CUI enclave: protect CUI from cloud to machine.

A CUI enclave is a bounded part of your network that holds every system that stores, processes or transmits Controlled Unclassified Information. Access control, encryption and audit logging guard its boundary, and only authorized people and processes get in. The DoD CMMC Level 2 Scoping Guide lets a contractor take its certification assessment on a specific enclave rather than the whole enterprise, so the rest of the company stays out of scope.

Yes, and for most suppliers that is the realistic shape. GCC High holds CUI on the IT side: email, documents and collaboration. It cannot enforce anything once that CUI has to reach a plant. An NC program going to a machine tool, a drawing opened on an operator station, or a print job on a shop-floor printer all leave the cloud boundary. The on-premise enclave picks up the flow there. Trout and CUI Vault connect a managed GCC High environment to Access Gate over a FIPS 140-3 validated site-to-site tunnel, so a job goes from the enclave to the machine without landing on a workstation.

Four cases. When CUI reaches OT, PLCs, CNCs or other specialized assets, which no cloud tenant can reach. When most of the company never handles CUI, so tenant-wide licences buy nothing for most users. When plants run air-gapped or offline. And when the CMMC timeline cannot wait for a tenant migration. In the first case the enclave usually runs alongside a GCC High tenant rather than replacing it.

GCC High is Microsoft's government cloud for defense contractors. It runs Exchange, Teams, SharePoint and OneDrive in dedicated infrastructure that supports DFARS 252.204-7012 and CUI workflows. It became the default because it solves the email and collaboration side of CUI. It also moves every CUI user into the GCC High tenant, with the licence, identity and migration work that implies.

Access Gate enforces 87 of the 110 NIST SP 800-171 controls at the network layer, across access control (AC), audit and accountability (AU), identification and authentication (IA), system and communications protection (SC) and system integrity (SI). The remaining controls are organizational: personnel security, physical protection, training and your own processes. Every covered control produces evidence on demand: session logs, policy configurations, segmentation baselines and denied-access records.

Access Gate is installed in a day, and a single-site enclave is complete in a week. Day 1: install the appliance, connect it to the network and to your identity provider. Days 2 and 3: confirm scope (which workflows, users and machines), then configure policy, MFA and audit logging. Days 4 and 5: assemble the evidence package, align the SSP and review internally. Nothing migrates, so no workflow changes.

32 CFR 170.19 sorts assets into CUI assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets and Out-of-Scope Assets. An asset that cannot store, process or transmit CUI, and is logically or physically separated from the enclave, is out of scope. In practice the engineering workstations, the machines that receive CUI drawings and the CUI file share sit inside the enclave. Everything else stays outside. Fewer assets in scope means fewer controls to prove and a smaller assessment.

You do not retire it, and you do not pretend it complies. Machine tools are Specialized Assets under CMMC scoping, documented in the SSP and managed under your risk-based policies. Access Gate is the compensating control. It sits in front of the controller, enforces identity, allows only the commands the job needs and logs every session. A CNC control cannot run an MFA client, so Access Gate performs the MFA and nothing is installed on the controller.

GCC High is the common default for ITAR and EAR technical data, because it offers US-person support and US data residency inside a DoD-authorized cloud. An on-premise enclave can hold ITAR and EAR data too, but the burden is yours. It must enforce US-person access at the identity layer, keep the data on US soil under your control, and log every access. Access Gate binds each session to a named identity from your IdP and records it. Many contractors keep ITAR email in GCC High and use the enclave for the ITAR drawings that live on the shop floor.

It does not need to be. FedRAMP is an authorization program for cloud services, and an on-premise enclave is not a cloud service. DFARS 252.204-7012 requires a cloud service that stores or processes CUI to meet the FedRAMP Moderate baseline or equivalent. Keeping CUI inside an on-premise enclave keeps those flows out of the cloud, so the question narrows to the cloud services you still use. It is a scope decision, not a FedRAMP substitute.

It replaces the flat VPN route into the CUI segment. The encrypted link stays: Access Gate CMMC Edition includes a FIPS-certified VPN that ends at the gate. A remote engineer or vendor authenticates through Access Gate and gets a time-bound session to the one machine the job requires, and the session is recorded. There is no flat tunnel into the CUI segment and no standing vendor account.