Can zero trust and VDI shrink your CMMC assessment scope?

Why does assessment scope drive the cost of CMMC?

Scope decides how many systems, people and places must meet the 110 security requirements of NIST SP 800-171 Rev 2. Under 32 CFR 170.19, every asset that processes, stores or transmits CUI is in scope, along with the assets that protect them. At many architecture and engineering firms, project folders sync to every laptop, so a single defense job can pull the whole company into scope. Every in-scope laptop then needs the full set of controls, evidence and documentation. A CMMC VDI design, reached through zero trust access, keeps CUI off those laptops. Reducing the number of devices that ever touch CUI is the most direct way to shrink the assessment, the remediation budget and the ongoing effort of keeping a self-assessment score accurate.

How does the CMMC rule sort assets for a Level 2 assessment?

Table 3 of 32 CFR 170.19(c)(1) puts every asset into one of five categories, and only one of them is out of scope:

• CUI Assets: "Assets that process, store, or transmit CUI." They are assessed against all Level 2 requirements.
• Security Protection Assets: assets that "provide security functions or capabilities" to the assessment scope, such as firewalls, identity systems and logging tools.
• Contractor Risk Managed Assets: assets that "can, but are not intended to, process, store, or transmit CUI" because of policy and practice. They must be documented in the system security plan.
• Specialized Assets: IoT devices, operational technology, government furnished equipment and test equipment that can handle CUI but cannot be fully secured.
• Out-of-Scope Assets: assets that "cannot process, store, or transmit CUI" and provide no security protection for CUI Assets.

The rule also states that an asset fitting any in-scope category cannot be treated as out of scope. The DoD Level 2 scoping guide adds that logical separation can come from software or network controls such as firewalls, routers, VPNs and VLANs.

How can zero trust and VDI take a laptop out of CMMC scope?

By making sure CUI never lands on it. The CMMC rule gives one explicit pattern: "An endpoint hosting a VDI client configured to not allow any processing, storage, or transmission of CUI beyond the Keyboard/Video/Mouse sent to the VDI client is considered an Out-of-Scope Asset." Zero trust network access is a practical way to deliver that pattern. Following the model in NIST SP 800-207, a zero trust broker checks the user's identity, device and context on each request and connects the user to one application instead of the whole network.

For CUI work, the design usually looks like this. CUI stays in a protected environment, such as a virtual desktop or a cloud enclave. Users reach it only through the zero trust broker after phishing-resistant MFA. Policy blocks file download, clipboard copy, printing and local drive mapping from that session. Configured that way, the laptop displays pixels and sends keystrokes. It never holds the file.

The configuration is the whole point. A zero trust tool that simply replaces a VPN and lets an engineer open a CUI drawing locally does not shrink scope at all. The laptop still processes and stores CUI, so it remains a CUI Asset. If policy allows limited exceptions, the endpoint may fit the Contractor Risk Managed category instead, which still has to be documented in the system security plan and can be spot checked by an assessor.

What stays in scope after you add zero trust?

The zero trust platform itself, plus the identity and logging systems around it. These are Security Protection Assets. The scoping guide says they are assessed against the Level 2 requirements "relevant to the capabilities provided," and it lists hosted VPN services, cloud-based security solutions and SIEM tools as examples.

In practice, the broker must show how it meets the remote access requirements in NIST SP 800-171 Rev 2, requirements 3.1.12 through 3.1.14: monitoring and controlling remote sessions, protecting them with cryptography, and routing them through managed access control points. The virtual desktop or enclave that holds CUI is fully in scope, and so are the administrators who manage it.

There is also a cloud question. If a cloud-delivered zero trust service stores, processes or transmits covered defense information, DFARS 252.204-7012(b)(2)(ii)(D) requires the contractor to ensure the provider meets security requirements equivalent to the FedRAMP Moderate baseline, and the DoD CIO's December 2023 memo explains what equivalency means. Ask the vendor which authorization or equivalency evidence it holds before you sign.

Does the CMMC Phase 2 suspension change the case for shrinking scope?

No. On July 13, 2026, the Department of War suspended the transition to Phase II, which had been scheduled to begin November 10, 2026. The same announcement said all Phase I self-assessment requirements remain in place and that the department will enforce NIST SP 800-171 Rev 2 through self-assessments and select government-led assessments. Contractors also remain bound by DFARS 252.204-7012 to safeguard covered defense information. As of this writing, no replacement date for Phase II has been announced. Our guide to what still applies during the Phase 2 suspension covers the details.

A smaller scope makes each of those obligations cheaper and easier to defend: fewer systems to assess, a self-assessment score that reflects reality, and less to remediate if certification requirements return. The Cyber AB has said C3PAO assessments remain available during the suspension for firms that want one.

What should a defense subcontractor do this quarter?

Start with where CUI actually goes, then design access around keeping it in one place:

• Map where CUI lives and travels. Start with contracts and drawings marked CUI and trace every place a copy lands, including laptops, file sync clients and email.
• Pick the target pattern. Decide which environment will hold CUI, such as a virtual desktop or a cloud enclave, and which people need access to it.
• Build the zero trust policies. Require phishing-resistant MFA, check device health, and block download, clipboard, printing and drive mapping for CUI sessions.
• Test the controls. Try to copy, print and save a test file from a managed and an unmanaged device, and keep screenshots of what was blocked.
• Update the system security plan. Record each asset's category, the reasoning behind any out-of-scope endpoints, and every Contractor Risk Managed Asset.
• Check the vendor. Keep the zero trust provider's FedRAMP authorization or equivalency evidence on file.
• Revisit the self-assessment. If scope or your score changes, update the record in SPRS as 32 CFR 170.16 describes for Level 2 self-assessments, and keep the annual affirmation current.

How does s90 help?

s90 designs and runs zero trust network access for architecture, engineering and construction firms that handle CUI. We help map where CUI flows, build the enclave and access policies, test that endpoints stay clean, and document asset categories in the system security plan, so a self-assessment or a C3PAO review starts from evidence. If your scope feels larger than your defense work, talk with our team.