CUI enclave design
Where CUI lives, written down.
Advisory design for a Controlled Unclassified Information boundary on Microsoft GCC High and Azure Virtual Desktop, for contractors building or keeping their own. Design and documentation only.
Advisory CUI enclave design on Microsoft GCC High and Azure Virtual Desktop: where Controlled Unclassified Information lives, who reaches it, and how that is evidenced.
Sound familiar?
We do not know exactly which systems touch CUI.
Without a written boundary, everything looks in scope, which makes the assessment bigger than it needs to be.
Somebody told us to just move everyone to GCC High.
GCC High licenses run about three times a standard Microsoft 365 seat, and most of your team never touches CUI.
A full migration sounds like it would take a year.
Enterprise-wide GCC High migrations typically run six to eighteen months, with real disruption while they happen.
We do not have a diagram an assessor could actually read.
The CUI flow and the network boundary are two separate pictures, and both have to match what is really running.
Splitting people into an enclave sounds simple.
Done wrong, nobody is sure which environment they are supposed to be working in, or where a file actually lives.
We built something once and never wrote down why.
A boundary only holds up if someone can explain, in writing, why each system is in scope or out of it.
Where CUI actually lives
A boundary is not a wall. It is a wall with exactly one gate, and knowing where that gate is, and who is allowed through it, is most of the design work.
Scroll sideways to see the whole diagram.
Is this the right service?
SCOPED, NOT PRICEDWho it is for
A contractor building its own CUI environment, or reshaping one it already has, who wants the boundary designed before money is spent on licensing and build.
How it starts
With where CUI enters your business today: which contracts bring it in, which people handle it, and which systems it touches.
How it differs
The gap assessment reviews the boundary you already have. Enclave design draws a new one. CMMC In A Container gives you an enclave we provide and manage, already FedRAMP Moderate Authorized, so there is nothing to design; this service is for when you are building or keeping your own.
The $5,000 gap assessment, CMMC In A Container™, or all three side by side.
What you receive
What this is not
This is design and documentation only. We do not hold your CUI, we do not operate the environment under this engagement, and we are not an Authorized C3PAO.
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 25 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.