CMMC Level 2 Enclave Strategy
Segmentation, Scope Reduction, and Assessor Confidence
A CMMC enclave is a scope-reduction architecture that uses physical and logical separation techniques to contain CUI within a tightly defined assessment boundary — keeping the rest of the corporate environment out of scope. How well you build, document, and defend that boundary determines how long your assessment takes and how much it costs.
The most consequential cost lever in a CMMC Level 2 program is not which controls you implement — it is how much of your organization falls inside the assessment boundary. All 110 NIST SP 800-171 practices apply to every asset inside your assessed scope. Every asset you can credibly remove from that boundary eliminates a control verification obligation, reduces assessor sampling, and shortens the engagement.
The DoD CIO scoping guidance frames this through a specific architecture: the enclave. An enclave is a defined environment — physical, digital, or both — built specifically to process, store, and transmit CUI, with strict separation from the broader corporate network. Everything inside the enclave is fully assessed. Everything legitimately outside it is not.
What a CMMC Enclave Is — and What It Is Not
An enclave is not a permission restriction on a shared folder. It is not a policy statement in your SSP saying certain computers don't access CUI. It is a meticulously defined technical and physical boundary — with enforced separation, documented access controls, and evidence the assessor can verify independently of your word.
Logical vs Physical Separation: When Each Approach Works
The DoD scoping guidance identifies two separation techniques that establish a defensible enclave boundary. Most deployments require both — physical separation addresses the building, logical separation addresses the network.
Hard Barriers
Physical separation uses architectural and access controls to prevent unauthorized personnel from physically reaching CUI systems or observing CUI on screens.
A cipher lock on a server room door is not sufficient on its own if the door has a window or the room is visible from a common hallway. Physical separation addresses observation as well as entry.
Technical Boundaries
Logical separation uses network architecture and access controls to prevent unauthorized systems from reaching CUI systems digitally — even if both sit in the same building.
A VLAN is not effective without corresponding ACLs. Logical separation requires both the network boundary and the enforced rules preventing traffic across it.
In most deployments, physical and logical separation must work together. If your CUI server sits in the same open office as your corporate workstations, logical separation (VLAN) controls the digital boundary but does nothing to prevent an unauthorized employee from walking over and reading the screen. The combination — locked room plus VLAN — closes both attack surfaces and gives the assessor two independent verification points rather than one.
How Enclaves Change Asset Categories
Building an enclave does not just reduce your compliance workload — it fundamentally restructures how every piece of technology in your organization is categorized, assessed, and documented. The DoD CIO scoping guidance defines five asset categories, and your enclave strategy determines where each asset lands.
The Confidence Problem: What Makes an Enclave Defensible to Assessors
An assessor reviewing your asset inventory who sees 2,000 corporate devices classified as CRMAs faces a fundamental verification question: how do they know CUI hasn't leaked onto any of those machines? The answer — or the absence of one — is what drives sampling volume, audit duration, and cost.
This is the confidence problem. An assessor's willingness to accept your CRMA classification without extensive sampling is directly proportional to the technical evidence you can provide that the separation is real, enforced, and current.
The tools that raise assessor confidence most effectively are those that create verifiable, technical evidence the assessor can review independently. A VLAN configuration file, a firewall ACL ruleset, a data classification policy enforced by Microsoft Purview, or a GCC High tenant separation — these are evidence. A policy document stating CUI shall not leave the enclave is not.
The Documentation Package That Makes an Enclave Defensible
Before an assessor evaluates a single control, they will review your documentation package to understand your claimed boundary. An enclave without documentation is just an assertion. The following four documents, taken together, give an assessor a complete and independently verifiable picture of your scope.
Common Enclave Mistakes That Expand Scope
Most scope expansion happens not from deliberate misrepresentation but from implementation gaps that allow CUI to reach systems outside the intended boundary — silently, before anyone notices. These four patterns are the most common.
The most common enclave failure: every device on the same subnet, with no VLAN, no ACL, and no firewall rule preventing corporate PCs from reaching the CUI server. The CUI server may have access controls — but if a corporate PC can ping it, the assessor has no basis for accepting the CRMA classification without extensive sampling.
CUI that arrives via standard commercial email — Microsoft 365 Business, Google Workspace, or similar — has already left the enclave before it reaches the recipient. The moment CUI touches a commercial tenant without FedRAMP authorization, the entire tenant is potentially in scope. This is one of the most common and most expensive unintentional scope expansions in the supply chain.
Security tools that reach into the enclave — vulnerability scanners, EDR agents, SIEM collectors — are Security Protection Assets and fully in scope. Organizations routinely deploy these tools without cataloging them as SPAs, then face unexpected scope expansion when an assessor identifies them during the network diagram review.
An asset inventory, network diagram, or data flow diagram that reflects the environment as it existed 18 months ago — before a cloud migration, a network refresh, or a new contract — is not just unhelpful. It actively undermines assessor confidence. When the documentation doesn't match reality, assessors expand their sampling to compensate for the gap they cannot explain.
The Bottom Line
An enclave is not a compliance shortcut — it is an architectural decision that determines the cost and duration of every CMMC assessment your organization will undergo. A well-constructed, well-documented enclave gives the assessor verifiable evidence that your boundary is real, enforced, and current. That evidence replaces sampling. Sampling replaced by evidence is time — and time, in a C3PAO engagement, is money.
Build the separation before the contracts that require it begin. Document it precisely. Keep the documentation current. And understand that the assessor's job is not to trust your classification decisions — it is to verify them. Give them the tools to do that quickly.
The question an assessor is always asking at the boundary is: "How do I know CUI isn't on those systems?" Your VLAN diagram, your ACL ruleset, your data flow, and your asset inventory are the answer. Without them, the question stays open — and open questions get resolved through sampling.