CUI Enclave Guide: Scope, Cost, and a Turnkey Option on Microsoft GCC High

What Is a CUI Enclave?

A CUI enclave (also called a CMMC enclave or secure enclave) is a segregated environment built specifically to store, process, and transmit Controlled Unclassified Information, with all 110 NIST SP 800-171 controls concentrated inside one defined boundary. CUI itself is defined in 32 CFR Part 2002 as information the government creates or possesses, or that a contractor handles on its behalf, that a law, regulation, or government-wide policy requires be safeguarded. The CMMC Assessment Process (CAP) published by the Cyber AB describes an enclave as a set of system resources that operate within a single security domain and share a common, continuous security perimeter. In practice, that means the people, devices, applications, and data that touch CUI live inside the enclave, everything else stays in your commercial IT environment, and the assessment scope shrinks to match.

Both paths can pass a Level 2 assessment. The difference is how much of your business has to be brought into scope to get there.

Whatever platform it runs on, a defensible CUI enclave is built from four capabilities. An assessor will look for each one in your System Security Plan and expect to see it working in the environment.

1. Isolation from the host network. The enclave is a separate tenant with its own identities, devices, and network path. Nothing in the commercial Microsoft 365 tenant can reach CUI without crossing a controlled, logged boundary. In the Essendis enclave this is a dedicated Microsoft 365 GCC High tenant with Azure Government, kept cleanly apart from your commercial tenant.

2. Least-privilege access. Only named users with a need to know can authenticate into the enclave, every login uses phishing-resistant multifactor authentication, and conditional access blocks unmanaged or non-US devices. Access reviews produce the evidence for the Access Control and Identification & Authentication control families.

3. Cryptographic protection. CUI is encrypted at rest and in transit with FIPS 140-validated modules, and sensitivity labels travel with the data so it stays protected when it is emailed to a prime or downloaded to a managed laptop. This is what DFARS 252.204-7012 paragraphs (c) through (g) and NIST SP 800-171 3.13 actually require.

4. Logging, monitoring, and response. Every sign-in, file access, and configuration change inside the boundary is logged centrally, reviewed by a Secure Operations Center, and retained for the assessment. The Audit & Accountability and Incident Response families cannot be met with a tool alone; someone has to watch it, and that is what the managed service is for.

Picture three zones side by side: your commercial Microsoft 365 tenant on the left running day-to-day business; the CUI enclave in the middle holding the program team, its devices, email, files, and CAD data behind the four controls above; and your primes, DoD customers, and C3PAO on the right, who exchange CUI only with the enclave. The assessment scope is the middle box, and nothing else.

Who Should Consider a CUI Enclave?

Any organization in the DoD supply chain that handles CUI — primes and subcontractors alike — is the obvious candidate: CMMC Level 2 applies wherever that data lives, and an enclave is the fastest defensible way to contain it. But the same architecture serves anyone holding high-sensitivity data under strict compliance obligations: ITAR technical data, regulated health or financial information, criminal-justice data. If you face requirements under any of these frameworks, an enclave is worth a serious look:

An enclave is not a silver bullet, and a vendor who tells you every contractor needs one is selling, not scoping. There are four situations where you should treat the whole enterprise as the CMMC boundary instead.

Most of your business is defense work. If CUI flows through sales, engineering, manufacturing, and finance alike, an enclave boundary will either leak or swallow the company. At that point an enterprise-wide GCC High migration is simpler to assess and to run.

Your workflows cannot be split. Shared ERP, PLM, or shop-floor systems that mix CUI and commercial data cannot sit half in and half out of a boundary. Either the system moves inside the enclave (and everyone who uses it with it) or the enclave is the wrong model.

You expect the enclave to do the compliance for you. An enclave inherits a large share of the 110 controls from the platform and the managed service, but a Shared Responsibility Matrix will still show controls marked partially inherited or customer responsibility: training, personnel screening, physical protection, and your own policies. Those are yours whether or not you buy an enclave.

You have ITAR data and a provider that cannot prove US-person support. Export-controlled technical data needs US-sovereign hosting and US-person administrators end to end. A hosting provider that cannot show FedRAMP Moderate (or equivalent) authorization and US-person staffing turns an enclave into an automatic finding.

The question we hear most from program managers is not about controls, it is about Tuesday morning: what changes for the engineer who has to get work done? Here is what day-to-day life inside an enclave looks like, and the habits that keep it compliant.

