CMMC Enclave Strategy: How Defense Contractors Shrink Assessment Scope Without Losing the Business

Most defense contractors who look at CMMC Level 2 for the first time come to the same painful conclusion: making the entire company compliant with all 110 NIST SP 800-171 controls is going to be brutal.

Every laptop. Every server. Every SaaS tool. Every subcontractor. Every printer. Every mobile phone. Every backup. Every email inbox.

If you handle CUI on any of that, an assessor can look at any of that.

For a 30-person engineering firm with a mix of commercial and DoD work, that math does not work. It is not that CMMC is impossible. It is that trying to compliance-harden the whole business at once is a self-inflicted wound. You end up spending money on systems that do not touch CUI, slowing down commercial work that pays the bills, and still failing on the systems that actually matter.

The way experienced contractors solve this is not with more tools. It is with a smaller boundary.

That boundary is called an enclave.

The CMMC final rule in 32 CFR Part 170 puts the scope of assessment on any contractor information system that processes, stores, or transmits FCI or CUI, along with the security protection assets that defend those systems. Nothing in that rule says the boundary has to be the entire company network. If your CUI lives in a defined, isolated environment, that is the environment the C3PAO assesses. Everything outside the enclave that cannot reach CUI is out of scope.

This article walks through how small and mid-sized defense contractors design a CUI enclave, decide what belongs inside it, and defend that boundary to an assessor without gimmicks or wishful thinking.

What an Enclave Actually Is

An enclave is a purpose-built, logically or physically isolated environment inside your organization that is designed to be the only place CUI is processed, stored, or transmitted.

It has its own identity system, its own network segmentation, its own endpoint controls, its own monitoring, and its own access policies. Users enter it deliberately. CUI never leaves it without controlled processes. Everything else in the company — the commercial CRM, the shop floor iPad, the accountant's laptop, the marketing intern's Google Drive — sits outside that boundary and does not touch CUI.

An enclave is not a marketing term. It is a scoping decision.

Done well, it lets a 100-person contractor limit CMMC Level 2 assessment to maybe fifteen users, one virtual desktop environment, one SharePoint tenant, one file share, and the identity and logging services that support them. Done badly, it becomes a leaky boundary that assessors can drive a truck through, and the enclave becomes a lie the company tells itself.

The difference between the two is discipline, not budget.

Why Whole-Company Scoping Fails

Before designing an enclave, it helps to be honest about why the alternative is worse.

Whole-company CMMC Level 2 compliance means every workstation must meet endpoint hardening, FIPS-validated encryption, MFA, and monitoring standards. Every SaaS platform must be either FedRAMP Moderate or backed by a CMMC-authorized equivalent. Every user must complete role-based training. Every printer, phone, and camera must be accounted for. Every subcontractor with any access must be flowed down and evidenced. Every log must be retained and reviewed.

For a company where CUI is a fraction of the work, this means paying for compliance on systems that will never see a controlled drawing. It means slowing down commercial customers who do not care about DFARS. It means asking sales, HR, marketing, and finance to live under DoD-grade controls they neither understand nor need.

Owners try this for a quarter, run the numbers, and quietly decide CMMC is going to force them to walk away from DoD work.

The enclave strategy is how you avoid that outcome.

Step One: Find the CUI Before You Draw the Boundary

You cannot enclave what you have not identified.

The first work is not architectural. It is a CUI inventory. Which contracts flow down CUI? What kind of CUI is it — technical drawings, export-controlled data, personnel records, source selection sensitive information? Where does it currently live? Which employees touch it? Which subcontractors touch it? Which tools have ever seen it?

Assume the answer is worse than you think. Ask engineering where the last set of contract drawings ended up. Ask sales where proposal responses live. Ask HR whether cleared personnel records are stored anywhere convenient. Ask IT which SharePoint sites, Teams channels, and shared drives have contract data in them today.

The output of this exercise is not just a list. It is a heat map of where CUI is right now versus where you want it to be. Every location on the current map that is not on the future map has to be cleaned up or brought into the enclave.

Contractors who skip this step design enclaves that assessors immediately puncture. The assessor asks a project manager where the last CUI drawing was reviewed, and the answer is a personal OneDrive that the enclave design never accounted for. Boundary breached. Findings written. Assessment failed.

Step Two: Pick an Enclave Architecture That Matches the Business

There is no single right enclave. There are three common patterns, and the right one depends on how CUI actually flows through the business.

The first pattern is a cloud-based virtual desktop enclave. Users connect from any endpoint into a hardened virtual desktop that lives in a CMMC-eligible environment such as Microsoft 365 GCC High or a comparable authorized cloud. All CUI processing happens inside the virtual desktop. Endpoints act as thin clients. Copy and paste, printing, and local storage are disabled by policy. This pattern works well when the workforce is remote or hybrid, when CUI is primarily documents and drawings, and when the company already has strong identity infrastructure.

The second pattern is a dedicated on-prem or hybrid enclave network. A physically or logically separated network segment houses the CUI file server, engineering workstations, and print devices. Access is gated by hardware tokens, MFA, and network access control. Data leaves only through controlled transfer mechanisms. This pattern fits contractors doing hands-on engineering, manufacturing, or laboratory work where CUI touches physical processes.

