For a small defense supplier, the first reaction to CMMC Level 2 requirements is often alarm at the apparent cost. Applying NIST SP 800-171 controls across every computer, server, and employee in the company is a heavy task. But the requirements apply to the systems that process, store, or transmit controlled unclassified information, and to the systems that support them, not necessarily to your entire organization.
Careful scoping, often by creating a dedicated enclave for CUI, can dramatically reduce effort. It is one of the most useful decisions a small contractor can make.
What scope means
Scope defines which people, systems, facilities, and services an assessment will examine. Assets that handle CUI are in scope. So are assets that provide security protection for them, and others that can reach them without adequate separation. The larger the scope, the more controls you must implement and evidence you must produce.
The enclave idea
An enclave is a separate, controlled environment where CUI is handled. Instead of upgrading everything, the company concentrates the sensitive work in a defined space with its own accounts, devices, storage, and policies, and keeps CUI out of the rest of the business.
Enclaves can take several forms.
- A separate cloud environment built for government data, with managed controls
- A dedicated set of laptops and a segregated network segment
- A hosted virtual desktop that employees use to reach CUI
- A combination, depending on workflow
When an enclave makes sense
- Only a small number of employees handle CUI
- CUI appears in a limited set of projects or contracts
- The rest of the business has varied systems that would be costly to bring up to standard
- Your current environment is hard to bring into compliance as it stands
If CUI touches nearly every person and system, the enclave may offer less savings and a company-wide approach could be simpler.
Steps to scope well
Step 1: Identify CUI
Work with your contracts team and your prime to determine what information is marked or should be treated as CUI. Review contract documents and ask for clarity when markings are unclear. Do not guess.
Step 2: Map the data flow
Trace how CUI enters your company, where it is stored, who uses it, and where it leaves. Include email, file transfers, collaboration tools, printing, backups, and mobile devices. Gaps in this map are where scope creep occurs.
Step 3: List the people and assets
Identify who needs access, and which devices, applications, and services they use. Minimize the list to those with a genuine need.
Step 4: Draw boundaries
Decide what is inside the enclave and what is outside. Document the boundary, including how information may enter or leave and how outside systems are prevented from touching CUI.
Step 5: Consider external service providers
Cloud services and managed providers that handle CUI or security functions for you may fall within scope and are expected to meet applicable requirements. Ask each provider what assurances they can give and confirm in writing.
Step 6: Document everything
Your system security plan should describe the boundary, the assets inside, and how each requirement is met. Assessors will examine whether reality matches the documentation.
Trade-offs to weigh
An enclave is not free.
- Cost. The enclave itself requires licenses, setup, and support.
- Usability. Employees must work differently, and friction can lead to workarounds that leak CUI outside the boundary.
- Discipline. Keeping CUI out of regular email and file shares requires training and enforcement.
- Dependence. You rely on the enclave provider's quality.
Weigh these against the cost of bringing everything into scope.
Common mistakes
- Assuming the boundary is the same as the office network
- Letting CUI leak into email attachments and personal folders
- Forgetting about backups, printers, and mobile devices
- Not training staff on what CUI looks like
- Building the enclave without confirming what the prime requires
A hypothetical example
Consider a hypothetical 50-person machine shop in which three engineers and one contracts manager handle drawings marked as controlled. Instead of upgrading fifty workstations, the shop could provide those four people with managed devices that access a secured enclave, keep the drawings there, and block removable media and unapproved sharing. The remaining staff continue as before, with basic protections.
Validate with others
Before investing, confirm your approach with your prime and, if applicable, an assessor or consultant experienced with the program. A scope that seems reasonable to you may be challenged during assessment if the boundary is poorly justified.
Where Ironfield Cyber helps
Ironfield Cyber helps defense suppliers evaluate scope options, design practical enclaves, and prepare documentation aligned with NIST SP 800-171. If compliance cost is a concern, a scoping conversation is a good first step.