Start with the work performed
Describe the contract activity, the information used, and the people and systems that touch it. Include remote work, portable devices, printers, collaboration services, backups, and administrative access. A boundary should describe reality in enough detail that another reviewer can follow the information from receipt through disposal.
Use the correct asset categories
Level 2 scoping distinguishes CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets, and Out-of-Scope Assets. These categories have different documentation and assessment treatment under 32 CFR 170.19. Do not remove an asset from consideration simply because its primary purpose is not to store documents.
Account for service providers
An external provider may handle CUI or security protection data, administer in-scope assets, or deliver security functions. Document the services and the allocation of responsibilities. Cloud service use brings additional requirements where CUI is processed, stored, or transmitted. A commercial marketing claim about being compliant does not replace a review of the relevant offering and responsibilities.
Keep scope connected to change management
Give the inventory and diagram owners and review dates. Revisit the boundary when onboarding an application, moving backups, changing an MSP, or starting a new contract. Record the reasoning behind exclusions so the next review can test whether the facts remain true. Scope is an operational record, not a one-time drawing.