CMMC specialized assets: OT, IoT, test equipment and GFE scope

How CMMC treats specialized assets like OT, IoT and test equipment

At CMMC Level 2, specialized assets such as operational technology, IoT, test equipment and government furnished equipment are documented in the system security plan with their treatment, but they are not assessed against the 110 requirements. At Level 1, they are excluded from the assessment entirely. Both rules come from 32 CFR 170.19, which scopes assessments by asset category. A machine tool controller, a test rig running a vendor image or a networked sensor on the shop floor therefore does not need to pass the controls that a CUI file server must pass, but the SSP must still say what it is, where it sits and how it is handled. The answer changes with three questions. First, does the asset process, store or transmit CUI, or is it a security protection asset or a contractor risk managed asset? Second, is it physically or logically separated from CUI assets, in which case it is out of scope? Third, does a Level 3 program apply? At Level 3, specialized assets must either be included in the enhanced requirements or segregated in purpose-specific networks under SI.L3-3.14.3e, so a machine that was documented-only at Level 2 can become a segregation project. Map each device to one of these outcomes before you write anything.

DeployOpen can help prepare the system security plan entries, network diagrams, asset inventories and segregation evidence that describe these decisions, and can implement the network separation where the client chooses it. DeployOpen does not decide the scope on the client's behalf, and it does not issue results. Only the certified third-party assessor (C3PAO) for Level 2 certification, or DCMA DIBCAC for Level 3, can issue findings. Confirm the current assessment path with your contracting officer, because the Department of War suspended Phase II in July 2026 and the CMMC program rule text still shows the original phase schedule. Enduring exceptions need the most care. Where a device cannot meet a requirement, such as a medical device or specialized test equipment that cannot run an approved update path, describe the limitation, the compensating mitigations and the review date in the SSP. Under 32 CFR 170.24(b), a documented enduring exception with mitigations is assessed as MET. Write each entry for the device model and location, not as a general statement, and ask your integrator for the vendor documentation that supports the limitation.

Which assets count as specialized, and which do not

The CMMC scoping rule sorts every asset into a category, and each category gets a different level of assessment at Level 2. The category an asset lands in decides whether it is fully assessed, documented in the system security plan, or left out of scope, so the sorting has to be deliberate and written down.

CUI assets

CUI assets store, process or transmit controlled unclassified information, and they are assessed against all Level 2 requirements. Any system that touches CUI, including email, file shares, identity services and endpoints used by people who handle it, starts here. Check whether each system holds CUI directly or only passes it along, because that answer changes what must be assessed. Assume a system is a CUI asset until the boundary analysis shows otherwise.

Security protection assets

Security protection assets, such as firewalls, directory services, logging collectors and endpoint security tools, do not hold CUI themselves but protect the systems that do. They are assessed against the requirements relevant to their function, not necessarily all of them. Inventory each one that enforces a control for CUI assets, since an unlisted security tool is a common gap in scoping evidence.

Contractor risk managed assets

Contractor risk managed assets are systems the organization operates that are neither CUI assets nor security protection assets, such as general office devices. They are not assessed directly but must be described in the system security plan with the risk decisions behind them. Record how each group is managed, who owns the decision and how it is reviewed, because an assessor will test whether the description matches reality.

Specialized assets

Specialized assets include IoT, operational technology and test equipment. At Level 2 they are documented in the system security plan but not assessed against the requirements, which makes the classification a significant decision. Document what each device does, why it cannot meet the requirements, and what compensating measures apply. Treat any device that can process CUI as a candidate for reclassification rather than a specialized asset.

Assets separated from CUI

Assets physically or logically separated from CUI assets fall outside the Level 2 assessment. Separation must be real, meaning separate networks, enforced boundaries and no shared credentials or data paths. Test the separation during scoping by attempting access from the separated segment, and keep the evidence, because an assessor will ask how the boundary was verified. A flat network with a label on it is not separation.

