CMMC enclave for small manufacturers. The desk and the shop floor.
An enclave keeps CUI in a small, controlled part of your business. Small manufacturers usually pick one for email, files and CAD. The drawings then go to the shop floor. This guide compares the enclave types and shows how to cover the machines that receive CUI.
Last updated:
What is the best CMMC enclave for a small manufacturer?
It depends on where your CUI lives. When CUI reaches the shop floor, you need two pieces: an IT enclave for the desk and protection for the machines.
For the desk, there are five common enclave types: a managed GCC High enclave (Summit 7), a hosted GCC High virtual desktop enclave (Cuick Trac, CUI Vault), a single hardened on-premise PC (Totem HRDN-IT), an encrypted email and file overlay (PreVeil), or a managed IT program with GCC High (C3 Integrated Solutions).
For the floor, an enclave stops at the desk. When a CUI drawing or toolpath reaches a CAD/CAM station, a DNC server or a CNC, those machines are in your assessment scope. Trout Access Gate protects those machines and works with any of the five enclave types.
The five CMMC enclave types and who offers them
Each row describes the offer in the provider's own words, from its public page. Pick the row that matches where your CUI lives. The last column answers one question: are the shop-floor machines covered?
| Enclave type | Example providers | What it protects | Best for | CNCs, PLCs and HMIs |
|---|---|---|---|---|
| Managed GCC High enclave | Summit 7 | Microsoft government cloud with virtual or physical desktops. Summit 7 lists SolidWorks, Autodesk and ProShop. | Mixed businesses with a small defense footprint, already on Microsoft 365. | Not what it is built for. Summit 7 links the enclave to the shop floor without bringing OT into scope. If CUI reaches the machines, pair it with machine-level protection. |
| Hosted virtual desktop enclave | Beryllium InfoSec, Cuick Trac, CUI Vault | A fully managed enclave in Microsoft GCC High, used through a virtual desktop. CUI does not reach users' own devices. | Defense contractors without the staff to build NIST 800-171 controls in-house. | Not what it is built for. Files that leave the virtual desktop for a machine need machine-level protection. CUI Vault, our partner, connects its enclave to Access Gate for that. |
| Single hardened on-premise PC | Totem Technologies, HRDN-IT | A hardened Windows 11 laptop, a hardened router and a FIPS-validated backup drive, shipped to you. | Small and micro businesses where one person handles CUI. | Not what it is built for. A drawing copied from the PC to a CNC takes the CUI out of the enclave. |
| Encrypted email and file overlay | PreVeil | End-to-end encrypted email and file sharing, deployed alongside Microsoft 365, Exchange or Google Workspace. | Teams whose CUI is mostly drawings and documents exchanged with primes. | Not what it is built for. Once a drawing is opened on a CAD/CAM station or sent to a machine, it needs machine-level protection. |
| Managed IT program with GCC High | C3 Integrated Solutions | Managed IT and cybersecurity, GCC and GCC High deployment, and CMMC environments built for the Defense Industrial Base. | Growing manufacturers that want one provider for IT, security and compliance. | Depends on the scope you agree with the provider. Ask whether the machines are in it. |
These are examples, not a ranking. Check each provider's current offer, and ask for the assessment boundary it proposes for your company.
Where the shop floor falls out of the enclave
An enclave keeps CUI inside a boundary. On a shop floor, the CUI does not stay at the desk. It follows the part.
CAD/CAM stations
Engineers open CUI drawings to program a part. The station that runs the CAM software holds the drawing, even if the enclave stored it.
DNC servers and file shares
Toolpaths built from CUI drawings go to a DNC server or a shared folder, then to the machine. Each hop is a copy of CUI.
CNCs, CMMs and printers
The machine that cuts the part, the CMM that inspects it and the printer that prints the traveler all receive CUI. Many run old operating systems that cannot take an agent or MFA.
Specialized assets
CMMC treats these machines as specialized assets. They stay in scope: you document them in your SSP, and you protect them with controls around them, at the network. See CMMC exceptions and compensating controls for OT.
The question to ask before you buy an enclave: draw the assessment boundary. If a CUI drawing can reach a machine, the machine is inside the boundary, and the enclave alone does not protect it.
How Access Gate works with each enclave type
Access Gate is an appliance on the shop-floor network. It does not replace your enclave. It extends the protection from the enclave to the machines that use the CUI.
