Services / Module A: Scope & Boundary Package

Documentation · Module A

Your scope decisions, turned into documents an assessor can read

For contractors whose scope is settled but undocumented — the boundary exists in heads, not on paper.

Already done the Sprint? You don't need Module A — the Sprint already produces these exact deliverables (a $5,500 saving). Module A is sold standalone, only to clients starting from a completed Gap Analysis.

$5,500

Fixed fee — invoiced 100% at signing

2 weeks

From complete document checklist

Gap-first only

Not sold to Sprint clients — the Sprint already produces these deliverables

A scope that isn’t written down doesn’t exist

When a C3PAO asks "why is this system out of scope?", the answer has to be a document, not a conversation. Undocumented boundaries are re-litigated during assessment — at the worst possible time, with assessment fees already paid.

Module A converts your scoping decisions into the formal artifacts the assessment process expects: asset inventory, boundary diagrams, and written justifications for every exclusion.

What you get in 2 weeks

CUI asset inventory

Every in-scope asset categorized per CMMC scoping guidance — the list your assessor opens first.

Boundary diagrams

Network and data-flow diagrams showing where the assessment boundary sits and why — drawn for assessors, usable by your IT team.

Exclusion justifications

A written rationale for every system kept out of scope, in the language assessors expect to see.

Scope boundary decision document

The written boundary decision: CUI flows, at least two boundary options with tradeoffs, provider responsibilities (including your MSP), and the rationale for the option you approve — signed with a named approver and date.

Two weeks, week by week

Gate

Your clock starts here

SOW signed + payment + document checklist complete = your clock starts. Until then, nothing is counting against you.

Week 1

Inventory and diagramming

Asset categorization from your gap analysis, plus boundary and data-flow diagrams drafted and reviewed with your IT contact.

Week 2

Justifications and assembly

Exclusion rationales written, the boundary decision documented with at least two options, and a 30-minute decision call where you choose the boundary — then the package is assembled with one consolidated revision round.

Week 2 · close

Recorded debrief

A recorded walkthrough of every finding and deliverable — so your team can replay it, and nothing lives only in one person’s head.

What we need from you

This checklist is how your timeline stays protected — the clock starts when it's complete, so nothing stalls mid-engagement.

✓ A completed Gap Analysis — from Lumos or a third party (Module A is built from those findings, not from scratch)

✓ Current network documentation, in whatever state it exists

✓ Your MSP or cloud service agreements, if any

✓ One consolidated round of stakeholder feedback in week 2

Is Module A what you need?

Module A works well for:

✓ Gap Analysis clients whose scope decisions now need formal documentation
✓ MSP-supported contractors who've never documented provider responsibilities
✓ Teams preparing for the SSP build that don’t want it stalled by missing scope artifacts

Not the right fit:

✗ Sprint clients — the Sprint already produced these exact deliverables; Module A isn't sold to you
✗ Scope still undecided — Module A documents decisions; the Sprint makes them
✗ Organizations wanting Lumos to perform the formal assessment — a C3PAO must do that
✗ Looking for hands-on technical implementation — your IT staff or MSP performs that work

Lumos is a solo practice led by a Cyber AB Registered Practitioner providing readiness advisory and documentation only — formal CMMC assessments are conducted by certified C3PAOs, and technical implementation is performed by your IT staff or MSP. CMMC readiness consulting is generally an allowable cost under FAR 31.205-33; confirm with your contracts team.

CISSP · ISSEP · CCSP · CSSLP · CISA · CISM · PMP Cyber AB Registered Practitioner 28 NIST engagements since 2017 Veteran & Native Hawaiian-Owned

Where this leads

Module A's artifacts are direct inputs to Module B — the SSP build cites the decision document, inventory, and diagrams on nearly every page. Sprint clients: your $2,000 credit applies to Module B.

Sprint / Snapshot Gap Analysis Module A Module B Module C Readiness Review Retainer

← Previous step: Full Gap Analysis Next step: Module B: SSP Build →

Questions about this engagement

I already did the Sprint — do I need Module A? +

No. The Sprint already produces these exact scope deliverables — the decision document, asset inventory, and boundary diagrams — so Module A isn't sold to Sprint clients; buying it would mean paying $5,500 for documents you already hold. Module A exists for clients who completed a Gap Analysis and now need the formal scoping document set.

Can we buy Module A without a completed gap analysis? +

No — Module A is built from completed gap-analysis findings, not from scratch. The gap analysis doesn't have to be Lumos' own: if a third party performed it, a short scope-confirmation call verifies those deliverables are complete and readable enough to scope from. Documentation built on unvalidated assumptions is exactly what fails under assessor scrutiny.

Our MSP says they "handle compliance." Does that change scope? +

It changes responsibility, not scope — and that's precisely what the provider-responsibility section of the decision document pins down. "The MSP handles it" is not an answer an assessor accepts; a written, named responsibility entry is.

What does the revision round cover? +

One consolidated round: your stakeholders gather all feedback, and it’s applied in a single pass. This is the fixed-fee discipline — it keeps the price honest and the timeline real.