Scoping defines which systems, users, assets, and connections fall inside the assessment boundary, based on how CUI is handled and how environments are segmented.