ESP Evidence Pack: CRM Starters & Scoping Worksheet

CRM starter: Non-CSP ESP handling CUI

Use one copy per service and client boundary. Fill in and validate each applicable requirement with the client; a domain row is not a completed CRM.

CRM starter: SPD-only service assessed as Security Protection Assets

Use one copy per service and client boundary. Fill in and validate each applicable requirement with the client; a domain row is not a completed CRM.

CRM starter: CSP holding CUI

Use one copy per service and client boundary. Fill in and validate each applicable requirement with the client; a domain row is not a completed CRM.

Service description outline

Create one description per service line and client boundary. Record the actual delivery arrangement, not marketing copy.

1. Service name, version/date, client identifier, and service owner
2. What the service delivers, where it operates, and the client functions it supports
3. People, systems, facilities, and third-party services that deliver the service
4. Data touched: CUI, SPD (including logs, configurations, and credentials), or neither; where it flows and is retained
5. Tenant licensing and ownership, provider-managed components, and client/provider boundary
6. Access paths, admin credentials, isolation, and relevant shared infrastructure
7. What the provider performs, what the client performs, and how shared actions are validated in the CRM
8. Evidence contacts, artifacts, interview availability, and review/update date

Scoping worksheet — repeat per service line

Run all gates; more than one path may apply. Use the completed answers to confirm which starter needs tailoring.

1. Service line and client (use an internal identifier, not CUI on this page)
2. Executed contract, purchase order, task order, amendment, and applicable clauses (Gate 1)
3. Which CUI or Security Protection Data touches provider people, systems, or facilities? How is it processed, stored, or transmitted?
4. Which assets hold logs, configuration or vulnerability data, alerts, or admin credentials?
5. Who owns or licenses the cloud tenant: client or provider? Is a cloud service modified or subdivided for client use?
6. Which provider-owned laptops, VPNs, password vaults, ticketing systems, servers, or shared infrastructure touch this service?
7. Which people, systems, and facilities are in the proposed boundary? What isolation exists between client environments?
8. Who owns each action, who can supply evidence, and who validates the boundary with the client?

Prospect-response scripts

Choose only the answer that is true for your actual scope. Replace brackets with verified facts; do not claim an assessment or status you do not hold.

“Are you CMMC certified?”

“Our CMMC Status is Final Level 2 (C3PAO) for [named scope], assessed [date] by [C3PAO name]. Our service description and Customer Responsibility Matrix for [service] are attached.” Use only if true and supported by your records.

“Do you have a self-assessment status?”

“Our CMMC Status is Final Level 2 (Self) for [named scope], self-assessed [date], with the required affirmation submitted [date].” Use only if true.

“What if you have no CMMC Status for this service?”

“We don’t hold a CMMC Status for this service. Based on our current service architecture, 32 CFR 170.19 places this service inside your assessment scope rather than requiring a separate provider status. We provide a service description and Customer Responsibility Matrix for review, and our people are available for assessment interviews.” Confirm this classification against the actual service and contract before using it.

“Can you guarantee our assessment outcome?”

“No. We can identify the service boundary, document our assigned responsibilities, and provide available evidence for your assessment team to examine.”