Level 2 doesn't have to mean rebuilding the whole shop. See how scoping a CMMC enclave keeps the 110 practices where they belong.
------------------------------------------------------------------------------------------------------------------
TL;DR: A Cybersecurity Maturity Model Certification (CMMC) enclave is a walled-off corner of a shop's network built just for handling Controlled Unclassified Information (CUI), so the rest of the shop doesn't have to carry the full weight of Level 2. All 110 practices still apply, but only to the machines inside that boundary. Draw the line well and Level 2 becomes a contained project instead of a shop-wide overhaul. Draw it badly and a shop either overspends protecting things that never needed it or leaves CUI sitting somewhere nobody locked down.
------------------------------------------------------------------------------------------------------------------
Plenty of defense contractors hear "CMMC Level 2" and picture rebuilding their whole shop's IT from the ground up. A CMMC enclave is the way out of that picture. It's a walled-off corner of the network built just for Controlled Unclassified Information (CUI), so the rest of the business can carry on as usual.
Think about a busy restaurant kitchen. One customer's dish suddenly comes with a stack of new rules. Dedicated pans, a separate prep station, its own cleaning routine, and only two named cooks allowed to touch it, with a log of every hand that did. Now, picture making the whole kitchen follow those rules for every ticket on the rail. Every cook, every burner, every Friday night rush. Nobody does that. The owner would lose their mind, and the other forty tables would be waiting an hour for fries. So the smart move is to set up one corner, name the two cooks who work it, and send that dish through there. Everybody else keeps cooking.
CMMC allows that same split, and it's a relief to hear. A shop can fence off the systems that touch CUI and the specific people who are cleared to work with them, instead of treating every computer and every employee as in scope. Most shops walking into Level 2 for the first time don't know that's an option, so they picture the full kitchen overhaul, run the numbers, and freeze. With CMMC requirements now showing up in real contracts, freezing is getting expensive.
Scope is the biggest lever on what CMMC costs and how long it takes. The 110 practices don't change, but whether they land on six machines and three people or on the whole shop is a call the contractor gets a real say in, as long as the boundary holds up when an assessor shows up.
A smart enclave doesn't shrink what CMMC asks for. It shrinks where those asks apply, and that's what turns Level 2 from a shop-wide overhaul into a project a small shop can get done.
Table of Contents
- Giving CUI Its Own Space on the Network
- Why the Number of Machines in Scope Sets the Price Tag
- Deciding What Belongs Inside the Walls
- Separating the Systems and Limiting Who Gets Access
- Where Enclaves Go Wrong
- Who Builds and Runs the Enclave Matters
- One Corner, Designated Cooks, and the Rest of the Kitchen Keeps Cooking
- Key Takeaways
- Frequently Asked Questions
Giving CUI Its Own Space on the Network
An enclave is a separate, locked-down slice of a shop's network where CUI lives and gets worked on. Think of it as its own little neighborhood. It has its own computers, its own storage, its own rules about who can walk in, and a clear line between it and everything else the business runs on.
Everything outside that line stays right where it is. Sales keeps its laptops. The front office keeps its email and its printers. The shop floor keeps doing what it does. None of it has to be rebuilt to Level 2 standards, because none of it touches CUI.
Some folks hear that and figure it's a trick, a way to dodge the rules. It isn't. All 110 practices still apply, and every one of them has to be met inside the enclave. Assessors will look hard at it, too. What changes is how much ground those practices have to cover, and for most small shops, that's the difference between a project they can finish and one they never start.
Why the Number of Machines in Scope Sets the Price Tag
Every one of the 110 practices costs something. There's the software, the setup, the documentation, the hours somebody spends making sure it all still works six months later. That's why the jump from Level 1 to Level 2 hits so hard, and the Level 1 vs. Level 2 post in this series covers just how big that jump is.
Now multiply that cost by every machine and every person the practice applies to. Locking down logins or tracking who opened what isn't a one-time purchase. It gets set up, managed, and checked on every system in scope. Thirty-five laptops, a file server, and a handful of cloud accounts add up to a lot of work. Six machines and three people add up to a lot less.
That's the whole reason scope matters. The practices are the same either way. The bill is different because the territory is different.
A shop that calls everything in scope usually finds that out when the first quote lands. A shop that draws the boundary around just the CUI work can often shrink the project to something it can plan and budget for. The trick is knowing where that boundary belongs, and that's next.
Deciding What Belongs Inside the Walls
The easiest way to find the boundary is to follow the CUI. Start where it comes in. Maybe a customer emails a drawing, a prime contractor shares a spec package, or a contracting officer sends over a file with markings on it. Then keep following it. Where does it get saved? Who opens it? Does it get printed, backed up, or copied to a laptop for a job off-site? Every system it lands on or passes through belongs inside the enclave. Anything that it never touches can stay outside.
None of that works if nobody can tell what's CUI and what isn't. That's what the FCI vs. CUI post in this series sorts out, and it's the first thing to settle before anyone draws a line.
People get the same treatment. Ask who needs to handle CUI to do their job, and put those people on the list. Everyone else stays out, even the ones who've been around for twenty years and know the shop better than anybody. It isn't a knock on them. It's just how a smaller boundary stays small.
The tighter that list, the smaller the project. Just make sure the list is honest, because CUI has a way of showing up in places nobody counted.
Separating the Systems and Limiting Who Gets Access
Once the boundary is drawn, it has to hold up in real life. That comes down to three jobs.
