Scope Change Trigger

A boundary change can invalidate the story your evidence tells

What to review when the CMMC CUI boundary changes: assets, data flows, providers, diagrams, SSP, responsibility matrices, evidence mappings, and assessment status.

Use the change-trigger checklist Review the CUI operating boundary

Map the old and new CUI flows

Reclassify affected assets and providers

Update SSP, diagrams, inventories, and responsibility records

Revalidate evidence support under the new boundary

Start with the changed flow of information

A boundary is not just a network line. It depends on the systems, people, facilities, and external services that process, store, transmit, or protect CUI. Document the changed flow and affected asset categories before deciding which evidence remains representative.

Reconcile scope documents and evidence

The boundary story should be consistent across the SSP, diagrams, inventories, service descriptions, responsibility matrices, and evidence ledger.

New or removed CUI assets and security protection assets
Changed connections, remote access, facilities, and users
New ESPs or changes to inherited/shared responsibility
Evidence collected from the old architecture
New evidence and test demonstrations required
Assessment-status and contractual coordination

Treat significant-change decisions as governed records

Record who reviewed the change, what facts were considered, what documents and evidence were updated, and whether the C3PAO, contracting party, or other authorized stakeholder was contacted.

What the work produces

Concrete, client-owned operating records

Boundary change record

Asset and flow delta

Document update queue

Evidence impact map

Qualified decision and coordination log

Responsibility boundary

Facts, not verdicts

Gridex operates the documentation and evidence workflow. Gridex does not independently determine the official assessment scope or whether a new assessment is required.

Questions buyers ask

Frequently asked questions

Can evidence from the old boundary still be used?

It may remain historical support, but current findings require evidence relevant to the present assessment scope and implementation. Qualified review is required.

What counts as a significant change?

The DoD scoping guide discusses significant architecture or boundary changes, but the facts and required coordination must be evaluated for the specific organization and assessment.

Primary references

Source context

DoD CMMC Level 2 Scoping Guide v2.13 Defines the assessment scope, asset categories, ESP relationships, and responsibility documentation. DoD CMMC Level 2 Assessment Guide v2.13 Defines assessment objectives, evidence expectations, MET and NOT MET findings, and Examine, Interview, and Test methods.

Start with one bounded scope

Bring the evidence state you actually have.

Gridex will map the operating work, the human judgment boundary, and the safest next step.

Use the change-trigger checklist →