Specialized assets is a category defined in 32 CFR Part 170 — the CMMC Program Rule — for equipment that processes, stores, or transmits Controlled Unclassified Information but cannot be fully configured to meet all 110 NIST SP 800-171 Rev 2 controls. The category matters because CMMC scopes assessment differently for specialized assets than for general IT.
What counts as a specialized asset
The CMMC rule identifies five asset types:
- Government-Furnished Equipment (GFE) — hardware provided by the customer that the contractor cannot reconfigure.
- Internet of Things (IoT) — networked sensors, cameras, and embedded controllers without general-purpose operating systems.
- Operational Technology (OT) — PLCs, DCS, SCADA, HMIs, CNCs, and industrial controllers running firmware.
- Restricted Information Systems — systems whose configuration is constrained by contract, export control, or security classification.
- Test Equipment — calibrated instruments, probes, and measurement systems where firmware changes invalidate the calibration.
How CMMC treats specialized assets
Specialized assets are in scope for the assessment but are evaluated against a reduced set of requirements. The SSP must identify each specialized asset, document the CUI that flows to or from it, and describe the compensating controls that protect it. The C3PAO will verify that the compensating controls are operating and that the Enduring Exception documentation is complete.
This is not a loophole. An asset marked as specialized still has to be risk-managed; it just cannot be held to controls its firmware does not support. The contractor takes on the burden of proving risk equivalence at the network and process layers.
Typical scenarios
- A CNC controller receives G-code files that contain CUI technical drawings. The controller runs 10-year-old firmware with no TLS, no MFA, and no audit logs. It is a specialized OT asset. Compensating controls enforce identity, encryption, and logging at the network proxy in front of it.
- A calibrated pressure sensor on a munitions test stand transmits readings over serial. It has no concept of authentication. It is specialized test equipment. Physical access control and network isolation are the compensating mechanisms.
- A government-furnished inspection camera sits on a segment that touches CUI data flows. Its firmware is owned by the customer. It is GFE. The boundary around it is the control.
Related terms
- CMMC Enduring Exception
- Compensating Control (CMMC)
- Operational Technology Security
- Controlled Unclassified Information
- Programmable Logic Controllers
Access Gate connection
Access Gate protects specialized assets by enforcing identity, encryption, and audit at the network layer — producing C3PAO-ready evidence for assets that cannot satisfy the controls themselves. See CMMC Enduring Exceptions for OT.
