CMMC Enclave: Shrink Your Scope Instead of Hardening Every Laptop

A CMMC enclave is one small, separate environment where controlled unclassified information (CUI) lives, so the rest of your company is not assessed against the 110 requirements of NIST SP 800-171. If your shop has 30 laptops and only four people touch CUI, the enclave strategy asks whether you should harden 30 laptops or four. This post explains how a CMMC enclave works under the Cybersecurity Maturity Model Certification (CMMC) rule, three ways to build one, and the mistakes that quietly pull everything back into scope.

It is explanatory content, not legal advice. The scoping rule is short and worth reading yourself: 32 CFR 170.19.

What the rule says about scope

Section 170.19 starts with a plain requirement: you must specify the assessment scope before you assess. The scope is the set of all assets in your environment that will be assessed against the security requirements. For Level 2, the rule sorts every asset into one of five categories.

Category	What it is	How it is treated
CUI Assets	Process, store or transmit CUI	In scope. Assessed against all Level 2 requirements.
Security Protection Assets	Provide security functions to your scope (firewall, identity, logging)	In scope. Assessed against the requirements relevant to what they do.
Contractor Risk Managed Assets	Can, but are not intended to, handle CUI because of your policies and practices	In scope but lightly checked. Your SSP must describe them. An assessor can do a limited check.
Specialized Assets	Can handle CUI but cannot be fully secured (operational technology, test equipment, government furnished equipment)	Documented in the SSP, not assessed against the other requirements.
Out-of-Scope Assets	Cannot process, store or transmit CUI, and provide no security protection to CUI assets	Not assessed. You must be prepared to justify why.

The enclave strategy is the decision to make as many assets as possible land in the last row. Anything that falls into one of the first four categories cannot be called out of scope, so the work is in keeping CUI, and anything that protects CUI, small and contained.

The VDI exception is the heart of it

The rule gives one concrete example that matters a great deal to small shops. An endpoint hosting a virtual desktop infrastructure (VDI) client that is configured to allow no processing, storage or transmission of CUI beyond the keyboard, video and mouse sent to the client is considered out of scope. The laptop is only a window. The CUI stays in the environment on the other side.

That is why the common enclave design is a hosted desktop or a secure remote workspace. Engineers who need CUI connect to it from ordinary machines, and those machines drop out of the assessment, provided the client really cannot save files, copy to a local clipboard, print locally or map drives. "Cannot" is the standard, not "we ask people not to."

Three ways to build a CMMC enclave

1. A separate cloud tenant for CUI

Run a second Microsoft 365 or Google Workspace environment used only for CUI work, and keep the main company tenant for everything else. Only the people who need CUI get accounts in the CUI tenant. This is the most common choice for companies already living in a productivity suite. The cloud provider that holds CUI has to meet the FedRAMP requirements in DFARS 252.204-7012, which is a real cost driver. We compare the options in GCC High vs Microsoft 365 for CMMC.

2. A hosted virtual desktop

Users reach a managed desktop in a provider's environment. Files never reach their own devices. This pairs naturally with the VDI exception above and works well for a small group of engineers or estimators. Expect a monthly per-seat price and a provider that becomes an external service provider (ESP) in your scope.

3. A physically or logically separate on-premises segment

A dedicated workstation or two on their own network segment, with their own accounts and controlled removable media. It is the cheapest in software and the most demanding in discipline, and it suits shops where CUI is a few drawings that arrive by one route.

What an enclave does not remove

The enclave shrinks the number of assets assessed. It does not shrink the paperwork around the ones that remain.

• You still need a system security plan. The plan describes the enclave, its boundary and how each requirement is met inside it. Even out-of-scope reasoning is easier to defend when it is written down. CMMC Map, CMMC compliance software, generates that plan from your assessment answers.
• You still need an asset inventory and a network diagram. The rule requires CUI Assets, Security Protection Assets, Contractor Risk Managed Assets and Specialized Assets in the inventory and on the diagram of the assessment scope.
• Security protection assets stay in. The identity system, firewall and log collector that protect the enclave are in scope even if they live outside it physically.
• Providers join your scope. Under table 4 of 170.19(c)(2), a cloud provider handling CUI must meet the FedRAMP requirements in 252.204-7012, and a non-cloud service provider handling CUI is assessed as part of your assessment. Your SSP must describe the relationship and include the provider's customer responsibility matrix. See what CMMC requires of your MSP.
• The 72-hour reporting rule is unchanged. DFARS 252.204-7012 applies wherever CUI is handled, enclave or not.

The mistakes that pull the office back in

1. Email leaks. A drawing attached to an email in the company tenant makes that mailbox a CUI Asset. Decide in writing how CUI arrives and block the other routes.
2. Sync clients. A cloud drive set to sync to every laptop copies CUI to every laptop. The enclave boundary has to cover the sync settings.
3. Shared admin accounts. If the same administrator manages both environments with one login, the main environment may become a security protection asset for the enclave.
4. Vague VDI. If the client allows file transfer, clipboard or local printing, the laptop is no longer out of scope.
5. Forgetting CAD workstations and shop-floor machines. Machines that receive CUI files directly are CUI Assets unless they qualify as Specialized Assets and are documented that way.

Is an enclave worth it for your shop?

A rough test: if fewer than a third of your people handle CUI, and you can name the one or two routes it arrives by, an enclave usually costs less than bringing every device into scope. If everyone touches CUI all day, the boundary has little to draw around and you are better off hardening the whole environment. Either way, run an honest self-assessment first. The CMMC scoping guide walks the asset categories in more detail, and the free SPRS calculator shows what your current score would be.

What to do this week

1. List every place CUI enters your company: email, portals, shipped media, customer file shares.
2. List every person and device that touches it today.
3. Count how many of those you could remove by moving CUI work into one place.
4. Price one option from the three above against the cost of securing everything you listed.
5. Write the proposed boundary on one page. That page becomes the first draft of your SSP scope statement.