The categorization decision

The boundary between categories is a documented decision that the organization must justify, not a label chosen to avoid assessment. Record the reasoning for each asset, the data flows that support it and the person who approved it, then keep that record current as the environment changes. Confirm with your assessor and the scoping rule text how they expect the rationale to be presented before you finalize it.

Why Level 1, Level 2 and Level 3 treat the same device differently

The same CNC controller can carry three different obligations depending on the CMMC level. At Level 1, 32 CFR 170.19(b) excludes specialized assets such as IoT, OT, government furnished equipment, restricted information systems and test equipment from the assessment of systems that process federal contract information, and out-of-scope assets need no documentation. At Level 2, 32 CFR 170.19(c) classifies that same controller as a specialized asset. It must appear in the system security plan (SSP) with its treatment described, but it is documented rather than assessed against the 110 requirements. Level 3 changes the answer. SI.L3-3.14.3e requires specialized assets to be included in the scope of the enhanced requirements or segregated in purpose-specific networks.

Consider this illustrative example. A machine shop runs a CNC controller that cannot run endpoint agents or accept routine patches. In the first design, the controller sits on a purpose-specific network with no route to the enclave that stores CUI drawings. At Level 2, the SSP documents it as a specialized asset and shows the boundary that separates it, so the assessor checks the documentation and the separation. In the second design, the controller shares a network segment with the engineering systems that hold CUI. Its position makes it a CUI asset, so it falls under the requirements that apply to CUI assets, and a controller that cannot meet them has no clean path to a passing score without an enduring exception documented in the SSP.

The 13 July 2026 suspension of CMMC Phase II and the Phase 1 status described on the DoW CIO page do not change the scoping rules in the rule text. The asset categories in 32 CFR 170.19 still govern how each device is treated. Confirm the current schedule with the Department of War before you commit budget to segregation work, and confirm whether your contracts require Level 3 or any enhanced scope. The practical step does not wait for that answer: build an asset inventory that tags every device as a CUI asset, security protection asset, contractor risk managed asset or specialized asset, and write those treatments into the SSP now.

How to write an enduring exception into the SSP so it scores as MET

This sequence turns an asset that cannot meet a Level 2 requirement into a documented SSP entry with mitigations, an owner and a review cycle, so the assessor can score the exception as MET. The result is a traceable record that ties the asset, the requirement and the compensating controls together.

Inventory the asset and its asset category
Start by naming the specific device, system or equipment that cannot meet the requirement, such as a medical device, a programmable logic controller, an IoT sensor or a test bench. Record its make, model, firmware version, location and the CUI workflow it touches, then assign it to its asset category in the scoping decision. Under 32 CFR 170.19(c), specialized assets such as IoT, OT and test equipment are documented but not assessed, so confirm whether the asset is truly specialized or whether it processes or stores CUI, which would move it into scope. The check that closes this step is a row in the asset inventory linked to a documented category decision.
Identify the requirement the asset cannot meet
For each asset, list the specific Level 2 requirement IDs it cannot satisfy, using the CMMC format such as AC.L2-3.1.1 or SC.L2-3.13.11. Work from the assessment objectives in NIST SP 800-171A rather than from the asset vendor's marketing sheet, and test each objective against the device's actual configuration. Ask the vendor in writing whether patching, password changes, logging or encryption are supported, and record the answer. The output is a requirement-by-requirement list that names each gap, which becomes the basis for the exception.
Document why full compliance is not feasible
Write the technical or operational reason the requirement cannot be met as stated, such as a vendor that forbids agent installation, a clinical device that cannot be rebooted for patching, or a test fixture that depends on an unsupported operating system. Attach supporting evidence, such as vendor documentation, a change request, a support statement or a test result showing the failure. Keep the explanation specific to the asset and avoid general statements about legacy systems. The check is that a reviewer could reproduce the infeasibility from the written record alone.
Describe the mitigations for each exception
For each unmet requirement, describe the compensating controls that reduce the risk, such as network segmentation into a purpose-specific network, monitoring of traffic to and from the asset, restricted administrative access through a managed jump host, removal of unneeded services, and documented manual review of logs. Explain how each mitigation addresses the risk the original requirement was meant to control, in your own words. Where a mitigation depends on another system, reference that system's SSP entry. The output is a mitigation table that maps each control to the exception it supports.
Record the owner and review cycle
Name a single accountable owner for the exception, usually the system owner or the operations manager responsible for the asset, along with a deputy. Set a review cycle that the organization can keep, and define the triggers that force an earlier review, such as a firmware change, a new network connection, a vendor end-of-support notice or a security incident. Record the date of the last review and who approved the exception. Confirm the cycle with your own governance process, because no review interval is specified in the researched facts for this purpose. The check is a signed or approved record naming the owner, the approver and the next review trigger.
Write the enduring exception into the SSP
Enter the exception in the system security plan under the section covering the asset category, stating the asset, the requirement, the reason, the mitigations, the owner and the review cycle. Under 32 CFR 170.24(b) and the DoD Assessment Methodology, an enduring exception described in the SSP with its mitigations is assessed as MET, so the entry should read as a complete, final-form statement and not as a draft. The DFARS 252.204-7012(b)(3) clause also allows other security measures for dynamic or special circumstances to be addressed in a system security plan. The output is a finished SSP section that a third party can read without asking the author for context.
Cross-reference the SSP and any POA&M
Link the SSP entry to the asset inventory, the network diagram showing segmentation, the monitoring records and the relevant evidence files, so an assessor can trace each claim. Where the exception covers only part of a requirement, or where a remediation date is known, record the remaining gap in the plan of action and milestones under 32 CFR 170.21 and make sure the two documents agree. Confirm with your assessor or CMMC advisor how they expect a permanent exception differs from a temporary POA&M item, since the decision affects scoring. The check is that every exception appears in the SSP, the inventory and, where needed, the POA&M with matching identifiers.

