32 CFR 170.19 · Specialized Assets
Operational technology in your CMMC scope
If you run a production floor, some of its equipment may belong in your CMMC documentation. On every subscription tier, Enclave AI™ records it as a Specialized Asset and drafts a Specialized Assets section for your SSP from what you record, to support the documentation 32 CFR 170.19 describes.
What 32 CFR 170.19 says today
- Level 1: Specialized Assets are “not part of the Level 1 CMMC Assessment Scope” and are “not assessed against CMMC security requirements” (170.19(b)(2)(ii)).
- Level 2: a Specialized Asset is one that “can process, store, or transmit CUI but are unable to be fully secured”. OT that cannot, and that provides no security protection for CUI Assets, is an Out-of-Scope Asset.
- Level 2 duties for Specialized Assets: document them in the asset inventory, document their treatment in the SSP, show they are managed under your own risk-based security policies, procedures and practices, and document them in the network diagram of the CMMC Assessment Scope.
- The Level 2 assessor’s instruction for these assets: “Review the SSP. Do not assess against other CMMC security requirements.”
- The platform computes no SPRS points for Specialized Assets. Your inventory, SSP and network diagram still have to account for them.
What the platform does
- You answer whether you operate OT that can handle CUI or FCI at onboarding, or later from your workspace.
- You record each OT, IIoT, IoT, GFE, Restricted Information System or Test Equipment item with its type, the policy that manages it, whether it is in your network diagram, and whether you treat it as an Enduring Exception and why.
- Your SSP gets a Specialized Assets section built from those records, and your CUI Scoping Package lists them by type.
- The platform does not scan OT networks. OT entries are what you record, and the documents say so.
Sources: ecfr.gov 32 CFR 170.19 and 170.4; DoD CIO CMMC Scoping Guide Level 2, Version 2.13.
SCADA and OT security readiness is a separate product: ai4scada.ai.