What's in scope at a moving company

Follow the information

Scope starts with the information. On these pages, DoD shipment information means the controlled information you handle for DP3 shipments, such as a service member's personal details and the shipment documents. Follow it through your company and write down every place it goes:

1. Where it arrives: the government's shipment system, email, phone calls, paperwork handed over at the door, or a hand-off from a TSP or agent.
2. Where it goes next: your moving software, spreadsheets, printouts, crew phones, texts to the service member, your agents.
3. Who handles it: office staff, estimators, crew leads, drivers, warehouse staff, agents and your IT company.
4. Where it is kept: cloud services, computers, phones, file cabinets, the warehouse office and backups.

That list becomes your asset inventory, the first of the documents scoping produces.

Sort everything into five types

The CMMC rule sorts every asset into one of five types. Everything in the first four types goes in your asset inventory, your System Security Plan (SSP) and your network diagram. What else you do depends on the type.

CUI assets

Hold, process or send DoD shipment information.

At a moving company: Your moving software and email, and the computers, phones and tablets that show shipment details.

What you do: Meet every Level 2 requirement that applies to them.

Security protection assets

Protect the systems above, even if they never hold shipment information themselves.

At a moving company: Your router and firewall, Wi-Fi equipment, antivirus, sign-in and multifactor service, password manager, and your IT company's remote-support tools.

What you do: Meet the requirements that fit what they do.

Contractor risk managed assets

Could hold shipment information, but your written rules and practices keep it out.

At a moving company: An accounting system, if your rule is that invoices for military moves never carry a service member's details.

What you do: Explain in your SSP how your rules keep the information out, and be ready for them to be checked against the Level 2 requirements. If your documents or other findings raise questions, an assessor can do a limited check.

Specialized assets

Could touch shipment information but cannot be fully secured. The rule lists connected devices (the internet of things, industrial ones included), operational technology, government-furnished equipment, restricted information systems and test equipment.

At a moving company: Security cameras that can see desks with paperwork, and other connected devices on the office network.

What you do: Show in your SSP how you manage their risk.

Out-of-scope assets

Cannot hold or reach shipment information and do not protect anything that does, because they are kept physically or logically separate, or simply cannot handle it.

At a moving company: A guest Wi-Fi network with no way into your business systems.

What you do: Be ready to explain why they cannot touch the information. Anything that fits one of the four types above cannot be out of scope.

Source: 32 CFR 170.19

The usual list at a moving company

What a typical mover has in scope. Yours may differ: your own scope decides.

• Moving software or CRM: Usually a cloud service, and a CUI asset if shipment details go in. The cloud rule below applies.
• Email: A CUI asset if orders or a service member's details are emailed. The cloud rule applies.
• Office computers and laptops: CUI assets, including any computer used to sign in to the government's shipment system or to open shipment files.
• Phones and tablets: Crew leads', estimators', drivers' and office staff's, personal phones included: CUI assets if they show, store or photograph shipment details. Crews using their own phones? See the FAQ answer.
• Shared drives and cloud storage: CUI assets if shipment files are saved there. The cloud rule applies.
• Printers, scanners and copiers: CUI assets if they print or scan shipment paperwork. Many keep copies on a drive inside.
• Texting and phone systems: Business texting with service members, call recording and voicemail sent to email: CUI assets if they carry a service member's details. The cloud rule applies to the provider.
• Router, firewall and Wi-Fi: Security protection assets, because they protect everything else, and CUI assets too when shipment information passes through them.
• Security tools: Antivirus, password manager, the sign-in and multifactor service and any log collection: security protection assets.
• Backups: CUI assets if they hold copies of shipment information, as most do. A cloud backup service must meet the cloud rule.
• Your IT company: If it handles your shipment information, its services are assessed against all Level 2 requirements as part of yours. If it handles only security data, such as your passwords, settings and activity records, its services are assessed as security protection assets. Either way, describe its services in your SSP and get its service description and customer responsibility matrix.
• Paper and places: Orders, inventories, bills of lading and other printouts, and the office, dispatch desk, file cabinets and warehouse office where they are kept. The physical and media requirements cover them.
• Agents and subcontractors: Not your systems, but agents, haulers, storage companies and other subcontractors you pass shipment information to need their own Level 2 (Self) status at minimum. Cloud services follow the cloud rule below, and your IT company the entry above, instead. See below.

Each requirement on the family pages has a “Usually applies to” line that points back to this list.

Source: 32 CFR 170.19

Keep your scope small

Every system you keep the information out of, and can show it cannot reach, is one less system to lock down. The cheapest Level 2 is the smallest one.

• Keep DoD shipment information in one system, not in copies across email, spreadsheets and texts.
• Set up your email and moving software so personal phones and computers cannot reach them at all. A rule alone leaves them in scope.
• Print only what the job needs, lock it up, and shred it once you no longer need it and any record-keeping period you must follow has ended.
• Give crews and agents only the details they need for the job.
• Keep guest Wi-Fi, and equipment that never needs shipment information, on a separate network.

Cloud services: the rule that catches movers

If a cloud service holds, processes or sends DoD shipment information for you, such as your moving software, email, file storage or texting service, it must be FedRAMP authorized at Moderate or higher, or meet security requirements equivalent to the FedRAMP Moderate baseline under DoD policy.

Before you put shipment information into any cloud service:

• Look it up in the FedRAMP Marketplace, or ask the provider for written proof that it meets DoD's equivalency policy.
• Ask for its customer responsibility matrix: the list of what the provider handles and what is still yours to do. Record what is still yours in your SSP.
• Remember that your own computers and phones that connect to the service stay in your scope.

Sources: 32 CFR 170.16, 32 CFR 170.19, FedRAMP Marketplace

Agents and subcontractors

If you pass DoD shipment information to an agent, hauler, storage company or other subcontractor, the CMMC rule makes a Level 2 (Self) status, a self-assessment plus an affirmation in SPRS, the minimum for them, and you must require it of them. If you are the agent, the same applies to you. A subcontractor that gets only federal contract information, and no CUI, needs Level 1.

Source: 32 CFR 170.23

IAM says CMMC reaches agents, storage facilities, hauling agents and crating companies in DP3. Pass on only what each one needs for the job.

Source: IAM CMMC Resource Center

Write it down

Scoping produces three documents: an asset inventory, a network diagram of your scope, and your SSP, which records each asset's type and how it is protected (requirement 3.12.4). When you post your self-assessment in SPRS, you also state your scope.

Sources: 32 CFR 170.19, 32 CFR 170.16

Next: the 14 families in the Level 2 guide, where every requirement says where it usually applies, or the FAQ.