Treatment by environment: OT on the factory floor, IoT in facilities, test equipment in labs

Operational technology on a production floor includes programmable logic controllers, human-machine interfaces, supervisory control systems, and robotics that run machines and processes. Many of these devices were built for availability and deterministic timing, often run vendor-supplied operating systems, and cannot take agents or frequent patches. Under 32 CFR 170.19(c), specialized assets such as OT are documented in the SSP but not assessed at Level 2, provided they are not the systems that process, store or transmit CUI. Where OT shares a network path with CUI systems, the contractor must either separate it physically or logically, or treat it as in scope for the relevant requirements.

Typical assets: PLCs, HMIs, historians, engineering workstations, and drive controllers.
Usual separation: a purpose-specific OT network with a controlled boundary device between the plant network and the business network that holds CUI.
Assessor documentation: a current asset inventory, a network diagram showing the boundary, and the SSP entry naming each OT asset category and its treatment.
Vendor limits: many controllers cannot be patched or hardened by the contractor, so compensating controls such as segmentation and access restriction become the documented measures.
Remote access: vendor support sessions into OT should be listed in the SSP with the approval, session logging, and mitigations used.

Confirm with each OT vendor which configuration changes, firmware updates, and logging options their products support before you write the SSP entry.

Government furnished equipment and restricted systems

Government furnished equipment and restricted information systems are named specialized assets, so they are excluded from a Level 1 assessment, and at Level 2 they follow the asset category rules in 32 CFR 170.19(c) rather than the full CUI treatment. The practical test is not the label on the device but two facts you can verify: whether your organization controls the device's configuration, patching and access, and whether it ever stores, processes or transmits CUI. A government-owned laptop that you administer and that touches a CUI enclave is a different case from a government-issued instrument on a standalone bench that never reaches your network. Work through each GFE item and record which category it falls into before you draft the scope.

Whatever category you assign, the System Security Plan must state how each in-scope asset category is treated, including specialized assets such as GFE and restricted systems, under the documentation requirement in 32 CFR 170.19(c). For any GFE that is assessed as specialized but connected to CUI, the SSP should describe the separation or segregation, who owns the device, which government requirements govern it, and any compensating measures you apply. Where a device cannot meet a requirement and that limitation is enduring, document the exception and its mitigations so an assessor can score it under the approach described in the CMMC Program final rule.

