CMMC Enclave: What It Is, When You Need One, What It Costs

By Shaheer Malik · Updated Oct 28, 2026

A CMMC enclave is a separate environment (cloud tenant, virtual desktop or segmented network) where all your CUI lives, so only that environment and the people who use it are in your Level 2 assessment scope. It is a scoping strategy, not a requirement: the rule lets you leave out assets that cannot process, store or transmit CUI and are separated from CUI assets.^[1]

Why enclaves work

Out-of-Scope Assets are those that can’t process, store or transmit CUI and don’t protect CUI assets, and you must be ready to justify why.^[1] An endpoint running only a virtual desktop client that can’t process, store or transmit CUI beyond keyboard, video and mouse is out of scope.^[1] An enclave uses exactly those rules to keep everything else outside.

When an enclave makes sense

• Only a few people or one program handle CUI.
• Your main IT can’t easily meet all 110 requirements, or runs on a cloud not authorized for CUI.
• You handle export-controlled data and need tight control over who can access it (see CMMC and ITAR).

What has to be true

• The enclave meets all 110 Level 2 requirements; a cloud enclave holding CUI must meet FedRAMP Moderate or equivalent.^[1][2]
• The security tools that protect it are Security Protection Assets and are in scope.^[1]
• The SSP, asset inventory and network diagram show the boundary.^[1]

How expensive is an enclave for one person at Level 1?

Usually you don’t need one. Level 1 covers FCI only, has 15 requirements and no FedRAMP requirement in the rule, so a one-person company can typically meet it in the tools it already uses.^[1] DoD estimates the Level 1 self-assessment and affirmation at about $5,977 a year for a small business, assuming the requirements are in place.^[3] Enclaves are a Level 2 tool for CUI.

What it costs at Level 2

Enclave services are priced per user and by the components included (licences, virtual desktops, monitoring, documentation support), so compare quotes on the same scope. Ask each provider for its customer responsibility matrix, which shows which requirements it covers and which stay with you.^[1]

Compare CMMC consultants (RPOs) and C3PAOs by state, or describe your project once and we send it to up to 3 matching firms.

FAQ

What is a CMMC enclave?

A separate environment where all CUI is kept, so only that environment and its users are in the Level 2 assessment scope. Other assets stay out of scope if they can’t process, store or transmit CUI.

Do I need an enclave for CMMC?

No. It is optional. It helps when only part of the company handles CUI or the main environment can’t meet the 110 requirements.

How expensive is a CMMC enclave for one person at Level 1?

Level 1 usually doesn’t need an enclave: it covers FCI only and has no FedRAMP requirement in the rule. DoD estimates the Level 1 self-assessment at about $5,977 a year for a small business.

Sources

1. 32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
2. DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (checked Oct 28, 2026)
3. Cybersecurity Maturity Model Certification (CMMC) Program, 32 CFR part 170, 89 FR 83092 (Oct 15, 2024) (checked Oct 16, 2026)

More on cloud, tools and enclaves

• Does CMMC Require GCC High? Microsoft 365 Options Compared
• Google Workspace and CMMC: Level 1, Level 2 and Editions
• Is Box, Dropbox, HubSpot or ChatGPT CMMC Compliant?
• CMMC Compliance Software: What It Can and Can’t Do