The third pattern is a managed CMMC enclave from a specialized provider. Several vendors now offer packaged Level 2 environments that include GCC High, hardened endpoints, MDR, and compliance evidence. The contractor rents the enclave and inherits many controls from the provider. This pattern works well for smaller contractors who do not have the internal IT depth to build an enclave and defend it. It is not a magic button. The contractor still owns their side of the shared responsibility matrix, and assessors will still ask the contractor to prove it.

Most real deployments are a hybrid. A cloud enclave for documents. A segmented on-prem lab for hardware work. A managed provider for identity, logging, and monitoring. That is fine. The rule is not that the enclave must live in one place. The rule is that the boundary must be knowable, documented, and defensible.

Step Three: Draw the Boundary So an Assessor Can See It

An enclave that only exists in a Visio diagram is not an enclave. An enclave that shows up in your System Security Plan, your network diagram, your data flow diagram, your identity system, your DLP configuration, and your firewall rules is an enclave.

The boundary needs to be visible in four places:

• Documentation. The System Security Plan explicitly defines the CUI enclave, lists its assets, names its users, and describes its boundary controls. A network diagram shows the enclave, the systems inside it, and the interfaces to the rest of the environment. A data flow diagram shows how CUI enters, moves, and leaves.
• Identity. Users who can access the enclave are enumerated in a specific group or role. Their access requires MFA that meets NIST SP 800-63B AAL2 or better. Their entitlements are reviewed on a defined cadence. Users outside that group cannot authenticate to enclave systems, period.
• Network and application controls. Firewalls, conditional access policies, DLP rules, and endpoint policies enforce the boundary. Traffic between the enclave and the rest of the environment is limited to defined, monitored pathways. External sharing of CUI content is blocked or heavily controlled at the SaaS and endpoint layer.
• Monitoring. Logs from the enclave flow to a SIEM or managed detection service. Alerts fire on suspicious access, data movement, and configuration change. There is a documented, staffed process for handling those alerts.

If any of the four is missing, the enclave has a wall on three sides and open sky on the fourth. Assessors will notice.

Step Four: Decide What Is In Scope and What Is Not

Once the enclave exists, everything else in the business falls into one of three buckets.

CUI Assets. Systems inside the enclave that process, store, or transmit CUI. Fully in scope for all 110 controls.

Security Protection Assets. Systems that protect the enclave but do not themselves handle CUI — identity provider, SIEM, endpoint management, DLP, backup for CUI, MFA provider. In scope. Must be assessed against the controls that apply to how they protect CUI.

Contractor Risk Managed Assets. Systems that are capable of touching CUI but are managed by policy so that they do not. Assessors look at the policies and controls that keep those systems from becoming CUI systems. These are the trickiest assets to defend, and if the enforcement is weak, an assessor may pull them into full scope.

Out of Scope. Systems physically or logically incapable of processing, storing, or transmitting CUI, and not providing security protection to enclave systems. These are truly outside the assessment. Marketing laptops that cannot reach the enclave. Commercial CRM segregated from CUI workflows. Manufacturing systems for non-DoD product lines.

The clearer this classification is, the shorter the assessment gets. Every asset the contractor cannot classify becomes an asset the assessor can probe. Every asset the contractor overreaches to keep in the enclave becomes another 110-control burden.

The goal is to be honest and specific. Not to shrink the enclave so aggressively that it is not credible. Not to expand it out of paranoia. To draw a line the assessor can see, defend, and validate.

Step Five: Enforce the Boundary in the Real World

Enclave design fails in the tail of daily operations.

An engineer needs to email a drawing to a subcontractor and defaults to Outlook instead of the controlled transfer tool. A project manager takes screenshots of CUI to include in a slide deck stored in a commercial tenant. A new hire signs up for a personal AI assistant and pastes CUI into a prompt. A finance controller pulls contract data into a personal spreadsheet. Any one of these turns an enclave into a colander.

The enforcement layer has to be technical, procedural, and cultural.

Technical enforcement is DLP that blocks CUI from leaving the enclave through email, cloud sync, USB, print, or AI plugin. Conditional access that stops enclave sign-ins from personal devices and unsanctioned locations. Application allowlists that prevent unapproved SaaS from being installed inside the enclave. Copy-and-paste and clipboard restrictions between enclave sessions and the outside.

Procedural enforcement is a controlled process for every legitimate way CUI moves. How does CUI get shared with a subcontractor? Which tool. Which approvals. Which logs. How does CUI get destroyed at the end of a contract? Which media. Which certification. How is CUI backed up and where do the backups live? Which system, which encryption, which retention.

Cultural enforcement is repeated, contract-specific training. Not a generic once-a-year annual, but a briefing that names the actual contract, the actual CUI, the actual tools, and the actual do-nots for the people who touch it. Users who understand why the enclave exists are the strongest boundary control you have. Users who do not, are the weakest.

