CUI enclave design for defense research and development firms
Keep the controlled project apart from the rest of the lab.
We design a CUI boundary on Microsoft GCC High and Azure Virtual Desktop for research firms that run controlled and uncontrolled work side by side. Design and documentation only. Capital Cyber, based in Leesburg, Virginia, provides CUI enclave design for defense research and development firms and works on-site across Northern Virginia.
For R&D firms building or reshaping their own CUI environment.
Why does a mixed research portfolio suit an enclave?
Because the controlled project is usually one of several. Putting the whole lab in scope to protect one program's test data means every collaborator, every analysis server and every laptop is assessed. An enclave puts the controlled project's data, accounts and analysis in a defined boundary and leaves the rest outside it.
Where do the instruments fit?
Usually at the edge. Instruments and rigs stay in the lab as Specialized Assets, documented in the SSP and on the diagram. The design settles how their output reaches the enclave, by a controlled network path or by issued removable media, and that path is drawn on the CUI flow diagram.
Can collaborators work inside the enclave?
Sometimes that is the simplest answer. A partner who works on a virtual desktop inside your boundary, on accounts you issue, does not take controlled data back to their own systems. The scoping rules allow an endpoint that passes only keyboard, video and mouse to a virtual desktop to be out of scope. Whether that fits a given partner is a design and contract question.
What does the design hand you?
A written boundary, an access design and the scoping documents an assessor expects, such as the CUI flow diagram and network boundary diagram. You or your IT provider build from them. We do not hold your CUI or operate the environment under this engagement.
Which requirements does this touch?
NIST SP 800-171SC.L2-3.13.6
Network Communication by Exception
Traffic from the lab network into the enclave is denied by default and allowed only for the defined path from the rigs. Evidence is the rule set matched to the diagram.
AC.L2-3.1.1
Authorized Access Control
Only people on the controlled project, including named collaborators, hold enclave accounts. Evidence is the account list matched to the project roster.
AC.L1-3.1.20
External Connections
A partner's connection to the enclave is verified and controlled. Evidence is the list of external connections and the agreement behind each.
MP.L2-3.8.7
Removable Media
Where rig output reaches the enclave on removable media, those drives are issued and controlled. Evidence is the device control setting and media log.
What do you receive?
SCOPED PER CLIENTA written boundary
Which systems handle the controlled project's data, and which are kept out of scope and why.
An access design
Who reaches the controlled data, from where, including collaborators, and how that access is evidenced.
Scoping documentation
The CUI flow diagram and network boundary diagram, written against your environment.
A start from your real CUI flow
We begin with which contracts bring controlled data in, who handles it and what systems it touches.
What does this service not include?
This is design and documentation only. We do not hold your CUI, we do not operate the environment under this engagement, and we are not an Authorized C3PAO.
The full service, for any industry: CUI enclave design. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Does every researcher need an enclave account?
No. Only people working on the controlled project need access. Researchers on fundamental research or internal work stay outside the boundary, which is the point of an enclave in a research firm.
Do the lab instruments go inside the enclave?
Usually not. Instruments and rigs stay in the lab as Specialized Assets, documented in the SSP, and the design defines how their output reaches the enclave.
Do you hold our controlled test data?
No. CUI enclave design is design and documentation only. We do not hold your CUI, and we do not operate the environment under this engagement.
Where does enclave design for a research firm start?
With where controlled data enters the business today: which contracts bring it, which researchers and collaborators handle it, and which instruments, machines and shares it touches.
More for defense research and development firms
CUI enclave design in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.