# CMMC Enclave: How to Shrink Your Level 2 Scope to the Room Where CUI Lives URL: https://limehawk.io/reports/cmmc-enclave Published: 2026-10-02 Author: Corey Watson, Managing Member Topic: Guides Read time: 7 min A CMMC enclave is a separated environment where CUI lives, so the rest of the business stays out of Level 2 scope. 32 CFR 170.19 sets how assets are scoped. > **TL;DR** A CMMC enclave is a smaller, separated part of your environment where Controlled Unclassified Information (CUI) is handled. Everything that touches CUI goes inside it. Everything that's physically or logically cut off from it, and doesn't protect it, can be out of scope. The scoping rule at 32 CFR 170.19 sorts every asset into one of five categories: CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets, and Out-of-Scope Assets. Plant-floor OT usually lands in Specialized Assets. An enclave makes the assessment smaller. It doesn't make the 110 requirements go away, and the tools that protect the enclave come into scope with it. - Level 2 asset categories: 5 ## What is a CMMC enclave? A CMMC enclave is a segmented part of your environment set aside for Controlled Unclassified Information. The CUI goes in, the people who need it work inside it, and everything else in the business stays outside. If the separation holds, the rest of your network can be scoped out of your Level 2 assessment. The rule itself doesn't define the word. The DoD's [Level 2 Scoping Guide](https://dowcio.war.gov/Portals/0/Documents/CMMC/ScopingGuideL2.pdf) (version 2.13, September 2024) has a section called "Use of Enclaves," and it leans on NIST SP 800-171 Rev 2 for the idea. NIST says you "may limit the scope of the security requirements by isolating the designated system components in a separate CUI security domain," using things like "subnetworks with firewalls or other boundary protection devices." If you're not sure what counts as CUI in the first place, start with [what is CUI](/reports/what-is-cui). This guide assumes you already know CUI is coming in the door, usually as a drawing package, and you're deciding where to put it. ## Why does a small shop want an enclave? Because Level 2 applies to every asset in scope, and scope follows the CUI. If CUI drawings land in a shared inbox, sit on the file server, and get opened on the front-office PCs, that's all CUI Assets. Every one of them has to meet all 110 requirements in NIST SP 800-171 Rev 2. We walk through those in our [CMMC Level 2 requirements guide](/reports/cmmc-level-2-requirements). Put the CUI in a small, fenced-off space instead and the assessment covers that space plus what protects it. The accountant's laptop, the shipping PC, and the break-room TV can stay outside, as long as they really can't reach CUI. ## How does CMMC scoping work under 32 CFR 170.19? [32 CFR 170.19](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170/section-170.19) sorts every asset in your environment into 5 categories, and you have to set that scope before any Level 2 assessment. Four categories are in scope. One isn't. Here's what Table 3 of the rule says for each: - **CUI Assets.** Anything that processes, stores, or transmits CUI. Document it in the asset inventory, the SSP, and the network diagram. It's assessed against all Level 2 requirements. - **Security Protection Assets.** Anything that provides security functions to the scope: firewalls, logging, VPNs, the anti-malware console, and the people who run them. The scoping guide lists "managed service provider personnel who implement system maintenance" as an example. These are assessed against the requirements relevant to what they do. - **Contractor Risk Managed Assets.** Assets that can handle CUI but aren't supposed to, because your policies and practices keep CUI off them. They don't have to be separated from CUI Assets. The assessor reviews the SSP and can run a "limited check" if your documentation raises questions. - **Specialized Assets.** Assets that can handle CUI "but are unable to be fully secured": IoT, IIoT, operational technology, government furnished equipment, restricted information systems, and test equipment. They're documented and managed under your risk-based policies. They aren't assessed against the other requirements. - **Out-of-Scope Assets.** Assets that can't process, store, or transmit CUI and don't protect CUI Assets, or that are "physically or logically separated from CUI assets." No documentation is required. But if an asset fits any in-scope category, it can't be out of scope. That last line is where enclaves live or die. The scoping guide says separation "is required only for Out-of-Scope Assets." Logical separation means firewalls, VLANs, routers, or VPNs block data flow. Physical separation means no connection at all, so data only moves by hand. ## What does an enclave look like at a small shop? There's no single blessed design. The scoping guide says, "The OSA determines the architecture that best meets its business needs." For a shop with a handful of people who touch CUI, three patterns come up most: 1. **A dedicated cloud tenant.