This is where a well-built policy library carries its weight. Written procedures for CUI transfer, media handling, sanitization, incident reporting, and access review make enforcement repeatable and auditable. The TalonPoint PolicyPack is designed to give small and mid-sized defense contractors that library out of the box, mapped to NIST SP 800-171 and CMMC Level 2, so the enclave has the documented process an assessor expects to see. It does not replace the boundary. It gives the boundary a policy backbone.

Step Six: Prove the Boundary Holds Under Assessment

Enclaves get tested three ways during a C3PAO assessment.

First, the assessor walks the paper. They review the SSP, the network diagram, the data flow diagram, the asset inventory, and the classification of every asset. They look for inconsistency. A system called out as out of scope on the inventory but shown connected to the enclave on the network diagram is a finding.

Second, the assessor walks the configuration. They inspect firewalls, conditional access policies, DLP rules, endpoint configurations, and identity groups to confirm the technical controls match the paper. A DLP rule labeled "block CUI to external" that is set to audit-only is a finding.

Third, the assessor walks the humans. They interview users, project managers, and administrators about how CUI moves in practice. They ask what people do when the controlled tool is inconvenient. They ask where the last CUI file actually ended up. They compare answers across roles. Contradictions become findings.

The enclave passes if all three walks tell the same story.

An enclave passes not because the diagram is pretty. It passes because the paper, the config, and the people all describe the same boundary, and that boundary is enforced.

Common Enclave Mistakes That Fail Assessments

A few patterns show up repeatedly on enclave assessments that fail.

The porous enclave. CUI lives inside the enclave, but users can email it out, sync it to personal devices, or paste it into external chat tools. The technical controls to stop that behavior are configured in audit mode or not at all. The enclave is a suggestion, not a boundary.

The paper enclave. The SSP describes an enclave that does not exist yet in production. The network diagram shows segmentation that the actual firewall rules do not enforce. The assessment reveals the gap between plan and reality.

The over-scoped enclave. The contractor put too much inside the enclave — commercial systems, general email, HR tools — and now every general-purpose system has to meet Level 2 controls. Assessment ballooned in scope. Costs ballooned. Findings ballooned. The team is exhausted.

The unmonitored enclave. The boundary controls are in place, but nobody watches them. Alerts fire and go nowhere. Access reviews are stale. Configuration drift is undetected. The enclave was strong on day one and has degraded ever since.

The subcontractor blind spot. The primary enclave is well-designed, but subcontractors receive CUI through channels the primary does not fully control. Flow-down clauses are in the contract, but there is no evidence anyone verified the subcontractor's environment. The primary's enclave is defensible; the subcontractor's is a mystery, and the CUI flowing to them is exposed.

The AI assistant leak. Users copy CUI content into personal or commercial AI tools to summarize, translate, or draft. Those tools sit far outside any enclave and were never in the SSP. This is the fastest-growing enclave failure of 2026.

None of these are theoretical. All of them have shown up in real Level 2 assessments in the past twelve months.

Where Enclave Strategy Fits in a Realistic Compliance Roadmap

For a small or mid-sized contractor coming into CMMC for the first time, a realistic enclave rollout looks something like this.

• Weeks 1–4. CUI inventory, contract review, and stakeholder interviews. Identify where CUI lives today, where it should live, and which users truly need access. Draft an enclave concept and get executive alignment.
• Weeks 4–12. Stand up the enclave architecture. Configure the identity provider, cloud tenant, virtual desktops or segmented network, endpoint management, DLP, and logging. Migrate CUI into the enclave and clean up legacy copies elsewhere.
• Weeks 8–16. Document the SSP, network diagram, data flow diagram, and asset inventory around the enclave. Rewrite policies and procedures to match the actual boundary and enforcement.
• Weeks 12–20. Train users on enclave-only CUI handling. Run internal enforcement checks. Fix DLP false positives and access issues so the enclave is usable, not just secure.
• Weeks 16–24. Conduct a mock assessment against the enclave. Fix findings. Close the gap between paper, configuration, and behavior.
• Weeks 20–28. Enter the formal Level 2 assessment window with an SPRS score and evidence set that matches reality.

That is a real six-month runway. Not a six-week miracle. Not a two-year death march.

The contractors moving fastest through Phase 1 of the CMMC rollout are not the ones with the biggest budgets. They are the ones who drew the smallest defensible boundary, put CUI inside it, and refused to let anything else drift in.

The Bottom Line

The CMMC final rule does not require you to make your entire company compliant. It requires you to make your CUI environment compliant, prove where that environment ends, and prove that CUI cannot escape it.

That is a strategy problem, not a tooling problem.

An enclave is how a small defense contractor stays in the DoD market without buying compliance for every corner of the business. It is how a mid-sized contractor keeps commercial work profitable while running a Level 2 program on the DoD side. It is how a program manager finally gives an assessor a clear, defensible answer to the question that decides most assessments: where does your CUI live, and how do you know it stays there.

Draw the boundary. Put CUI inside it. Enforce it in your firewalls, your identity, your DLP, your logs, your policies, and your training. Then walk an assessor through paper, configuration, and people that all describe the same enclave.

That is how contractors pass Level 2 without breaking the company that has to pay for it.