Terms / Scope and assets

Enclave

A separated environment built to hold the controlled work and nothing else. It is the usual way a small company keeps its assessment small.

Also called CUI enclave, secure enclave.

Practitioner Guidance

What it means in practice

An enclave is a small environment that holds the controlled work and nothing else.

It can be a separate cloud tenant, a separate set of workstations, a separate network segment, or all three. The point is not the technology. The point is that the boundary around it is narrow enough that most of your company stays outside your scope. For a company where a handful of people touch Controlled Unclassified Information, this is usually the cheapest defensible answer.

An enclave trades user convenience for assessment cost, and the trade is worth making.

People working inside it switch environments to do the controlled work. They cannot drag a file to a personal folder or open it on the laptop they use for everything else. That friction is real, and it is also what keeps the scope small. Decide who genuinely needs access before you build, because every added person widens the environment you must secure.

The enclave is only as good as the rules that keep information inside it.

Controlled information arriving by email, leaving on a memory stick, or copied into a quoting system defeats the design. Write down how information enters and leaves. Make those paths the only ones, and make them narrow. SC.L2-3.13.1 is the requirement that tests the boundary you drew. An enclave with a convenient side door is an enclave in name only.

Everything that protects the enclave is in scope with it.

Your identity provider, your endpoint protection, your backup service, and the tool your support provider uses to administer the machines are all security protection assets. They get assessed against the requirements relevant to what they do. People underestimate this and then discover the assessment covers a management platform they thought was outside it.

What falls short

An enclave that shares a file service with the rest of the business. The shared service carries controlled information, so it is inside the scope.
An enclave built for storage while email carrying controlled information stays outside it. Email transmits, so the mailbox is in scope.
An enclave with no written rule about how information enters and leaves. The paths exist regardless, and undocumented ones are found during the assessment.

Edge cases

Users reach the enclave through a virtual desktop. An endpoint running a client configured to pass only keyboard, video, and mouse is treated as an out-of-scope asset under table 3 to 170.19(c)(1).
Your controlled work includes paper drawings on a shop floor. A digital enclave does not cover them, so the physical handling needs its own treatment in the same plan.
A machine on the shop floor needs a program derived from a controlled drawing. That equipment is often a specialized asset, which is documented rather than assessed against every requirement.

Over-engineering

A separate enclave for each contract or program. One environment with access separated by program meets the requirement, unless export rules demand more.
An enclave for a company that holds only Federal Contract Information. Level 1 applies to your ordinary systems, and nothing asks you to separate that work.

Connects to

Boundary The line between what is inside your assessment scope and what is outside it. An assessor tests whether the line is actually enforced. Scope and assets
Scope The set of assets that will be assessed. Scope is the single decision that drives your cost, your evidence burden, and your assessment length. Scope and assets
Controlled Unclassified Information (CUI) CUI is unclassified information a law, regulation, or Government-wide policy requires you to protect. Handling it puts you at CMMC Level 2. What you protect
SC.L2-3.13.1 Boundary Protection System and Communications Protection (SC)
Security protection asset An asset that provides security functions for your assessment scope. It is in scope and assessed against the requirements it is relevant to. Scope and assets
Out-of-scope asset An asset that cannot handle CUI and protects nothing that does. It is not assessed, and you must be ready to justify the claim. Scope and assets
Specialized asset Equipment that can handle CUI but cannot be fully secured: IoT, OT, Government furnished equipment, restricted systems, and test equipment. Scope and assets
Federal Contract Information (FCI) FCI is information a contract provides to you or generates for the Government that is not for public release. Holding only FCI means CMMC Level 1. What you protect

Referenced by

Scope The set of assets that will be assessed. Scope is the single decision that drives your cost, your evidence burden, and your assessment length. Scope and assets
Data flow diagram A drawing of how CUI moves through your organization. It is the artifact that makes a scoping decision defensible, and it is usually done first. Certification
Level 1 The 15 basic safeguarding requirements for FCI, assessed by you every year. No plan of action is permitted at Level 1, ever. Certification
Level 2 The 110 requirements of NIST SP 800-171, assessed by you or by a C3PAO depending on what your contract says. This is where most CMMC work happens. Certification
AC.L2-3.1.1 Authorized Access Control Access Control (AC)
AC.L2-3.1.3 Control CUI Flow Access Control (AC)
AC.L2-3.1.20 External Connections Access Control (AC)
SC.L2-3.13.1 Boundary Protection System and Communications Protection (SC)