Is This Mac in Your CMMC Scope?

Four questions. The categories and the assessment consequences are quoted from 32 CFR 170.19, so the answer is the regulation's rather than ours.

Nothing you answer leaves this page. No server, no account, no storage. There is no code on this page that can send anything. Open your Network tab, answer the questions, and watch it stay empty.

Answer the questions in order. The first yes decides the category, which is the regulation's own precedence: an asset that handles CUI is a CUI Asset even if it also provides a security function.

Planning use only. This is not an assessment finding, not a CMMC status, and not legal advice. Scoping decisions are yours to make and defend, and your architecture may move an asset. Do not enter CUI, FCI, credentials or system configurations anywhere on this page. There is nowhere to enter them by design.

Want the reasoning, not just the answer? Mac asset classification for CMMC walks the same five categories step by step, with the VDI nuance, the Specialized Asset edge cases, and where the classification has to be recorded once you have it.

This tool forgets. Your inventory should not.

The classifier gives you an answer and stores nothing. The asset inventory workbook in the suite is where that answer lives permanently, with the reasoning, the owner and the review date that an assessor will ask about.

See what is in the suite

Mac-first, one-time purchase, no subscription.

Where this fits