Skip to main content

🔔 Notifications Hub: See compliance updates in one place

CMMC Enclave (CUI Enclave)

A CMMC enclave is a scoped segment of your IT environment dedicated to handling CUI. Instead of applying 110 NIST 800-171 practices across the whole company, you build a bounded network with specific workstations, storage, and users, and CMMC assessment applies only there. This is the usual strategy for managing CMMC cost and complexity.

Why Enclaves

Without an enclave, every endpoint that could touch CUI falls into assessment scope. For a 500-person company, that means 500 laptops under full NIST 800-171 controls plus the full Microsoft 365 tenant. With an enclave, you scope down to maybe 30 engineers, 30 workstations, a dedicated GCC High tenant, and a specific set of applications. The remaining 470 endpoints and the commercial M365 tenant stay out of scope.

Common Enclave Architectures

  • GCC High tenant: Full Microsoft 365 environment (Teams, SharePoint, Exchange, OneDrive) with FedRAMP High baseline controls. Users access via dedicated accounts.
  • Virtual Desktop Infrastructure (VDI): Users RDP or stream into a virtualized desktop inside the enclave. Local laptops stay commercial, the CUI never leaves the VDI.
  • Physical segmentation: Separate facility, separate network, dedicated workstations. Most common for OT-heavy environments or classified-adjacent work.
  • Azure Government Virtual Network with Azure Virtual Desktop: Hybrid of the previous two. IaaS/PaaS workloads in Azure Gov, accessed via AVD.

Designing an Enclave That Actually Works

  • Network segmentation: Firewall between corporate network and enclave, with explicit allow rules.
  • Dedicated identity: Separate accounts for enclave access, MFA enforced, no SSO federation with corporate identities without strict review.
  • File transfer controls: Define how data enters and leaves the enclave. One-way data diodes or managed file transfer appliances with DLP scanning.
  • Monitoring and logging: SIEM coverage of the enclave specifically, not just corporate. Log retention matching NIST 800-171 3.3.x requirements.
  • Endpoint protection: EDR on enclave endpoints, with alerts going to a team trained on the enclave's purpose.

Scoping Your Assessment

The C3PAO assesses what's in the CMMC Assessment Boundary defined in your SSP. If the boundary is clear and the enclave architecture holds up, the assessment stays focused. If CUI has escaped the enclave (say, someone forwarded a drawing to their corporate email), the assessor will expand scope to wherever that data went.

What Goes Wrong

  • Data spillage: CUI accidentally lands in commercial tools like personal email or commercial M365. This is the single most common finding.
  • Shadow IT: Engineers use a SaaS tool that isn't in the enclave because it's faster.
  • Collaboration friction: Working with subcontractors or government partners is harder in a locked-down enclave. Expect pushback.
  • Identity sprawl: Separate enclave accounts without lifecycle management leads to orphaned privileged access.