Begin with an information route
Pick an actual contract process and trace where FCI is received, created, stored, used, and sent. Ask the person who performs the work to demonstrate a normal day using a safe sample. An administrator may know the network, while an operations employee knows about the shared mailbox, download folder, or printed work packet that the diagram omitted.
The Level 1 scoping rule focuses on systems that process, store, or transmit FCI. It also directs organizations to consider people, technology, facilities, and external service providers. Use that breadth to challenge a boundary drawn only around equipment the company owns.
Create an inventory that can be checked
Record each relevant system or service, its business purpose, the type of information handled, an owner, and its connection to other systems. For remote work, include the location and device arrangements without collecting unnecessary home details in a public or generic tool. Identify which facts were observed and which remain assumptions.
An illustrative route might read: customer mailbox → approved cloud workspace → managed laptop → controlled print process. Ask what happens when an attachment is forwarded, a file is synchronized for offline work, or a person uses an alternate device. These branches often reveal more than a list of installed software.
Apply the official exceptions carefully
32 CFR 170.19 distinguishes in-scope systems, out-of-scope systems, and specialized assets for Level 1. Specialized assets have specific treatment under the rule; they should not be casually folded into ordinary endpoint assumptions. The regulation also describes a narrowly configured virtual desktop endpoint case.
Do not declare a device outside scope merely because it is personal or because a policy discourages storing files there. Determine what the device actually processes, stores, or transmits and examine the applicable technical configuration. When a technical design depends on a specific exception, document the rationale internally and have a knowledgeable reviewer check it.
Turn the drawing into questions people can answer
A useful scope diagram shows information routes, relevant systems, and boundaries in language an operations manager can explain. Add a short statement of what is covered and where questions remain. Supporting records are practical planning aids; do not misrepresent them as mandatory Level 1 document formats.
Review the scope before the self-assessment and when workflows change. A new file-sharing service, acquisition, location, or subcontract may alter the answer. Resolve unknowns before the Affirming Official is asked to rely on the assessment. The goal is a defensible understanding of the actual environment, not the smallest possible picture.