CUI enclave design for defense construction contractors
A plan room for marked drawings, in one place.
Instead of copying marked drawings onto every laptop, tablet and platform, an enclave keeps them in one environment on Microsoft GCC High and Azure Virtual Desktop. We design that boundary and document it. Capital Cyber, based in Leesburg, Virginia, provides CUI enclave design for defense construction contractors and works on-site across Northern Virginia.
For construction contractors who want marked drawings in a defined environment rather than scattered across field devices.
Why not just lock down every device?
Because in construction the devices keep changing. New tablets for a new project, trade staff who need a few sheets for a few weeks, a laptop that lives in a trailer. Bringing every one of them fully inside the boundary means every one has to meet every applicable requirement, and the list never stops growing.
An enclave reverses that. Marked drawings live in one environment, and people reach them through it. The number of places CUI is stored shrinks to the enclave itself.
Can a jobsite laptop stay out of scope?
It can, under the right configuration. 32 CFR 170.19 treats an endpoint hosting a VDI client as an Out-of-Scope Asset when it is configured to allow nothing beyond keyboard, video and mouse to pass to it. A trailer laptop that opens drawings inside an Azure Virtual Desktop session, with no download, no clipboard and no local printing, can meet that description.
The design specifies those settings and the scoping documents explain them. If someone enables local printing on the trailer laptop to save a trip to the plotter, the laptop is back in scope, so the design says how that is prevented.
What about printed sets and the plotter?
An enclave does not make paper disappear. Crews still need sheets on the deck. The design decides where printing from the enclave is allowed, which printers and plotters are inside the boundary, and how printed sets are marked, stored and destroyed. Those printers become part of the scope, so fewer of them is better.
How do trades get the drawings they need?
Either through limited accounts in the enclave, reaching only the sheets for their scope, or by a controlled transfer to the trade's own environment, which then carries the flowed-down obligations. The access design records which approach applies to which trade, and how accounts are removed when a trade finishes.
Which requirements does this touch?
NIST SP 800-171SC.L2-3.13.2
Security Engineering
The enclave architecture chosen to keep marked drawings in one environment, documented with the reasoning. Evidence is the design document and diagrams that match what is built.
AC.L2-3.1.3
Control CUI Flow
Drawings stay in the enclave unless a defined transfer is approved, such as to a trade's environment or an approved plotter. Evidence is the session restrictions and the transfer procedure.
AC.L2-3.1.19
Encrypt CUI on Mobile
If tablets view drawings through the virtual desktop rather than storing them, the encryption question narrows to the enclave. Evidence is the session configuration showing files are not stored on the device, and encryption settings for any device that does hold CUI.
MP.L2-3.8.2
Media Access
Only authorized people can reach printed sets from the enclave. Evidence is which printers are permitted, where output is collected, and who can retrieve it.
What do you receive?
SCOPED PER CLIENTA written boundary
Which systems handle marked drawings, and which field devices are kept out of scope and why.
An access design
Who reaches the drawings, including trades and field staff, from where, and how that access is evidenced.
A CUI flow diagram
From the government's drawing set into the enclave, out to printers and trades, and back at closeout.
A network boundary diagram
Written against your environment, including the virtual desktop path from jobsites.
What does this service not include?
This is design and documentation only. We do not hold your CUI, we do not operate the environment under this engagement, and we are not an Authorized C3PAO.
The full service, for any industry: CUI enclave design. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Do you host the enclave or hold our drawings?
No. This is design and documentation only. We do not hold your CUI and we do not operate the environment under this engagement.
Will a virtual desktop work on a jobsite connection?
It depends on the site's connection, and that is one of the things the design has to account for, including what happens when the connection drops and what field staff do instead.
Does the enclave replace our plan-sharing platform?
Not necessarily. The design decides where marked drawings live. Unmarked project information can stay on your existing platform; marked drawings go wherever the design puts them, with the reasoning written down.
Where does enclave design start?
With where marked drawings enter your business today: which contracts bring them, which people and trades handle them, and which systems and devices they touch now.
More for defense construction contractors
CUI enclave design in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.