Confirm treatment in writing before you assess. The contracting officer and the program office set the rules for government property, including what the government requires you to do with it, and those requirements can be stricter than the CMMC scoping rule. Ask the contracting officer to confirm whether specific GFE items or restricted systems must be included in your assessment boundary, and ask the program office whether any government-mandated controls apply. The Level 3 rules in SI.L3-3.14.3e are a separate question that only matter if your contract requires Level 3. Keep the written answers with your SSP so the scoping decision is traceable.

What must be in place before an assessor reviews specialized assets

An assessor will not accept a specialized asset on assertion alone. Five checks connect the inventory, the network picture, the SSP text, the exception records and the working separation controls, so each claim about an OT, IoT, test equipment or GFE asset can be traced to evidence before the assessment begins.

Complete asset inventory with category tags

Every system component that touches the assessment boundary needs an entry, and each entry needs a category tag: CUI asset, security protection asset, contractor risk managed asset, or specialized asset. Under 32 CFR 170.19(c), the category decides how the asset is treated, so an untagged device leaves the assessor guessing. Check that OT controllers, IoT sensors, lab instruments and government furnished equipment each appear by name, model and location. Confirm that the inventory owner is the IT or asset management lead, and that the inventory is reconciled against network discovery at least once per review cycle.

Current network diagram showing separation

The diagram must show where specialized assets sit relative to CUI systems, including every firewall, VLAN and gateway between them. An assessor uses it to decide whether an asset is segregated (and therefore out of scope) or inside the boundary. Check that the diagram matches the live configuration, not the design from the original deployment, and that it is dated and approved by the system owner. Ask the network engineering lead to walk the diagram against the firewall rule base before the assessor arrives.

Dated SSP section per asset category

The system security plan must describe how each asset category is treated, with a date and a revision history. Keep one section for CUI assets, one for security protection assets, one for contractor risk managed assets, and one for specialized assets such as IoT, OT and test equipment. A section that is undated or describes a network that no longer exists invites findings. Check that each section names the control owner and the review date. The compliance lead owns the SSP, while technical owners supply the content for their domains.

Enduring exception entries with mitigations and owners

Where a specialized asset cannot meet a requirement, such as a medical device or a test rig with a vendor-locked operating system, the exception must appear in the SSP with the compensating mitigations. Each entry needs a named owner who is accountable for the mitigation, and a rationale explaining why full compliance is not feasible. Check that every exception traces to a specific asset from the inventory and that no entry is a blanket statement covering a whole category. The engineering manager for that equipment usually owns the technical rationale, and the compliance lead confirms the wording.

Evidence that separation controls operate

A diagram and a policy do not prove that segregation works. Collect firewall rule exports, access control lists, and logs showing that traffic between specialized assets and CUI systems is denied or restricted as documented. Test at least one path by attempting a connection that should fail and capturing the result. Confirm that the evidence is in final form and dated within the review period. The network security team owns these records, and the internal audit or compliance function samples them to verify the controls function as described.

Which treatment to choose for a given asset

This table compares the three ways to treat a specialized asset such as OT, IoT, test equipment or GFE in a Level 2 scope. Read each row to see when the option fits, what evidence it produces and the main risk it carries. The main takeaway is that an asset separated from CUI or categorized as specialized can be documented and excluded, while an asset that touches CUI needs an enduring exception or segregation.

