CMMC enclave or whole company? How to choose your CUI scope

Your firm won a DoD project, the contract carries DFARS 252.204-7012, and now someone has to decide how much of the office the CMMC assessment will cover. A CMMC enclave keeps CUI inside a small, separate environment so the rest of the firm stays out of scope. A whole-company scope brings every workstation, account and design tool up to NIST SP 800-171. This guide explains how the rules draw the boundary and how to tell which option fits the way your project teams work.

What does scope mean for NIST SP 800-171 and CMMC?

Scope is the set of systems, people and facilities an assessment covers, and it decides how much of your firm has to meet all 110 NIST SP 800-171 requirements. 32 CFR 170.19(a) defines the CMMC Assessment Scope as "the set of all assets in the OSA's environment that will be assessed against CMMC security requirements" and requires you to specify it before any assessment, including a self-assessment.

The rule then sorts assets into five categories. CUI Assets process, store or transmit CUI and are assessed against every Level 2 requirement. Security Protection Assets, such as your firewall, identity provider or logging tool, are assessed against the requirements relevant to the security they provide. Contractor Risk Managed Assets can handle CUI but are not intended to, and must be documented in your system security plan. Only Out-of-Scope Assets, which cannot process, store or transmit CUI and provide no protection to CUI Assets, drop out entirely. The DoD's Level 2 Scoping Guide says you must be prepared to justify why an out-of-scope asset cannot handle CUI.

The same idea sits underneath DFARS 252.204-7012. The clause applies NIST SP 800-171 to any "covered contractor information system", meaning a contractor system that processes, stores or transmits covered defense information. CMMC scoping is the formal method for proving where that boundary is.

What is a CMMC enclave?

A CMMC enclave, often called a CUI enclave, is a separate environment, with its own accounts, devices or cloud tenant, where all CUI work happens, so the rest of the company stays out of scope. The word "enclave" does not appear in the CMMC rule. The mechanism does: Table 3 in 32 CFR 170.19(c)(1) treats assets that are "physically or logically separated from CUI assets" as out of scope, and the DoD Scoping Guide lists firewalls, routers, VPNs and VLANs as ways to achieve logical separation.

In practice an AEC enclave is often a government cloud tenant used only by the people who touch defense project files, sometimes reached through virtual desktops. A laptop that connects to a VDI session passing only keyboard, video and mouse is an Out-of-Scope Asset under the same table. We covered that pattern in how zero trust and VDI can shrink CMMC scope.

When does a whole-company scope make more sense than an enclave?

A whole-company scope, sometimes called an enterprise scope, fits when CUI moves through the same email, file shares and design tools everyone uses, because separating it would cost more than protecting everything. If most of your project teams work on DoD facilities, an enclave becomes a second company to run: duplicate accounts, duplicate licensing and staff switching between two environments to do one job.

Signs that a whole-company scope is the more honest choice:

• Defense work runs across most studios, offices or project teams, and staff rotate between federal and commercial projects.
• CUI drawings and specifications travel through the same Revit, AutoCAD, Bluebeam or project management workflows as everything else.
• Consultants and subcontractors exchange CUI with you through shared folders or email you cannot easily wall off.
• Your controls are already close to 800-171 across the firm, so the extra cost of covering everyone is small.

A whole-company scope also removes the hardest audit question: how you know CUI never leaked outside the boundary. Requirement 3.1.3 in NIST SP 800-171 Rev. 2 asks you to control the flow of CUI under approved authorizations. That is easier to show when there is only one environment to show.

When does a CMMC enclave make more sense?

An enclave fits when CUI touches a small, stable group of people and a short list of systems, and the rest of the firm never needs it. Picture a 60-person engineering firm with one federal studio of eight people. Securing those eight users, their devices and one tenant to Level 2 is a contained project. Bringing every workstation, plotter and site tablet to the same standard is not.

An enclave tends to work when:

• CUI arrives on identifiable contracts, and the contracting officer has told you which information is covered.
• The people who handle it can do their CUI work inside one environment without exporting files to everyday tools.
• Your commercial work depends on tools or cloud services you would rather not move into a government-grade tenant.
• You can enforce the boundary with technology, such as blocking downloads and copy and paste out of the enclave, rather than relying on staff memory.

The test is behavior. If people regularly email a CUI drawing to a colleague outside the enclave, every system that touched it is a CUI Asset again, and your scope is wrong.

What stays in scope even with an enclave?

More than most firms expect. Security Protection Assets that protect the enclave stay in scope, which often includes your identity provider, endpoint protection, logging and the managed service provider tools used to administer it. Cloud services matter most. Under DFARS 252.204-7012(b)(2)(ii)(D), any cloud service that stores, processes or transmits covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline. The DoD's December 2023 equivalency memo says equivalency means 100 percent of the Moderate baseline controls, validated by a FedRAMP-recognized third-party assessment organization. That applies to any cloud tenant holding CUI, whichever scope you choose.

Two more items catch firms off guard. First, an enclave does nothing for Federal Contract Information. The Scoping Guide notes that if FCI and CUI do not share an environment, the Level 1 and Level 2 assessments are conducted independently, so the rest of the company may still owe a Level 1 self-assessment. Second, people and facilities are part of the picture. The staff who work in the enclave, and the office where they work, still need the training, physical protection and personnel security the requirements describe.

Does the CMMC Phase 2 suspension change the decision?

No. The Department of War suspended the transition to CMMC Phase 2 on July 13, 2026, so third-party (C3PAO) certification is not being added to new contracts while a CMMC Reform Task Force reviews the program. Phase 1 requirements remain in place, including Level 1 and Level 2 self-assessments with annual affirmations, and contractors are still bound by DFARS 252.204-7012, including its 72-hour cyber incident reporting. As of early November 2026, the Department has not announced when, or whether, Phase 2 will resume.

A Level 2 self-assessment still requires a defined scope, and your score in SPRS is only as accurate as that scope. Choosing well now also means less rework if certification returns. Our summary of what still applies during the suspension covers the rest.

What should an AEC firm do this quarter?

Start with the data, then pick the scope that matches it.

• List every active contract with DFARS 252.204-7012, and confirm with each contracting officer what information is CUI.
• Trace how that information arrives, who opens it, which applications touch it and where copies end up, including consultants and subcontractors.
• Count the people and systems involved. If the count is small and stable, price an enclave. If CUI is everywhere, price a whole-company uplift.
• Confirm that every cloud service in the CUI path meets FedRAMP Moderate or documented equivalency.
• Write the chosen boundary, asset categories and data flows into your system security plan, and build a network diagram that matches it.
• Check the CMMC level your prime requires of you, since flow down requirements can set it before your own contracts do.

Revisit the decision when your mix of federal and commercial work changes. A scope that fit three DoD projects may not fit ten.

How does s90 help?

s90 helps AEC firms map where CUI actually flows, compare the cost of an enclave against a whole-company scope, and then build and run the environment that fits. We document asset categories and boundaries in the system security plan, keep evidence current, and commit to producing assessment evidence within 24 hours of a request. If you are weighing an enclave for defense work, we are happy to walk through your data flows with you.