A CUI enclave is an isolated network segment that contains every system storing, processing, or transmitting Controlled Unclassified Information (CUI). It draws a hard boundary around CUI-handling assets and enforces that only authenticated, authorized identities can reach anything inside it. That boundary is also the assessment scope for CMMC Level 2 and the unit of documentation in the System Security Plan (SSP).
How does a CUI enclave work?
A CUI enclave groups every asset that touches CUI into one logical boundary: workstations where engineers open controlled technical data, file servers that store CUI documents, and any network path CUI crosses in transit. Everything inside the boundary is in scope. Everything outside it, ideally, is not.
For a manufacturer, the enclave has two halves. A cloud or file-sharing enclave, such as Microsoft GCC High or an encrypted file-sharing service, holds CUI on desks and in email. The shop-floor half covers the machines that receive CUI drawings: CNCs, DNC servers, CAD/CAM stations, PLCs and HMIs. For a small manufacturer, that second half is often where the assessment boundary gets hard to draw.
The shop-floor half does not need recabling. One route on the existing router sends the traffic of the machine subnet through a single enforcement point. That point checks identity, logs every access attempt and produces the audit evidence assessors expect. Removing the route undoes it.
How is a CUI enclave different from a VLAN?
The difference is the enforcement mechanism. A VLAN segments traffic at Layer 2 using switch-port assignments and 802.1Q tags. Any device plugged into the right port, or configured with the right VLAN ID, joins the segment regardless of who is using it or how the device is configured. A CUI enclave requires identity verification before granting network-layer access. Traffic from an unauthenticated or unauthorized device never reaches enclave resources, even when that device shares the same physical switch. VLANs separate traffic. Enclaves separate trust.
Why do CUI enclaves matter for OT and industrial environments?
Defense manufacturers often handle CUI on the same shop floor where PLCs, HMIs, and SCADA historians run. A CNC machine receiving controlled technical drawings is inside the CUI enclave; the adjacent environmental monitoring system is not. Without a well-drawn enclave, the whole plant network becomes the assessment boundary, and the cost and complexity of a CMMC assessment climb with it.
In brownfield OT environments, where change freezes and uptime rules block physical network edits, a routed enclave is especially useful. It deploys alongside production infrastructure without touching IP addressing, switch and VLAN configurations, or firewall rules on the physical network.
What CMMC and NIST controls apply to CUI enclaves?
CMMC Level 2 requires contractors to document every CUI enclave boundary in the SSP and show that access is limited to authorized users with a legitimate need. NIST SP 800-171 controls AC-3 (access enforcement), SC-7 (boundary protection), and SC-28 (protection of information at rest) map directly to enclave design. IEC 62443 zones and conduits give a complementary way to define enclave boundaries in OT.
Related terms
- Controlled Unclassified Information (CUI)
- CMMC
- Network Segmentation
- Zero Trust Architecture
- NIST SP 800-171
How Access Gate helps
Access Gate builds the shop-floor half of the CUI enclave with one route on the existing router, so defense contractors isolate the machines that handle CUI without physical network changes. It works with a GCC High or file-sharing enclave: Access Gate CMMC Edition connects to enclaves such as GCC High over an IPsec tunnel that uses FIPS 140-3 validated modules. See CMMC compliance and CUI enclave architecture.