The first is separation. The enclave needs its own space on the network, so CUI can't drift out to the rest of the shop and everyday traffic can't wander in. Some shops build that with dedicated machines on a locked-down network segment. Others use a hosted environment that lives outside the shop's own network entirely. Either way, an ordinary office laptop shouldn't be able to reach into the enclave just because it's on the same Wi-Fi. The small stuff counts too. If someone can copy a CUI file onto a thumb drive or forward it to a personal email, the wall has a door in it.
The second is access. Each person on the list gets their own login, a second step to prove it's really them, and permission to see only what their job needs. Every sign-in and every file touched gets logged, so there's a record if anyone ever asks. That's why keeping the list short matters. Every name on it comes with training, upkeep, and paperwork. When someone leaves or changes roles, their access goes away the same day.
The third is easy to overlook, and it's physical. Machines that hold CUI need to sit somewhere that not everyone can wander past. A screen facing a busy hallway undoes a lot of good network work.
All 110 practices still apply to everything in this space, and the first post in this series lays out what Level 2 asks of it.
Where Enclaves Go Wrong
Most enclave problems come from the same few spots, and none of them are complicated.
The first is CUI that leaks out. A drawing gets emailed to a regular inbox, a spec lands on the shared drive everybody uses, or someone saves a copy to their desktop to finish up at home. The enclave was built right, but the CUI isn't staying in it.
The second is a boundary that only exists on paper. The documents say six machines and three people, but a seventh laptop has been touching CUI for months. An assessor who goes looking will find that, and it can undo the whole scope.
The third is building the enclave once and walking away. People get hired, software gets added, a new project brings in a new customer. If nobody updates the list and the boundary along with it, it drifts until it no longer matches what's really going on.
The fourth is trusting a hosted setup without checking it. If a cloud provider holds CUI, that provider has to meet requirements of its own, and a big name doesn't count as proof.
The Defense Federal Acquisition Regulation Supplement (DFARS) clauses that put all this into contracts, including the score a shop posts in the Supplier Performance Risk System (SPRS), rest on the boundary being accurate. The DFARS post in this series covers how those pieces fit.
Who Builds and Runs the Enclave Matters
An enclave doesn't run itself. Somebody has to build it, patch it, watch it, and fix it when something breaks. Shops usually land in one of three places. They handle it with their own people, they hire an outside IT company to build and manage it, or they rent a hosted environment from a cloud vendor.
All three can work. Plenty of small shops don't have anybody on staff with the time or know-how to keep a locked-down environment healthy, so leaning on outside help is common and smart. The catch is that an outside company that touches the enclave, or holds CUI on its behalf, becomes part of the picture. It has requirements of its own to meet, and an assessor can ask to see how it does the work.
The shop still answers for the result, too. Handing the keys to a provider doesn't hand over the responsibility. "They handle it" won't carry much weight if the boundary doesn't hold.
How far a managed service provider (MSP) can carry CMMC for a shop, and what makes it an external service provider (ESP) in an assessor's eyes, is the subject of the MSP and ESP post in this series.
One Corner, Designated Cooks, and the Rest of the Kitchen Keeps Cooking
A CMMC enclave is a smart way to take on Level 2 without rebuilding the whole shop. The 110 practices stay put, but they only land on the corner of the network that handles CUI and the handful of people cleared to work in it. That's why scope sets the price tag, and why it pays to follow the CUI before drawing any lines. From there, it comes down to keeping that corner separated, keeping the access list short, and being clear about who builds it and who runs it day to day.
Most shops don't struggle with the idea. They struggle with the doing. A contract shows up with CMMC language, the first quote lands, and the whole thing looks like a kitchen overhaul nobody has the time or budget for. Small teams without a dedicated IT person end up guessing where CUI lives. Some protect everything and overspend. Others miss a few spots and find out the hard way. Freezing feels safer than starting, but it gets more expensive every month.
CNWR helps defense contractors sort this out. The team maps where CUI lives, sizes the enclave to the real work, and builds and manages the environment so the boundary holds when an assessor comes looking. For shops with nobody in-house to look after a locked-down corner of the network, that day-to-day management is the difference between an enclave on paper and one that works.
If your shop is staring down Level 2 and trying to figure out where to start, get in touch with CNWR and find out what a smaller boundary could look like. It's a shorter road than most shops expect.
Key Takeaways
- An enclave doesn't cut a single one of the 110 practices. It cuts how much of the shop they apply to.
- Scope sets the price tag. Fewer machines and fewer people inside the boundary means a smaller project.
- Follow the CUI to find the boundary, and keep the list of people short.
- Separation, controlled access, and physical security all have to hold up, not just the network diagram.
- Most enclave problems come from CUI that leaks out, boundaries that only exist on paper, and setups nobody monitors.
- Whoever builds and runs the enclave becomes part of the picture, and the shop still answers for the result.
Frequently Asked Questions
1. Does an enclave mean the rest of our network doesn't need any security?
No. Everything outside the enclave still needs sound security, and any system that handles Federal Contract Information (FCI) still falls under Level 1. The enclave just means the full set of Level 2 practices only has to cover what's inside the boundary.
2. Can any shop use an enclave?
Any contractor that handles CUI can build one, but it pays off most when CUI is limited to a small set of people and systems. If CUI is spread across the whole business, the boundary ends up covering most of the shop anyway, and the savings shrink.
3. Will an assessor check the enclave?
Yes. Whether a shop self-assesses or goes through a third-party assessment, the boundary has to be documented and has to hold up. That includes what's inside it, how it's separated from everything else, and who has access.