One rule on your router
Access Gate connects to your existing network. One rule on your current router sends the machine traffic through it. Nothing changes on the machines, and it is installed in a day.
Who reaches each machine
Only named people and approved stations reach a CNC, a PLC or an HMI, with MFA at the gate for machines that cannot ask for it. Every session is logged and can be recorded.
Evidence for the assessor
Access Gate produces evidence for 87 of the 110 NIST SP 800-171 controls at the network layer. The shared responsibility matrix lists who owns each control.
A tunnel to GCC High
Access Gate CMMC Edition connects to a GCC High enclave over an IPsec/IKEv2 tunnel that uses FIPS 140-3 validated modules (CMVP certificates #5441 and #5031). See FIPS validated encryption and the last hop from the cloud enclave to the machine.
With a GCC High enclave (Summit 7, C3, or CUI Vault's virtual desktops), the tunnel carries CUI from the enclave to the machines. With a virtual desktop or a single PC (Cuick Trac, Totem), Access Gate controls the path from the CUI station to the machines it feeds. With an encrypted overlay (PreVeil), Access Gate protects the stations that open the drawings and the machines that receive them.
Manufacturing cybersecurity, without downtime.
Access Gate Starter: secure your plant without a network project.
A 40-second film on Access Gate Starter: connect it, see every machine, control who reaches them and export the audit proof, without stopping production.
Five questions to ask any CMMC enclave provider, for the shop floor
- 1
What stays in my assessment scope?
Ask for a boundary diagram that shows workstations, printers, DNC servers and machines. If a machine receives CUI, it should be on the diagram.
- 2
Can we keep our CAD/CAM software?
Ask for a demonstration with your real drawings and post-processors, including exports to the machines.
- 3
How does a file get from the enclave to a machine?
Every transfer of a CUI toolpath is a copy of CUI. Ask which control protects that path and who logs it.
- 4
Who owns each control?
Ask for a written responsibility matrix. Compare it with ours for the network controls on the floor.
- 5
What evidence will the assessor get?
Ask for the control mapping and the documents you will hand over. Access Gate exports the inventory, the enforced policy and the session logs for the machines.
CMMC status
CMMC Phase II third-party assessments have been suspended since 13 July 2026. The NIST 800-171 obligation stands: the controls, the self-assessment and the SPRS affirmation still apply to contracts with CUI.
What protecting the shop floor costs
Access Gate Starter: $780 for the appliance, then $399 per month for license and support, with the first 30 days of license free. One plant, up to 200 machines, ordered online and plugged in yourself. US only.
Several plants, more machines, or the CMMC Edition tunnel to a GCC High enclave: see the plans and prices.
Tell us which enclave you use or are choosing. We show where the machines sit in your boundary, and how Access Gate covers them in a day.
Questions about CMMC enclaves for small manufacturers.
The best fit depends on where your CUI lives. A managed GCC High enclave (Summit 7, C3) suits Microsoft 365 shops. A hosted GCC High virtual desktop (Cuick Trac, CUI Vault) suits teams without IT staff. A single hardened PC (Totem HRDN-IT) suits one CUI user. An encrypted overlay (PreVeil) suits teams that mostly exchange drawings. If CUI drawings reach your machines, add machine-level protection such as Trout Access Gate.
No. A GCC High enclave protects the cloud tenant and the desktops that use it. A CNC that receives a CUI toolpath is a specialized asset in your assessment scope. It needs controls around it on the shop-floor network. Access Gate CMMC Edition connects to GCC High over a tunnel that uses FIPS 140-3 validated modules and protects the machines behind it.
Yes. PreVeil encrypts email and files alongside your existing Microsoft 365, Exchange or Google Workspace. Access Gate protects the stations that open the drawings and the machines that receive them. The two cover different parts of the boundary.
If a machine stores, processes or receives CUI, it is in scope. CMMC calls these machines specialized assets. You document them in your SSP and protect them with controls around them, because many cannot run agents or MFA.
Access Gate Starter costs $780 for the appliance, then $399 per month for license and support, with the first 30 days of license free. It covers one plant with up to 200 machines, in the US. Larger sites and the CMMC Edition are on the pricing page.
Yes. CMMC Phase II third-party assessments have been suspended since 13 July 2026, but the NIST 800-171 controls, the self-assessment and the SPRS affirmation still apply to contracts with CUI.