CMMC Enclave Implementation Guide

An enclave is an isolated environment for CUI processing. The isolation is enforced through network boundaries, identity controls, and data flow restrictions. The goal is to limit the scope of CMMC controls to a defined subset of your infrastructure rather than applying them across the entire organization.

Scope reduction is the primary benefit. If only 20% of your systems touch CUI, hardening that 20% is typically less expensive and disruptive than hardening everything. But scope reduction is not automatic—you must prove the boundary is real and maintained.

Operational complexity is the primary cost. Running two environments means two sets of procedures, two support paths, and users who must switch between modes. This friction is often underestimated.

Important: An enclave is not a compliance shortcut. The controls within the enclave must still meet NIST 800-171 requirements. What changes is where those controls apply, not the rigor required. You are trading breadth for depth: fewer systems to harden, but those systems must be fully compliant.

Hybrid Enclave (On-Prem + Cloud)

A hybrid enclave combines on-premises CUI processing with cloud-based supporting services. The CUI processing environment lives on-prem, while identity, logging, or backup may be cloud-hosted.

When to choose hybrid:

• Existing on-prem infrastructure that already handles sensitive workloads
• Latency-sensitive workloads that benefit from local processing
• Regulatory or contractual requirements for on-prem data residency
• IT team with strong on-prem management capabilities

Challenges:

• Maintaining clear separation between CUI and non-CUI systems
• Network boundary management (firewalls, VLANs, routing)
• Consistent identity and access management across environments
• More complex disaster recovery and backup strategies

Cloud-Only Enclave

A cloud-only enclave hosts the entire CUI environment in cloud infrastructure. This is typically implemented using a dedicated cloud tenant or subscription with appropriate security controls.

When to choose cloud-only:

• Cloud-native organization or distributed workforce
• Limited IT staff or on-prem infrastructure
• Need for rapid scaling or geographic flexibility
• Preference for managed infrastructure services

Challenges:

• Data egress costs and vendor lock-in considerations
• Understanding and documenting shared responsibility
• Selecting and configuring the right cloud service tier (e.g., Microsoft GCC High vs. commercial)
• Proving boundary isolation in a shared cloud environment

Industry data suggests cloud-only enclaves can reduce implementation costs by approximately 20% compared to hybrid approaches, primarily through reduced infrastructure management overhead. However, this varies significantly based on your starting point and requirements.

1. CUI inventory and workflow mapping. Before designing an enclave, you must know where CUI lives, how it flows, and who needs access. Map every system, application, and process that touches CUI. This inventory becomes your scope boundary definition.
2. Select enclave model. Based on your inventory, current infrastructure, and organizational capabilities, choose between hybrid and cloud-only. Consider: existing investments, IT capabilities, workforce distribution, and growth plans.
3. Design network boundaries. Define how the enclave connects to (and is isolated from) general business systems. Options include air-gapped networks (no connection), controlled access through firewalls and DMZs, or software-defined perimeters. Document the boundary architecture.
4. Implement identity isolation. Decide whether to use separate identity realms (different Active Directory domains or Azure AD tenants) or scoped permissions within a shared identity system. Separate realms are simpler to prove but more complex to manage.
5. Deploy technical controls. Within the enclave, implement encryption (at rest and in transit), Multi-Factor Authentication (MFA), logging and monitoring, endpoint protection, and backup/recovery. These controls must meet NIST 800-171 requirements.
6. Document the SSP and boundary diagrams. Your System Security Plan (SSP) must clearly describe the enclave boundary, what is inside and outside, and how controls are applied. Include network diagrams, data flow diagrams, and identity architecture.
7. Test and validate isolation. Verify that the boundary works as designed. Test: can a compromised non-CUI system reach enclave resources? Are access controls enforced? Is logging capturing all relevant events? Fix gaps before assessment.
8. Train users on dual-mode workflows. Users must understand when they are working in the enclave vs. general systems, how to transfer data between environments (if allowed), and what behaviors are prohibited. Training is ongoing, not one-time.

Network Segmentation

Network segmentation isolates CUI systems from general business systems at the network layer. Common approaches:

• VLANs: Virtual LANs separate traffic at layer 2. Simple to implement but require careful configuration of routing and firewall rules.
• Microsegmentation: Software-defined segmentation that creates boundaries at the workload level. More granular but requires platform investment (e.g., VMware NSX, cloud security groups).
• Physical isolation: Separate network infrastructure for the enclave. Strongest isolation but highest cost and complexity.

The right approach depends on your existing infrastructure and risk tolerance. Most organizations start with VLANs and firewall rules, then evolve toward microsegmentation as maturity increases.

Identity Models

Identity architecture determines how users authenticate to enclave resources.

• Separate AD/Azure AD tenant: Completely separate identity realm for CUI access. Clearest boundary but requires managing two directories and user provisioning.
• Scoped permissions in shared tenant: Single identity provider with conditional access and scoped permissions. Simpler user management but requires careful configuration to prove isolation.
• Federated identity: External identity provider federated with enclave systems. Common when subcontractors need access.