Treatment	When it fits	Evidence it produces	Main risk
Document and exclude at Level 2	Asset is categorized as a specialized asset under the scope rules, or is physically or logically separated from CUI assets so it is out of scope	SSP entry stating the asset category, why it is treated that way, and how it is separated or classified	Separation is weaker than described, so a CUI path exists that the assessor finds and the asset is reclassified
Enduring exception with mitigations	Equipment cannot meet a specific requirement over the long term, such as a medical device, test rig or legacy controller that cannot take required updates or authentication	SSP description of the exception, the requirement affected, compensating mitigations and their implementation records	Exception is assessed as MET only while the described mitigations hold, so drift in mitigations invalidates the score
Segregate into a purpose-specific network	Asset must communicate with CUI systems or Level 3 scope applies and the asset cannot be brought into the enhanced requirements directly	Network diagrams, boundary and segmentation rules, firewall configuration, and records showing the asset stays in its own zone	Misconfigured routes, shared credentials or remote access that bridge the zone back into CUI systems
Effort driver: asset inventory	Every option starts with a complete list of specialized assets and their connections to CUI	Inventory with owner, function, network path and data flows for each device	Unknown devices or undocumented connections push assets into the wrong treatment
Effort driver: vendor dependence	Equipment is supplied or maintained by a manufacturer who controls firmware, remote access or patching	Vendor letters, maintenance records and remote session logs where the vendor connects	Vendor remote access becomes an unmanaged path into the boundary
Effort driver: Level 3 applicability	The contract or program requires Level 3 so specialized assets must be in enhanced scope or segregated	Level 3 scoping decision and purpose-specific network records	Choosing exclusion at Level 2 for an asset that Level 3 later requires to be included

Who owns the asset decision, who prepares the evidence and who assesses it

The organization owns every decision that defines its CMMC boundary and every risk it accepts. No outside party can make the scoping call for a specialized asset, because the asset category it falls into changes what the assessor tests and what the system security plan must say. The organization's leadership, typically the executive who signs the affirmation, is accountable for whether the stated treatment is true and stays true.

Scoping decision: Decide whether each IoT, OT, test equipment, government furnished equipment or restricted system is CUI, security protection, contractor risk managed, specialized or out of scope, and record the reasoning.
System security plan: Write and maintain the SSP entries that describe how each in-scope asset category is treated, in the organization's own words.
Risk acceptance: Name the accountable owner for every enduring exception and approve the mitigations that come with it.
Separation proof: Own the network and physical controls that make an asset out of scope, and keep evidence that they operate.
Affirmation: Ensure the Affirming Official can stand behind the stated scope when the status is posted.

Before the assessment, confirm that each asset decision has a named owner and a dated rationale that matches the network as it actually runs.

Questions buyers ask about specialized assets in a CMMC assessment

Can an IoT sensor be left out of CMMC Level 2 scope?

Sometimes, but the decision depends on what the sensor touches, not on the device type alone. Under 32 CFR 170.19(c), specialized assets such as IoT devices are documented in the system security plan but not assessed against the requirements. That treatment only applies if the device is a specialized asset. If the sensor stores, processes or transmits CUI, it is a CUI asset and falls under the full assessment. Assets that are physically or logically separated from CUI assets are out of scope. For each sensor, confirm three things: whether it touches a CUI system, how it is separated if it does not, and whether the SSP records its category and the reason for that category. An assessor will test the boundary, so the separation must be real and documented, with a current network diagram that shows it.

What does an assessor ask for on operational technology systems?

The assessor will first ask how each OT system is categorized and where it sits relative to CUI. Expect requests for an asset inventory that lists OT devices with their category, a network diagram showing the boundary between OT and CUI systems, and the SSP sections that explain how each category is treated. If OT is separated, the assessor will want evidence of that separation, such as firewall rules, segmentation configuration and access controls on the boundary. If OT is documented as a specialized asset, the SSP must state that treatment and the reason for it. Level 3 adds requirements for specialized assets, but Level 2 focuses on accurate categorization and documentation. Vendor manuals, maintenance records and change records for OT devices help show the system as described. Confirm your approach with your C3PAO or contracting officer before the assessment.

Is an enduring exception a POA&M item?

Usually not, when the exception is documented correctly. Under 32 CFR 170.24(b) and the definitions in 32 CFR 170.4, an enduring exception, such as a medical device, test instrument or OT component where full compliance is not feasible, is assessed as MET when the system security plan describes it along with its mitigations. A plan of action and milestones is for deficiencies that you intend to correct, and the POA&M rules in 32 CFR 170.21 apply to those. The distinction matters because a POA&M item implies a planned fix, while an enduring exception implies a permanent condition managed by mitigations. Describe the condition, why full compliance is not feasible, the compensating measures and how you review the exception over time. Ask your assessor to confirm how they will score each exception before the assessment begins.