** CUI email and files live in a separate cloud environment, and only the people who need CUI get accounts in it. If a cloud provider stores CUI for you, the rule says it "shall meet the FedRAMP requirements" in DFARS 252.204-7012. We cover what that means for Microsoft customers in [GCC High and CMMC](/reports/gcc-high-cmmc). 2. **Virtual desktops.** CUI stays on a hosted desktop, and users reach it through a VDI client. The rule says an endpoint running a VDI client that allows nothing "beyond the Keyboard/Video/Mouse sent to the VDI client" is out of scope. The configuration has to actually block copy, print, and drive mapping, and you have to be able to show it. 3. **A few dedicated workstations.** Two or three machines on their own network segment, behind their own firewall rules, used only for CUI work. It's low-tech and easy to explain, and it fits a shop where CUI work happens at one desk. Plenty of shops end up with a mix, such as a dedicated tenant plus dedicated workstations for the engineers who open the drawings. ## Where does shop-floor OT fit? Usually in Specialized Assets. The scoping guide defines OT as "programmable systems or devices that interact with the physical environment" and says it "specifically includes" SCADA. If a CNC controller or the old Windows PC that feeds it gets CUI drawings loaded onto it, it's handling CUI, but you often can't patch it or put modern security tools on it. That's exactly the case the Specialized Asset category was written for. It's not a free pass. You still have to list the machine in the inventory, show it in the network diagram, and describe in the SSP how you manage it under written risk-based policies. In practice, that means the same isolation we describe in [what is OT security](/reports/what-is-ot-security): keep it off the internet, wall it off from the office, and control who can reach it. Our [manufacturing IT page](/industries/manufacturing) covers how we segment the plant floor. ## What are the tradeoffs? An enclave cuts the assessment down. It also adds friction and a few surprises: - **The protection comes with it.** The scoping guide's example is a central anti-malware tool. The tool, its management server, and the IT people who run it can all be in scope even if the enclave is small. Any shared service that protects the enclave becomes a Security Protection Asset. - **Every requirement still has to be MET.** Inside the enclave you can inherit company-wide controls, but the guide says if something in the enclave "would invalidate an implementation at the Enterprise level," you have to meet that requirement some other way. - **Workflow changes.** People switch between two environments. If CUI starts moving through the regular inbox because it's easier, your scope just grew. - **Big changes mean a new assessment.** The guide says "significant architectural or boundary changes" require one. Adding a machine inside the existing boundary that follows the SSP doesn't. - **Out of scope has to be justified.** The rule says you must "prepare to justify" why an out-of-scope asset can't handle CUI. Saying it's separate isn't enough. You need a firewall rule, a diagram, or a config that proves it. On timing: the July 13, 2026 [memo suspending the Phase 2 transition](https://dowcio.war.gov/Portals/0/Documents/Library/ImplementingSuspensionCMMC-PhaseII.pdf) means new contracts can only ask for Level 1 (Self) or Level 2 (Self) for now. Scoping rules don't change with it. A self-assessment still has to say what's in scope, and a DIBCAC review can still check it. As of October 2, 2026, the suspension is still in place, so check the solicitation in front of you. ## Key takeaways - An enclave is a separated environment where CUI lives. The goal is a smaller CMMC Assessment Scope, not fewer requirements. - 32 CFR 170.19 sorts assets into 5 categories. Four are in Level 2 scope. Only Out-of-Scope Assets need no documentation. - Out-of-scope requires physical or logical separation from CUI Assets. A VDI endpoint that only passes keyboard, video, and mouse counts as out of scope. - Tools that protect the enclave, like logging, anti-malware management, and the people who run them, are Security Protection Assets and come into scope. - Shop-floor OT is a Specialized Asset. It isn't assessed against the other requirements, but it must be in the inventory, the SSP, and the network diagram. ## What this looks like when we do it Limehawk isn't a C3PAO, an RPO, or an assessor, and we don't certify anyone. Our part is the IT under the scope. We build the asset inventory and network diagram, sort every device into one of the five categories, and separate the CUI space from the rest of the network with firewall rules and segments we can show on paper. On the plant floor, we keep Windows 98 through 7 and SCADA systems running, isolated, and documented instead of forcing a replacement. That's the work a Specialized Asset entry in your SSP needs behind it. If we manage systems that protect your enclave, we're a Security Protection Asset in your SSP, and we plan for that from the start. Our [manufacturing IT support](/industries/manufacturing) page covers the OT side in more detail. Got CUI drawings landing in the general inbox and no idea how big your scope really is? Book a call and we'll walk through it with you.