CMMC Solutions: Enclaves
What is a CMMC Enclave? A Guide for Small Defense Contractors
A CMMC enclave is a group of systems living behind one fence under one set of rules. The fence encloses the work that touches Controlled Unclassified Information (CUI), and the rest of the company continues operating as it always has.
What is CUI? The DoD defines CUI as sensitive information that does not meet the criteria for classification but must still be protected. It is U.S. Government-created or owned UNCLASSIFIED information that allows for, or requires, safeguarding and dissemination controls in accordance with laws, regulations, or Government-wide policies.
NIST puts it a little more formally. An enclave is “a set of system resources that operate in the same security domain and that share the protection of a single, common, continuous security perimeter.” Same idea, more words.
How CMMC Enclaves Work
Under CMMC, anything that's physically or logically separated from your CUI is out of scope, with no assessment requirements at all. Everything inside the fence is held to all 110 NIST 800-171 requirements — everything outside it isn't.
The more of your business that you can keep outside the fence, the less that has to be secured, documented, and assessed. The smaller the fence, the less you pay to guard it.
Understanding CMMC Scope
What is CUI? The DoD defines CUI as sensitive information that does not meet the criteria for classification but must still be protected. It is U.S. Government-created or owned UNCLASSIFIED information that allows for, or requires, safeguarding and dissemination controls in accordance with laws, regulations, or Government-wide policies.
The Department's own estimate puts a Level 2 certification assessment for a small business at $104,670 over three years. Expecting a small business to spend what Northrop Grumman spends on CMMC simply isn't feasible. More importantly, it isn't practical.
It's important to understand your scope before you choose a solution. It's a lot like buying a home — why would you buy a house with 18 bedrooms when you're a family of four? You could argue, well, who wouldn't want a mansion? But that brings us back to the point. Small businesses, like the average American family, don’t have the same needs as Lockheed Martin or Boeing.
For Many Organizations, a Government Contract is Just One Piece of the Pie
Take one of our higher education clients, a large state university. They have a small team of researchers working on a DoW contract. Now picture the rest of that campus: every dorm, every lecture hall, every student logging on to the Wi-Fi. Bringing that whole network into scope wouldn’t just be expensive; it would be impossible. Why put thousands of people on the inspection when only a handful of them ever touch CUI?
What a CMMC Enclave Takes Off Your Plate
The level of effort required to overhaul a whole system varies from company to company, but an enclave is a home that already has the alarm system and the electrical, built to code. You just have to move in.
An enclave eliminates the need for expensive consulting hours and, in many ways, the liability of handling CUI. If a provider has 100 companies certified, a 100% pass rate, and FedRAMP Authorization or Equivalency, you can trust that it works. That takes a large amount of time, money, and pressure off your team to do everything yourself.
That said, moving into a house with an alarm system doesn't mean you never have to set it. Your provider, in some instances, handles a large percentage of your objectives, but the CUI is still yours, and so is the responsibility to protect it.
Who a CMMC Enclave Works For (and Who It Doesn’t)
Enclaves sometimes carry a negative connotation. Maybe it's because they're simple, or some would say oversimplified. Maybe it's because they're considerably less expensive than a full system overhaul (i.e., service providers don't make as much money). But there's a reason enclaves work so well for CMMC, especially for small and mid-sized businesses.
Enclaves are a strong fit for small teams that handle a limited amount of CUI but still need CMMC certification to bid on contracts. They’re also great for businesses in which defense-related work is only a small portion of the overall business.
Enclaves may not work for large teams running heavy software or for shops where the physical machinery falls into scope, like drawings pulled up on CNC workstations or printed specs sitting at the machine. And if you need most of your work protected across most of your business lines or projects, an enclave probably isn't your answer.
Protecting CUI matters just as much for a small shop as it does for a prime. That doesn't mean they should pay for it the same way.
Sometimes the simple solution is the right one.
Still Figuring CMMC Out?
We've been there. Every business's scope looks a little different, and the right CMMC solution should fit yours. Our buyer’s guide helps you sort out what needs protecting, what doesn’t, and what to ask before you choose.