CMMC Scoping Pitfalls
The Hidden Issues That Derail CMMC Readiness
DATE
28 JAN 2026
TIME
9:00am PT | 12:00pm ET
WEBINAR
Register now!
By completing this form, I consent to receiving calls, texts and/or emails from CyberSheath regarding services and programs.
Getting CMMC scoping right is the foundation of a successful assessment. It is also one of the most misunderstood and error-prone parts of the compliance process.
Many organizations jump into policies, tools, or control implementation without clearly defining the systems, assets, people, and processes that are truly in scope. This often leads to unnecessary boundary expansion, missed CUI locations, overlooked high-risk assets, and assessment failure.
In this webinar, we break down the most common CMMC scoping pitfalls that contractors encounter. You will learn how to spot hidden risks early, apply scoping guidance correctly, and avoid the mistakes that assessors see regularly.
What You’ll Learn
By the end of the session, you will learn:
- The most frequent scoping errors that cause organizations to fail or stall their readiness
- How CUI misclassification expands risk and increases the assessment burden
- Techniques to right-size your CMMC boundary without compromising compliance
- What assessors look for when reviewing your scope and why accuracy matters
- Practical steps to ensure your scoping aligns with CMMC 2.0 expectations
Why Attend?
With CMMC Phase 1 now active and third-party certification requirements going live in 2026, getting CMMC scoping right is the foundation of a successful assessment.
Whether you are beginning your CMMC journey or preparing for a formal assessment, this session provides practical strategies, real-world examples, and a clear path to defining a defensible CMMC scope.
Who Should Attend?
- Defense contractors and subcontractors in the DIB
- Organizations preparing for CMMC Level 2 or considering Level 3
- IT and security professionals driving NIST 800-171 and CMMC compliance
- Executives responsible for DOD contract eligibility and risk management
Next Steps:
Join us to ensure your CMMC readiness effort does not get derailed before it even begins.
Erik Winkler
Partner, Federal, ControlCase
Erik has over 20 years of experience in the security and information technology industry. His experience includes performing and managing diverse IT projects and audits, network security assessments, network/application security and architecture design and information security policy development projects. He has served clients in the Financial Services, Retail, Manufacturing, and Healthcare industries, including many industry sector leaders. Erik leads our Federal Services group that specializes in providing certification services to our government clients. He holds a Master’s degree in Engineering Physics from the University of Virginia.
Casey Lang
CyberSheath SVP of Compliance
Casey Lang has over ten years of experience in cybersecurity, business resilience, and information technology from various roles in industries such as defense, healthcare, and retail. He has expertise in CMMC compliance, security program development and assessment, and has extensive experience in strategically planning security and business continuity programs based upon internationally recognized standards of practice from NIST, ISO, FISMA, and the PCI-SSC.