CMMC Level 1applies toFederal Contract Information (FCI)systems.
Any system or device that is connected to an FCI-handling network is within the assessment scopebecause it canintroduce vulnerabilitiesinto the environment.
TheWi-Fi-enabled thermostat is connected to the FCI network, meaning it haspotential accessto sensitive contract-related data.
PerCMMC Scoping Guidance, this type of device is classified as aRestricted Information System (Restricted IS)—devices that do not store, process, or transmit FCI but areconnected to networks that do.
Restricted IS must be accounted for in the self-assessment scope to ensure they do not compromise security controls.
[Reference:, CMMC Level 1 Scoping Guidance, CMMC Assessment Process (CAP) Guide, Step 3: Why Other Answer Choices Are IncorrectA. No, because it is OT (Incorrect):, Operational Technology (OT)includesindustrial control systemsbut does not exempt a device from assessmentif it connects to an FCI network., B. No, because it is an IoT device (Incorrect):, IoT (Internet of Things) devicesthat areconnected to an FCI network must be assessedto ensure they do not create security vulnerabilities., D. Yes, because it is government property (Incorrect):, Theownershipof the device (government or company) doesnotdetermine its inclusion in the CMMC assessment scope—its network connectivity does., Final Confirmation of Correct Answer:The thermostat is part of the CMMC Level 1 Self-Assessment Scope as a Restricted IS., Thus, the correct answer is:C. Yes, because it is a restricted IS, , , , ]
Submit