eTrepid CMMC Level 2 Scoping & Boundary Standard

Governing Standard: 32 CFR Part 170 / CMMC Scoping Guide for Level 2

1. Overview and Purpose

This standard defines the scoping principles, asset categorization criteria, and boundary isolation methods applied by eTrepid Inc. when architecting customer defense environments and supporting third-party C3PAO CMMC Level 2 assessments.

2. Asset Categorization Framework

Under 32 CFR § 170.19 and the CMMC Scoping Guide for Level 2, all information system components within customer environments are classified into five distinct asset categories:

flowchart TD

subgraph InScope ["IN-SCOPE ASSESSMENT BOUNDARY"]

CUI["1. CUI Assets: Process, store, or transmit CUI."]

SPA["2. Security Protection Assets (SPA): Provide security (EDR, Firewalls, SOC, eTrepid ESP)."]

CRMA["3. Contractor Risk Managed Assets (CRMA): Capable of communicating with CUI assets."]

end

subgraph OutScope ["OUT-OF-SCOPE ASSETS"]

SPEC["4. Specialized Assets (IoT, OT, Test Equipment, CNC)."]

OOS["5. Out-of-Scope Assets: Physically or logically isolated from CUI."]

end

InScope -. Micro-Segmentation .-> OutScope

2.1 eTrepid Role as a Security Protection Asset (SPA)

When eTrepid delivers managed services (ThreatKrusher ITSM, ThreatKrusher 24/7 SOC, ThreatKrusher Comply), eTrepid systems act as External Security Protection Assets (ESP/SPA). In accordance with DoD policy, eTrepid satisfies the relevant security requirements of NIST SP 800-171 Rev 2 across its operational boundary.

3. Boundary Segregation & Enclave Design

To minimize assessment costs and eliminate compliance exposure, eTrepid recommends and deploys a Bifurcated Enclave Strategy: