Most CMMC questions have specific answers. The difficulty is that the answers live across 32 CFR Part 170, the DoD scoping guides, NIST SP 800-171 Revision 2, and the DFARS clauses, and pulling them together takes longer than most contractors have. Each entry in this series takes one question, states the answer, and walks through the regulatory chain that produces it. The questions come from the field: LinkedIn polls, client conversations, and the recurring points of confusion that show up in scoping reviews.
-
Scoping
Are Office VoIP Phones in Scope for CMMC?
Employees discuss CUI on the office phones. Most contractors assume phones are office equipment rather than information systems. The rule text says otherwise, and the scoping consequences reach further than the handsets.
About This Series
Each answer in this series follows the same discipline applied in the firm's white papers: the answer is stated first, every claim is traced to a primary source, and the references link to the canonical text at eCFR, acquisition.gov, csrc.nist.gov, or dodcio.defense.gov. Nothing rests on vendor summaries or secondhand interpretation.
New questions are added as they arise from polls and practice. Longer treatments of related topics are available in the white paper library.