Short answer: A CMMC enclave is a separate, well-defined environment where your Controlled Unclassified Information (CUI) lives, so only that environment, and the people and tools that support it, fall inside your CMMC assessment scope. It makes sense when CUI touches a small part of your business: a few people, one program, or one engineering team. It makes less sense when CUI flows through most of your operations, because the separation becomes harder to maintain than securing everything.
How does CMMC scoping work?
Before any Level 2 assessment, you must define your CMMC Assessment Scope, the set of assets that will be assessed (32 CFR 170.19). The rule sorts every asset into a category:
| Asset category | What it is | How it’s treated at Level 2 |
|---|---|---|
| CUI assets | Systems that process, store, or transmit CUI | Assessed against all 110 requirements |
| Security Protection Assets | Tools that provide security for the scope, such as firewalls, identity, logging, and endpoint protection | Assessed against the requirements relevant to what they do |
| Contractor Risk Managed Assets | Systems that can but aren’t intended to handle CUI, because of your policies and procedures | Documented in the SSP; the assessor may do a limited check |
| Specialized Assets | IoT, OT, government-furnished equipment, test equipment, and other assets that can’t be fully secured | Documented in the SSP; not assessed against other requirements |
| Out-of-Scope Assets | Systems that can’t handle CUI and don’t protect CUI assets, physically or logically separated from CUI assets | Not assessed, but you must be able to justify why |
An enclave works by moving as many systems as possible into that last row. Everything outside the enclave is out of scope only if it is truly separated and doesn’t provide security for the enclave.
What does an enclave look like in practice?
Common patterns for small and mid-sized contractors:
- Cloud enclave. CUI is handled only in a dedicated cloud environment (for example, a government-cloud tenant), separate from the company’s regular email and file sharing. Cloud services that store CUI must meet FedRAMP Moderate or an equivalent baseline.
- Virtual desktop (VDI) enclave. Users reach CUI through a virtual desktop. The rule says an endpoint running a VDI client is out of scope if it’s configured so nothing beyond keyboard, video, and mouse data reaches it. No CUI can be downloaded, stored, or printed locally.
- Physical or network segment. A separate network segment, sometimes with dedicated workstations, for the team that handles CUI, such as a machine shop’s engineering group working with controlled technical drawings.
DoD has said it won’t prescribe how to build enclaves, because “such decisions are unique to each company.” The architecture is your choice. It must meet all applicable requirements and be documented.
When does an enclave make sense?
| An enclave usually makes sense when… | Securing the whole company may be simpler when… |
|---|---|
| Only a few people or one program handle CUI | CUI flows through email, ERP, and shared drives across the company |
| CUI arrives through a predictable channel (e.g., drawings from one prime) | Most employees touch CUI in some way |
| Your main business systems are hard or costly to bring up to 800-171 | Your environment is small and already close to meeting 800-171 |
| You want to keep commercial work and defense work separate | Maintaining two environments would strain your IT capacity |
What are the trade-offs?
- Separation must be real. If CUI leaks into email, laptops, or shared drives outside the enclave, those systems are back in scope. Your SPRS score and affirmation must reflect the actual environment.
- Security tools come along. Identity, logging, and endpoint-management tools that protect the enclave are Security Protection Assets and remain in scope, even if they also serve the rest of the business.
- People and process are in scope too. Training, personnel security, physical access, and incident response still apply to everyone who uses the enclave.
- Certification doesn’t transfer. In the final rule, DoD stated that an enclave may inherit some requirements from an enterprise network, but it cannot inherit the enterprise’s certification. Each assessment applies only to its own defined scope.
- Workflow friction. Users have to work inside the enclave for CUI tasks. Design it around how the team actually works, or people will route around it.
How do you scope an enclave?
- Map where CUI enters, moves, and is stored. Contracts, email, file transfers, portals, printed drawings, and backups.
- Decide who truly needs access. Fewer users means a smaller scope.
- Choose the pattern (cloud, VDI, segment) that fits those workflows.
- Categorize every asset using the categories above, and record it in your asset inventory and network diagram.
- Document the boundary in your System Security Plan, including how separation is enforced and how service providers share responsibility.
- Assess the enclave against the 110 requirements and update your SPRS score to match. See CMMC Level 2 requirements.
Frequently Asked Questions
What is a CUI enclave?
A CUI enclave is a separated part of your IT environment where all CUI is processed, stored, and transmitted. It defines your CMMC Assessment Scope so the rest of your business can be treated as out of scope, as long as it’s physically or logically separated and doesn’t protect the enclave.
Does an enclave reduce CMMC costs?
Often, yes, because fewer systems and users must meet and be assessed against the 110 requirements. But the enclave itself costs money to build and run, and security tools that protect it stay in scope. Compare both options before deciding. See how much CMMC costs.
Is a VDI endpoint in scope for CMMC?
Not if it’s configured so no CUI can be processed, stored, or transmitted on it beyond keyboard, video, and mouse data. 32 CFR 170.19 treats that endpoint as out of scope. The VDI environment itself is in scope.
Can different parts of a company have different CMMC levels?
Yes. A CMMC status applies to a defined assessment scope, so a company can hold a status for an enclave without its whole enterprise being assessed. Each status covers only the scope that was assessed.
How USCIBER can help
Scoping is the decision that shapes every later CMMC cost. USCIBER’s CMMC Readiness Review (from $7,500) maps where your CUI actually goes, compares an enclave with a whole-environment approach, and gives you a prioritized plan for the option that fits. Our Compliance Documentation Project documents the boundary in your SSP. USCIBER is a readiness consultant. We are not a C3PAO and do not issue certifications. Learn more on our CMMC consulting page.
Sources
- eCFR — 32 CFR 170.19, CMMC scoping: asset categories, ESP and cloud requirements, VDI treatment
- Federal Register — CMMC Program final rule, 89 FR 83092 (October 15, 2024): DoD responses on enclaves and inheritance
- DoD CIO — CMMC Resources & Documentation (CMMC Scoping Guide, Level 2)
This article is general information, not legal advice.