CUI enclave design for precision machine shops
Keep the drawing in the enclave and the floor PC out.
Capital Cyber designs a CUI boundary on Microsoft GCC High and Azure Virtual Desktop for precision machine shops, from the prime's email to the program on the control. Design and documentation only; we do not hold your CUI. Capital Cyber, based in Leesburg, Virginia, provides CUI enclave design for precision machine shops and works on-site across Northern Virginia.
For machine shops building their own CUI environment, or reshaping one, before money goes on licensing and build.
What problem does an enclave solve in a job shop?
It shrinks the number of places a controlled drawing can land. Instead of drawings on every estimator's laptop, the owner's tablet and the shared drive, they live in one environment, and the people who open them reach it through a session that leaves nothing behind on the local PC.
Can a floor PC be out of scope?
It can, under one specific rule. The CMMC scoping rule treats an endpoint running a virtual desktop client as out of scope when it is configured so that no CUI is processed, stored or transmitted beyond the keyboard, video and mouse sent to it. A floor PC that only displays the drawing from the enclave fits that rule. One that saves a copy to its desktop does not.
Where does enclave design get hard for a machine shop?
At the machine. CAM software needs real graphics performance, and a program still has to physically reach the control, by DNC, network share or USB stick. The design has to say how the posted program leaves the enclave, which path it takes to the machine network, and how that transfer is controlled and recorded.
An enclave that stops at the CAM screen and ignores the trip to the spindle is half a design.
Who needs to be inside the boundary?
Usually a short list: whoever receives drawings from the prime, the programmers, the quality staff who build CMM programs and inspection reports, and whoever releases the shipment paperwork. The access design names them, says where they connect from, and how that access is evidenced.
Which requirements does this touch?
NIST SP 800-171AC.L2-3.1.3
Control CUI Flow
The design states how a drawing moves from the prime's email or portal into the enclave and how a posted program moves from the enclave to the machine network. Evidence is the CUI flow diagram matched to the transfer and firewall settings.
SC.L2-3.13.1
Boundary Protection
Boundaries between the enclave, the office network and the machine network, each one drawn and controlled. Evidence is the network boundary diagram and the rules behind it.
SC.L2-3.13.6
Network Communication by Exception
The machine network allows only the traffic programs need to reach the controls and denies the rest. Evidence is a deny-by-default rule set with each allowed path explained.
IA.L2-3.5.3
Multifactor Authentication
Programmers and quality staff sign in to the enclave with multifactor authentication. Evidence is the sign-in policy and a test login.
SC.L2-3.13.11
CUI Encryption
FIPS-validated cryptography wherever encryption protects CUI, in the enclave and on the path to the machine network. Evidence is the validated module named for each of those places.
What do you receive?
SCOPED PER CLIENTA written boundary
Which systems handle the prime's drawings and your programs, which are kept out of scope, and why.
An access design
Who reaches CUI, from where, and how that access is evidenced, down to the programmer at the CAM seat.
Scoping documentation
The CUI flow diagram and network boundary diagram, written against your shop.
A start at intake
With where CUI enters your shop today: which contracts bring it in, which people handle it, and which systems it touches.
What does this service not include?
This is design and documentation only. We do not hold your CUI, we do not operate the environment under this engagement, and we are not an Authorized C3PAO.
The full service, for any industry: CUI enclave design. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Do we have to move the whole company to GCC High?
Not necessarily. An enclave design puts the systems and people that handle controlled drawings inside a defined boundary, and the rest of the company can stay where it is if it is separated from that boundary and the separation is documented. The design settles that question before licenses are bought.
Can CAM software run inside a virtual desktop?
That is one of the questions the design answers for your software and your programmers. Where it cannot, the design documents the CAM workstation as a CUI asset inside the boundary instead of forcing it into the virtual desktop.
How does a program get from the enclave to the CNC machine?
The design names the path, such as DNC, a controlled share on the machine network, or managed removable media, and says how each transfer is controlled and recorded. The machines themselves are usually documented as Specialized Assets.
Does Capital Cyber host or hold our CUI?
No. CUI enclave design is design and documentation only. We do not hold your CUI, we do not operate the environment under this engagement, and we are not an Authorized C3PAO.
More for precision machine shops
CUI enclave design in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.