A specialized asset is a category defined in 32 CFR Part 170, the CMMC Program Rule, for equipment that processes, stores, or transmits Controlled Unclassified Information but cannot be fully configured to meet all 110 NIST SP 800-171 Rev 2 controls. The category matters because CMMC scopes the assessment differently for specialized assets than for general IT: they are in scope, but held to a reduced set of requirements.
What counts as a specialized asset?
The CMMC rule names five asset types:
- Government-Furnished Equipment (GFE): hardware the customer provides that the contractor cannot reconfigure.
- Internet of Things (IoT): networked sensors, cameras, and embedded controllers with no general-purpose operating system.
- Operational Technology (OT): PLCs, DCS, SCADA, HMIs, CNCs, and industrial controllers running firmware.
- Restricted Information Systems: systems whose configuration is fixed by contract, export control, or security classification.
- Test Equipment: calibrated instruments, probes, and measurement systems where a firmware change invalidates the calibration.
How does CMMC assess specialized assets?
Specialized assets are in scope but evaluated against a reduced requirement set. The System Security Plan must identify each one, document the CUI that flows to or from it, and describe the compensating controls protecting it. The C3PAO then verifies that those compensating controls are actually operating and that the Enduring Exception documentation is complete.
This is not a loophole. A specialized asset still has to be risk-managed; it just cannot be held to controls its firmware does not support. The contractor takes on the burden of proving risk equivalence at the network and process layers, and of producing evidence an assessor can inspect.
What do specialized asset scenarios look like?
- A CNC controller receives G-code files containing CUI technical drawings. It runs 10-year-old firmware with no TLS, no MFA, and no audit logs. It is a specialized OT asset. Compensating controls enforce identity, encryption, and logging at a network proxy in front of it.
- A calibrated pressure sensor on a munitions test stand transmits readings over serial and has no concept of authentication. It is specialized test equipment. Physical access control and network isolation are the compensating mechanisms.
- A government-furnished inspection camera sits on a segment that touches CUI data flows. Its firmware is owned by the customer. It is GFE, and the boundary drawn around it is the control.
Why do specialized assets matter for OT environments?
Because most defense manufacturing runs on exactly this kind of equipment: unpatchable controllers, decade-old firmware, and instruments that cannot be reconfigured without breaking calibration or warranty. The specialized-asset category is what lets a contractor keep that gear in production and still pass a CMMC assessment, provided the compensating controls at the OT security boundary are real and provable. The risk moves off the device and onto the network, which is where it can actually be managed.
Related terms
- CMMC Enduring Exception
- Compensating Control (CMMC)
- Operational Technology Security
- Controlled Unclassified Information
- Programmable Logic Controllers
How Access Gate helps
Access Gate protects specialized assets by enforcing identity, encryption, and audit at the network layer, producing C3PAO-ready evidence for equipment that cannot satisfy the controls itself. See CMMC Enduring Exceptions for OT.