Do

Keep CUI work inside the enclave, and only CUI work. The enclave is for the program data that carries CUI markings or DFARS 7012 obligations. Payroll, marketing, and the company picnic stay in commercial Microsoft 365. Every unnecessary workload you move in widens the scope you will be assessed on.

Use your enclave email address for anything that touches CUI. Enclave users get a second mailbox in GCC High. CUI goes to and from that address, where data-loss-prevention rules, encryption, and logging apply. Primes and DoD customers are told to use it; a message with CUI sent to the commercial address is a reportable mistake.

Label your data. Sensitivity labels are applied when a file is created or saved, and they follow the file into email, Teams, and downloads. Labeling is what lets the system enforce rules automatically instead of relying on memory.

Expect one laptop, two environments. Most users work from a single managed device: the commercial desktop for ordinary work and a virtual desktop or isolated session for enclave work. A second monitor makes this painless. Heavy CAD users get a GPU-backed virtual desktop inside the enclave.

Don't

Don't try to move data out to make life easier. Copy and paste, screen capture, printing, and USB are blocked or logged inside the enclave by design. Working around them, even once, creates a data hole that an assessor or an incident investigation will find.

Don't invite people in who don't need to be there. Every account in the enclave is a person who needs training, screening, access reviews, and a license. Keep the roster to those who actually touch CUI.

Don't travel with it switched on without asking. ITAR-controlled enclaves geofence access to US locations. An engineer who opens a laptop in Toronto or at a conference abroad will be blocked, and that is the control working. Tell the SOC before travel so legitimate access can be planned.

Don't assume the enclave has done the training for you. Awareness training, acceptable-use acknowledgement, and insider-threat awareness remain your obligations under NIST SP 800-171 3.2. The enclave gives you the evidence trail; your people still have to complete it.

Build vs. Buy: Should You Stand Up Your Own GCC High Tenant?

You can build your own enclave: license GCC High, configure the tenant, harden every workload, write the policies, and generate the evidence. Contractors who go that route discover that the licensing alone is a specialty — GCC High is sold through a small circle of authorized partners, with eligibility validation and licensing rules that surprise first-timers — and the configuration work assumes deep familiarity with both Microsoft's government cloud and the assessment objectives a C3PAO will actually test. Budget a year or more of skilled internal effort, then plan for the permanent burden after go-live: patching, monitoring, evidence collection, and keeping configurations from drifting out of compliance. Buying a managed enclave compresses that into weeks, on an architecture that has already survived assessment scrutiny.

What a Managed Enclave Takes Off Your Plate

With the Essendis enclave, licensing is handled — we're a Microsoft Government Cloud reseller and AOS-G partner, so we procure and provision GCC High directly. The security stack arrives configured and mapped to the objectives assessors actually test. Policies, the System Security Plan, and evidence templates come with the environment instead of being written from scratch. And operations don't land on your IT team: our US-based 24x7 Secure Operations Center monitors the enclave, and our engineers keep it patched, tuned, and audit-ready between assessments. Your people keep their day jobs; your compliance program stops depending on whoever last touched the firewall.

Why are "CUI File Sharing" Solutions Not Enough?

Point solutions that promise "compliant CUI file sharing" solve one control family and leave the rest of your obligation untouched. CUI doesn't just sit in shared files — it moves through email, chat, project tools, and engineering systems, and NIST SP 800-171 applies to every system that stores, processes, or transmits it. A file-sharing tool bolted onto a commercial environment usually expands your assessment scope instead of shrinking it. An enclave addresses the whole data lifecycle inside one boundary.

How Do I Know if I'm Working with CUI?

CUI is unclassified information the government requires you to safeguard — in defense work, that's typically technical drawings, specifications, manufacturing data, and export-controlled information. Look at your contracts: DFARS 252.204-7012 clauses, distribution statements on documents, and CUI markings in the data you receive are the clearest signals. Many contractors underestimate what qualifies, then discover CUI scattered across email and file shares during their first scoping exercise. If you hold DoD contracts and aren't certain, assume you have it until a scoping review proves otherwise.

How Do I Know if I Need a CUI Enclave?

Ask three questions. How much of your business actually touches CUI — a program team, or everyone? What would it cost to bring your entire existing environment up to all 110 controls? And who will operate that compliance program year after year? If CUI is concentrated in a fraction of your operations, or your current network would need heavy remediation, isolating the data in a managed enclave is almost always faster and cheaper than an enterprise-wide retrofit.

