CUI enclave design for government IT and services contractors
A CUI enclave for the people on CUI work.
Most of your company never touches CUI. Enclave design draws a boundary around the people and task orders that do, on Microsoft GCC High and Azure Virtual Desktop, and documents why everything else sits outside it. Capital Cyber, based in Leesburg, Virginia, provides CUI enclave design for government IT and services contractors and works on-site across Northern Virginia.
For services contractors deciding whether to move everyone or build a smaller CUI environment for some.
Why build an enclave instead of moving the whole tenant?
Because in a services firm, CUI usually belongs to a few contracts and a defined set of people. Sales, HR, finance and the staff on FCI-only work have no reason to be inside a CUI boundary, and putting them there makes every one of their devices and accounts part of the assessment.
An enclave keeps CUI work in an environment built for it and leaves the rest of the company where it is. The trade-off is that people on CUI work have to know which environment to use for which task, so the design has to make that obvious.
How does Azure Virtual Desktop change what is in scope?
Under 32 CFR 170.19, an endpoint hosting a VDI client that is configured to allow nothing beyond keyboard, video and mouse to reach it is an Out-of-Scope Asset. For a consultant working from home or a customer site, that means CUI is opened inside a virtual desktop in the enclave, and the laptop in front of them only displays it.
The configuration has to back that up: no clipboard, no drive mapping, no printing to local printers, no file download. The design specifies those settings and the scoping documents explain them, because an out-of-scope claim is only as good as the configuration behind it.
Where does CUI enter the enclave?
Usually by email from the government customer or the prime, sometimes through a government file exchange, sometimes through a teaming partner. The design starts there: which mailbox receives it, what happens if it arrives in the commercial tenant by mistake, and how it is moved and removed.
That second question matters more than people expect. Someone will forward a marked file to a commercial address eventually, and the design should include what to do when that happens.
What about teaming partners who need to collaborate?
Guest access into the enclave is a design choice, not a default. The access design says who can be invited, which workspaces they can reach, how their accounts are reviewed, and how that is evidenced. If a partner hosts the shared workspace instead, the design records that the CUI flow crosses into their environment.
Which requirements does this touch?
NIST SP 800-171SC.L2-3.13.2
Security Engineering
The enclave design itself: an architecture chosen to contain CUI, documented with the reasoning. Evidence is the design document and diagrams that match what is built.
AC.L2-3.1.3
Control CUI Flow
Rules that stop CUI moving from the enclave to the commercial tenant or to personal devices. Evidence is the configured restrictions on the virtual desktop and the mail and sharing rules in the enclave tenant.
AC.L2-3.1.14
Remote Access Routing
Remote users reach CUI only through the virtual desktop gateway, not directly. Evidence is the access path in the network boundary diagram and the conditional access policies that enforce it.
SC.L2-3.13.4
Shared Resource Control
Preventing CUI leaking through shared resources such as clipboards, mapped drives or redirected printers between the virtual desktop and the local machine. Evidence is the session host configuration.
What do you receive?
SCOPED PER CLIENTA written boundary
Which systems handle CUI, and which parts of your commercial tenant are kept out of scope and why.
An access design
Which consultants and partners reach CUI, from where, and how that access is evidenced.
A CUI flow diagram
From the government customer or prime into the enclave, and what happens when a file lands in the wrong place.
A network boundary diagram
Written against your environment, including the virtual desktop path for remote staff.
What does this service not include?
This is design and documentation only. We do not hold your CUI, we do not operate the environment under this engagement, and we are not an Authorized C3PAO.
The full service, for any industry: CUI enclave design. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Do you host or operate the enclave?
No. This is design and documentation only. We do not hold your CUI and we do not operate the environment under this engagement.
Is a laptop using Azure Virtual Desktop really out of scope?
It can be. 32 CFR 170.19 treats an endpoint hosting a VDI client as out of scope when it is configured to allow nothing beyond keyboard, video and mouse. You have to be able to justify that with the configuration, which is why the design specifies it.
Why GCC High and not our commercial tenant?
A cloud service that holds CUI must meet security requirements equivalent to FedRAMP Moderate under DFARS 252.204-7012, and some contracts involve export-controlled data with further requirements. An enclave on GCC High keeps that decision to the people who need it. Whether it is right for you depends on your contracts, and the design writes down why.
Where does enclave design start?
With where CUI enters your business today: which contracts and task orders bring it in, which people handle it, and which systems it touches now.
More for government IT and services contractors
CUI enclave design in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.