Whichever model you choose, document how you prove that enclave access requires distinct authentication and authorization.

Endpoint Handling

How users physically access the enclave affects both security and usability.

• Dedicated CUI workstations: Physical devices that only connect to the enclave. Strong security but requires hardware investment and physical workspace.
• Virtual Desktop Infrastructure (VDI): Virtual desktops for enclave access from general-purpose devices. Flexible but requires VDI platform and careful configuration to prevent data leakage.
• BYOD with conditional access: Personal devices with strict compliance requirements. Viable for cloud enclaves but requires robust Mobile Device Management (MDM) and conditional access policies.

Data Flow Controls

Controlling how data moves into and out of the enclave is critical for maintaining boundary integrity.

• Data Loss Prevention (DLP): Monitor and block unauthorized data transfers. Configure rules to detect CUI patterns and enforce allowed transfer channels.
• Encryption in transit: All data crossing enclave boundaries must be encrypted using FIPS-validated cryptography.
• Controlled transfer points: Designated systems or processes for moving data between environments. Document these in your SSP and monitor for unauthorized transfers.

Enclave costs fall into three categories: implementation, operations, and hidden costs.

Implementation Costs

• Infrastructure: Dedicated hardware or cloud resources for enclave systems
• Network segmentation: Firewalls, VLAN configuration, or microsegmentation platform
• Identity infrastructure: Separate AD domain or Azure AD tenant, or enhanced conditional access configuration
• Consulting/design: Architecture design and implementation guidance

Operational Costs

• Dual support paths: IT support for both enclave and general systems
• Monitoring: Separate logging and monitoring infrastructure or scoped views
• Backup and recovery: Dedicated backup systems or isolated backup targets
• Assessment scope: While smaller, enclave assessments still require thorough preparation

Hidden Costs

• User training: Initial and ongoing training for dual-mode workflows
• Support overhead: More complex troubleshooting across environments
• Workflow friction: Lost productivity from context-switching and transfer processes
• Shadow IT risk: Users bypassing enclave for convenience

Enclave vs. Enterprise Rollout

The cost comparison depends on your scope. If CUI touches 20% of your systems:

• Enclave: Higher per-system cost (full controls), but only 20% of systems
• Enterprise: Lower per-system cost (some controls may be lighter), but 100% of systems

The break-even point varies. Organizations with CUI concentrated in specific workflows often find enclaves more cost-effective. Organizations with CUI spread across most operations often find enterprise rollout simpler.

Industry data suggests cloud-only enclaves can reduce costs by approximately 20% compared to hybrid approaches, primarily through reduced infrastructure management and simplified disaster recovery. However, cloud costs scale with usage, so high-transaction environments may not see the same benefit.

An enclave is not always the right choice. Consider alternatives when:

• CUI is pervasive. If more than 80% of your workflows involve CUI, the complexity of maintaining separation likely exceeds the benefit. You are essentially running two parallel organizations.
• Organization lacks operational maturity. Running dual-mode operations requires disciplined processes. If your organization struggles with basic change management or access reviews, adding enclave complexity will create problems.
• Integration requirements make separation impractical. Some workflows require tight integration between CUI and non-CUI systems. If your business processes cannot tolerate the friction of separation, an enclave will be circumvented.
• User resistance will undermine compliance. If users view the enclave as an obstacle rather than a security control, they will find workarounds. Shadow CUI on general systems is worse than no enclave at all.

In these cases, consider a broader rollout with appropriate controls. The assessment scope is larger, but operational complexity is lower. See our CMMC Guide for enterprise rollout strategies.

• "Leaky" boundaries. The most common failure is accidental data paths that bypass the enclave. Email is a frequent culprit: users send CUI to their personal email "just this once" or CC non-CUI recipients. File sharing services, USB drives, and cloud storage are other common leak points. Audit your data flows regularly.
• Users bypassing the enclave. When the enclave is inconvenient, users will find workarounds. Common patterns: storing CUI on personal devices, using non-approved collaboration tools, or photographing screens. Address this through training, monitoring, and making the enclave as usable as possible.
• Insufficient logging of enclave access. Assessors want evidence that enclave access is monitored. If your logging stops at the firewall, you cannot prove who accessed what. Ensure authentication events, file access, and administrative actions within the enclave are logged and retained appropriately.
• Treating the enclave as "set and forget." Enclave boundaries erode over time. New applications are added without boundary review. Network changes create unintended paths. User access accumulates. Schedule regular boundary reviews and access recertification.
• Failing to document the boundary architecture. Your SSP must clearly describe what is in the enclave, what is outside, and how the boundary is enforced. Vague documentation like "CUI systems are isolated" will not satisfy assessors. Include specific network diagrams, firewall rules, and identity configurations.
• Underestimating user training needs. Users need to understand not just how to access the enclave, but why the boundary matters. Training should cover: what counts as CUI, how to recognize when they should be in the enclave, prohibited actions, and how to report suspected violations.

Related: CMMC Assessment Guide for what auditors actually examine.