Is GCC High Required — or Can We Keep Commercial Microsoft 365?

Commercial Microsoft 365 can technically hold some CUI, but it can't satisfy the DFARS 252.204-7012 paragraphs (c)–(g) incident-reporting and sovereignty obligations most defense contracts carry, and it isn't appropriate for ITAR data. GCC sits in the middle and fits some civilian-agency work. For most of the Defense Industrial Base, GCC High is the defensible answer: a US-sovereign Microsoft cloud operated by screened US persons, built to FedRAMP High-equivalent standards, and designed to support ITAR and DFARS 7012 requirements. That's why the Essendis enclave is built on GCC High by default. And no — you don't have to move your whole company. Your commercial tenant keeps running the business; the enclave handles the CUI.

Less than enterprise-wide compliance, and that is the point. A CUI enclave has three cost components: Microsoft GCC High licensing for the users inside the boundary (not the whole company), a one-time build and migration effort, and an ongoing managed-service fee that covers 24x7 operations, evidence upkeep, and assessment support. The biggest single driver is the size of your CUI population: an enclave for 15 engineers on a single program costs a fraction of one for 150 people across three divisions. The next drivers are the workloads that must move (email, files, CAD and technical data, line-of-business systems) and how much of the operation you want handled for you versus run by your own IT team. Because every enclave is scoped to a specific CUI footprint, we price after a short scoping conversation rather than from a rate card, and the scoping conversation is free.

What is a CUI enclave?

A CUI enclave is a segregated IT environment, usually a dedicated Microsoft 365 GCC High tenant, where all Controlled Unclassified Information is stored, processed, and transmitted so that the 110 NIST SP 800-171 controls apply to one defined boundary instead of the whole company.

What is the difference between a CUI enclave and a CMMC enclave?

Nothing in practice. CUI enclave describes what it protects; CMMC enclave describes the assessment it is built to pass. Secure enclave and compliance enclave are used the same way.

Who needs a CUI enclave?

Defense contractors and subcontractors subject to CMMC Level 2 whose CUI is concentrated in a program team or a fraction of the business. If CUI flows through every department, an enterprise-wide boundary is usually the better choice.

CUI enclave vs. enterprise-wide compliance: how do I choose?

Ask what share of your people and systems actually touch CUI, what it would cost to remediate every legacy system, and who will run the program afterward. Concentrated CUI, expensive legacy IT, and a small IT team all point to an enclave. See the comparison table above and our enclave vs. enterprise guide.

Is Microsoft GCC High required for a CUI enclave?

For DFARS 252.204-7012 and ITAR work, GCC High is the default because it provides FedRAMP High-equivalent infrastructure, US data residency, and US-person support. Commercial Microsoft 365 cannot satisfy the 7012 incident-reporting and cloud-equivalency requirements on its own.

How much does a CUI enclave cost?

Three components: GCC High licensing for enclave users only, a one-time build and migration, and an ongoing managed-service fee. The main driver is the number of people inside the boundary. Pricing follows a free scoping conversation.

How long does it take to stand one up?

A pre-built managed enclave is typically assessment-ready in weeks to a few months, depending on how many workloads must migrate. Enterprise-wide remediation across legacy IT typically takes 12 to 24 months.

Can I build a CUI enclave myself instead of buying a managed one?

Yes, if you can license GCC High, configure and harden the tenant, write the System Security Plan and policies, and run 24x7 monitoring and evidence collection. Most contractors with fewer than a few hundred staff find a managed enclave cheaper once internal time is counted. See Build vs. Buy above.

What is an ITAR-compliant enclave?

A CUI enclave with added export-control safeguards: data stored only in US-sovereign cloud regions, administration and support limited to US persons, and geofenced access so technical data cannot be opened from outside the United States.

What does working in an enclave feel like for employees?

A second mailbox and a separate desktop session for CUI work on the same laptop, sensitivity labels on files, and blocked copy-paste, screenshots, printing, and USB inside the boundary. Most users adjust within a week; see the dos and don'ts above.

Has an Essendis enclave passed a CMMC Level 2 assessment?

Yes. RPS Defense took its Essendis-built enclave through a Level 2 assessment with A-LIGN, a certified C3PAO, and scored 110 out of 110 with no POA&M.