OSC — Am I in scope?

The Microsoft 365 GCC High tenant becomes a CUI Asset under the CMMC Scoping Guide Level 2 the moment any service in it processes, stores, or transmits CUI — and most C3PAOs default to assessing the full tenant under all 110 Level 2 requirements unless the OSC documents a narrower boundary. Per 32 CFR § 170.19(c)(2), the SSP must describe the M365 architecture at the service level (SharePoint, OneDrive, Teams, Exchange) with the Microsoft Purview sensitivity labels, Conditional Access policies, and DLP rules that enforce the CUI boundary. The contractor whose CUI is "somewhere in the tenant" walks into a much larger assessment than the one whose CUI sits in a dedicated CUI site collection.