CUI enclave design for engineering and design firms
Put the controlled design work in one place.
We design a CUI boundary on Microsoft GCC High and Azure Virtual Desktop for engineering firms that want controlled models in one environment and the rest of the office outside it. Design and documentation only. Capital Cyber, based in Leesburg, Virginia, provides CUI enclave design for engineering and design firms and works on-site across Northern Virginia.
For engineering firms building or reshaping their own CUI environment.
Why would an engineering firm want an enclave?
Because not every project is controlled. If one program brings drawings marked B through F and the rest of your work is commercial, putting the whole office in scope means assessing every workstation for one customer. An enclave keeps the controlled program in a defined boundary.
Does CAD work inside a virtual desktop?
Sometimes well, sometimes not, and it depends on your models, your CAD package and how the virtual desktop is sized. That question has to be tested with your real assemblies before the design is settled, not assumed. Where it works, the engineer's own laptop can sit outside the boundary, because the scoping rules allow an endpoint that passes only keyboard, video and mouse to a virtual desktop to be out of scope.
What about the plotter and the prime's portal?
Both have to be placed. A plotter that prints controlled sheets sits inside the boundary or is fed only from it. The route to the prime's portal is part of the CUI flow and is drawn on the diagram. Leaving either one off is how enclaves leak.
What does the design hand you?
A written boundary, an access design, and the scoping documents an assessor expects, such as the CUI flow diagram and network boundary diagram. You or your IT provider build from them. We do not hold your CUI or operate the environment under this engagement.
Which requirements does this touch?
NIST SP 800-171SC.L1-3.13.1
Boundary Protection
The edge of the enclave is defined and controlled, including the path to the prime. Evidence is the network boundary diagram matched to the firewall and virtual desktop configuration.
AC.L2-3.1.12
Control Remote Access
Engineers working from home reach controlled models only through the managed virtual desktop. Evidence is the access policy and the session logs.
PE.L2-3.10.6
Alternative Work Sites
What the firm requires of an engineer working on a controlled program from home, written into the design rather than left to habit.
AC.L2-3.1.3
Control CUI Flow
Controlled files stay inside the enclave unless an approved path moves them. Evidence is the CUI flow diagram and the settings that block copy-out.
What do you receive?
SCOPED PER CLIENTA written boundary
Which systems handle controlled models and drawings, and which are kept out of scope and why.
An access design
Who reaches the controlled work, from where, including remote engineers, and how that access is evidenced.
Scoping documentation
The CUI flow diagram and network boundary diagram, written against your environment.
A start from your real CUI flow
We begin with which contracts bring controlled drawings in, who handles them and what systems they touch.
What does this service not include?
This is design and documentation only. We do not hold your CUI, we do not operate the environment under this engagement, and we are not an Authorized C3PAO.
The full service, for any industry: CUI enclave design. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Does every engineer need to work inside the enclave?
No. Only the people working on controlled programs need access. Engineers on commercial work can stay outside the boundary, which is the reason an engineering firm builds an enclave in the first place.
Will our CAD software run in Azure Virtual Desktop?
That depends on the CAD package, the size of your models and how the virtual desktop is configured. It has to be tested with real assemblies before an engineering firm commits to the design.
Do you hold our controlled drawings in your environment?
No. CUI enclave design is design and documentation only. We do not hold your CUI, and we do not operate the environment under this engagement.
Where does an enclave design for an engineering firm start?
With where controlled drawings enter the business today: which contracts bring them, which engineers handle them, and which workstations, vaults and devices they touch.
More for engineering and design firms
CUI enclave design in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.