support a contract." This directly matches the question's scenario.

2. Carnegie Mellon University

Software Engineering Institute (SEI). "CMMC 2.0: What’s New and What’s the Same?" (Webcast

December 2021).

The webcast and associated materials discuss the asset categories for scoping in CMMC 2.0

reinforcing the definitions provided in the official DoD guides. The concept of Specialized Assets

including Restricted Information Systems

is explained as a key change for more flexible and logical scoping. (Reference to the general content of the official SEI training materials on CMMC 2.0).