Editor's note: CMMC has been updated several times since this post was first published, most recently when the Department of War suspended Phase 2 in July 2026. We have also rebranded: Intech Hawaii is now Intech Pacific. We updated this post in October 2026 to reflect the current state of the program. For the latest information, see our CMMC Overview and our CMMC Calendar.
Last updated: October 2026
A CMMC enclave is a separate, tightly controlled environment where all of a company's Controlled Unclassified Information (CUI) is stored, processed, and transmitted. Only the enclave, the people who use it, and the systems that protect it have to meet the 110 requirements of NIST SP 800-171 for CMMC Level 2. The rest of the business stays outside the assessment boundary. For many contractors that handle CUI on only a few programs, a CMMC enclave in Hawaii is the most practical way to keep the cost and disruption of compliance in proportion to the work. This post explains what an enclave is, how it reduces scope, and what it does not do.
What Is a CMMC Enclave?
A CMMC enclave is a defined boundary around the users, devices, applications, and data that touch CUI. Everything inside that boundary is in scope for assessment. Everything outside it is not, as long as you can prove the boundary is enforced.
An enclave can be built in a few ways:
- Cloud enclave: a dedicated tenant in a FedRAMP authorized service, often paired with virtual desktops so CUI never lands on a local laptop. Microsoft 365 can be used here: commercial or GCC, configured and documented correctly, can support Level 2 for CUI that is not export-controlled, and GCC High is the recommended choice for ITAR or NOFORN data.
- On-premises enclave: a segmented network with its own firewall rules, servers, and managed workstations.
- Hybrid enclave: cloud services for email and files, plus a few on-premises systems such as CAD workstations or test equipment.
The model is the same in each case. Draw the line around CUI, keep CUI inside the line, and document both.
Which CMMC Level Applies to CUI?
CUI falls under CMMC Level 2, not Level 3. Older articles, including the original version of this post, said companies handling CUI needed "Level 3 or higher." That reflected CMMC 1.0, which had five levels and was replaced by CMMC 2.0 in November 2021.
Under the current program (32 CFR Part 170, effective December 16, 2024), the levels are:
- Level 1: 15 requirements protecting Federal Contract Information (FCI), from FAR 52.204-21. Annual self-assessment and affirmation in SPRS.
- Level 2: the 110 requirements of NIST SP 800-171 Revision 2, protecting CUI. Self-assessment or C3PAO assessment as the contract specifies, every three years, with annual affirmations.
- Level 3: a Level 2 C3PAO certification plus 24 requirements from NIST SP 800-172, assessed by the government's DIBCAC. This applies to a small number of high-priority programs.
There is no Level 4 or Level 5 anymore. If you are handling CUI, the enclave you build is a Level 2 enclave.
How a CMMC Enclave in Hawaii Reduces Assessment Scope
An enclave reduces scope by shrinking the number of assets that fall into the in-scope categories. The CMMC scoping guidance sorts assets into groups:
- CUI assets: systems that store, process, or transmit CUI.
- Security Protection Assets: systems that protect the enclave, such as firewalls, identity providers, logging tools, and your managed service provider's tools.
- Contractor Risk Managed Assets: systems that can, but are not intended to, touch CUI, and are controlled by policy and technical measures.
- Specialized Assets: government property, operational technology, IoT, restricted information systems, and test equipment.
- Out-of-scope assets: systems that cannot process, store, or transmit CUI and are separated from the ones that can.
Without an enclave, a company that emails CUI through its normal mailbox has made that mailbox, every laptop that opens it, and every server those laptops connect to part of the CUI environment. With an enclave, most of the company's systems can move to out of scope.
The boundary has to be real. The DoW CIO's CMMC FAQ, updated in January 2026, answers "No" to whether encryption alone can create logical separation. Logical separation comes from controls that prevent data transfer, such as firewalls, routing rules, and segmentation. The same guidance confirms that encrypted CUI is still CUI. An encrypted folder on a shared network is not an enclave.
Security Protection Assets also stay in scope. Your firewall, your identity platform, and your logging system protect the enclave, so they are assessed against the relevant requirements.
What Belongs Inside a CMMC Enclave
A working enclave usually includes:
- A defined list of users who need CUI access, with separate accounts or groups and MFA on every login.
- Managed, hardened endpoints, or virtual desktops that keep CUI off local devices.
- A cloud service for CUI that meets FedRAMP Moderate or equivalent, as DFARS 252.204-7012 requires.
- CUI repositories with access controls, encryption at rest and in transit, and protected backups.
- Centralized logging and monitoring for every system in the boundary.
- A network diagram and data flow diagram that match what the assessor will see.
Designing that boundary around island lead times and limited local vendors is a big part of our CMMC Hawaii work.
Permanent and Temporary Enclaves
Most enclaves are permanent. They support ongoing programs and stay in place across contracts.
Some companies build an enclave for a single contract and retire it when the work ends. That can work, but retirement is its own project. CUI must be returned, retained per the contract, or sanitized, and media sanitization (NIST SP 800-171 requirement 3.8.3) needs evidence. A certification also covers a specific assessed scope, so tearing down and rebuilding environments has consequences for your CMMC status in SPRS.
What an Enclave Does Not Do
An enclave reduces the number of systems you have to secure. It does not reduce the number of requirements. All 110 still apply inside the boundary.
It also does not remove the paperwork. Policies, the System Security Plan, training, incident response, and personnel screening apply to the people and processes that touch the enclave. I have been involved in more than 100 CMMC gap assessments, and documentation is the most common gap every time. No company we have gap-assessed had the right documentation, including companies that paid a third party to write it. An enclave makes the documentation smaller. It does not write it for you.
Does the 2026 CMMC Pause Change the Case for an Enclave?
No. In July 2026, the Department of War suspended Phase 2 of CMMC, which would have required Level 2 C3PAO assessments in applicable contracts starting November 10, 2026. Class Deviation 2026-O0025 Revision 3 now lets contracting officers accept a self-assessment in place of a C3PAO certification.
The underlying obligation did not change. DFARS 252.204-7012 has required all 110 NIST SP 800-171 requirements since December 31, 2017. Your SPRS score and annual affirmation still need to be accurate, DIBCAC can still assess you, primes can still require certification, and the False Claims Act still applies. A well-scoped enclave makes every one of those easier to defend. For more on what the pause means, see our CMMC Calendar.
Talk to Intech Pacific About a CMMC Enclave
Intech Pacific is the only CMMC Level 2 certified MSP in Hawaii and Guam, and we design and manage enclaves for contractors across the Pacific.
To see how we help contractors in Hawaii and Guam, from a free readiness session to fully managed compliance, visit our CMMC Solutions page.