How does DFARS 252.204-7012(b)(3) apply to specialized equipment?

DFARS 252.204-7012(b)(3) lets a contractor apply other security measures when it reasonably determines they are needed. The clause covers dynamic environments or special circumstances, and it gives medical devices as an example. It also covers individual, isolated or temporary deficiencies. The clause states that these measures may be addressed in a system security plan. For specialized equipment, this provides the basis for documenting compensating measures that differ from the standard requirements. The determination must be yours and must be reasonable, so record why the equipment cannot meet the requirement, what risk remains and what measures reduce it. Keep the record current as the equipment or environment changes. Clause 252.204-7012 is a contract obligation separate from the CMMC assessment, so align the SSP entry with what you have told the contracting officer.

What evidence must a team prepare for specialized assets?

Prepare evidence that shows each specialized asset, its category and its treatment. The core set includes an asset inventory with a category for every device, the SSP sections that document each category and the reason for it, and current network diagrams showing any separation from CUI systems. For enduring exceptions, record the condition, the mitigations and the review schedule. Keep configuration exports, firewall or segmentation rules and access control lists that support the separation claim. Maintenance and vendor records help show the equipment is what the documentation says. Evidence must be in final form. Drafts, unsigned documents or spreadsheets with unresolved notes will not count. Keep records together in one repository with version history, so the assessor can trace each statement in the SSP to its supporting evidence. Confirm the exact evidence list with your assessor.

Does the Phase II suspension change how specialized assets are treated?

The suspension changes timing and certification requirements, but it does not change how the rule classifies specialized assets. On 13 July 2026 the Department of War suspended CMMC Phase II, which had required Level 2 C3PAO certification for applicable contracts, and started a 60-day review by a CMMC Reform Task Force. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. The scoping rules in 32 CFR 170.19 are part of the rule text, so the treatment of specialized assets still applies to any Level 2 self-assessment. The DoW CIO page also describes implementation as paused. Treat the suspension as a schedule change, not a scoping change, and keep the SSP accurate, because your affirmation and any future assessment will rely on it.

How DeployOpen scopes specialized assets and prepares the SSP evidence

DeployOpen plans and implements the network separation that decides whether a specialized asset stays out of the Level 2 assessment boundary or must be assessed. Before any hardware is moved, the scoping work lists every OT controller, IoT sensor, test rig and government furnished item, then records which category each falls into under 32 CFR 170.19(c): CUI asset, security protection asset, contractor risk managed asset, specialized asset, or an asset physically or logically separated from CUI. Where a test instrument or machine controller can reach a CUI enclave, we design the segmentation, deny-by-default rules and management paths that keep it outside that boundary, and we configure them in your cloud accounts, data center or air-gapped network. The organization owns the decision and must confirm it with its assessor before relying on it.

Once the boundary is set, DeployOpen drafts the system security plan entries that show how each asset category is treated, along with the enduring exceptions for equipment that cannot meet a requirement, such as a medical device or a legacy instrument. Each exception needs a written description, the compensating mitigations, the owner, and the review trigger, so that an assessor can see it is documented rather than ignored. We also collect the supporting evidence in final form: network diagrams, firewall and segmentation configurations, asset inventory extracts and the mitigation records. Retainer support covers keeping these records current when equipment is added or replaced.

Engagements are fixed-scope and agreed in writing before work starts, with the asset list, network changes, SSP sections and evidence deliverables named. DeployOpen does not issue assessment reports, attestations or certifications. Only an independent assessor determines whether the treatment of specialized assets is acceptable, so ask the assessor early whether it agrees with the categories and exceptions before the assessment begins. Confirm the current assessment requirements with the Department of War's CMMC pages, as the program schedule has changed since its original publication.

CMMC specialized assets: OT, IoT, test equipment and GFE