Instead of hardening your entire company to meet CMMC, you carve Controlled Unclassified Information (CUI) into a small, segmented enclave — a handful of workstations, one encrypted storage location, and a controlled connection. Because CMMC only assesses the systems that actually touch CUI, shrinking that boundary removes most of your network from scope and typically cuts the total cost of getting certified by 40 to 60 percent.
Most small contractors get their first CMMC quote and nearly walk away from federal work entirely. The number is brutal because the assumption underneath it is brutal: that every laptop, every server, every user in the company has to be brought up to NIST 800-171 and then audited. It doesn't. That assumption is the single most expensive mistake a small shop can make.
Here's the thing an assessor will tell you but a consultant selling you a full-network project won't lead with: CMMC scope is defined by where CUI lives. If controlled data never touches a machine, that machine is out of scope. Turn that one sentence into a design principle and you stop paying to secure a marketing intern's laptop the same way you secure a drawing package the government cares about.
I've built these enclaves for shops running everything from 6 people to 60. The pattern holds every time. Below is the method, named plainly so your team can actually use it, plus the hardware that builds the boundary — and an honest line about what that hardware does and doesn't do for you.
CMMC Level 2 is built on the 110 controls in NIST SP 800-171. Every one of those controls applies to every asset inside your assessment boundary. So the cost of compliance isn't really a function of how good your security is — it's a function of how many things you've dragged into scope.
Put 40 endpoints in scope and you're licensing endpoint tools for 40 seats, writing an SSP that describes 40 machines, training 40 people, and paying a C3PAO to assess a 40-asset environment. Put 6 endpoints in scope and every one of those line items shrinks with it. The security bar per machine is identical. The number of machines is what you control.
This is why the enclave beats the alternative so decisively. You are not lowering the standard. You are lowering the count.
Four moves, in order. Do them in this sequence and the work stays small. Skip step one and you'll spend money hardening things that never needed it.
The enclave is only real if something enforces it. That means a firewall that can segment traffic, block the enclave from the rest of your network, and produce logs you can hand an assessor. Your ISP's combo box can't do any of that. Here's what I actually deploy, matched to the size of the shop.
For a 2–10 person enclave, this is the fastest way to a real segmented boundary. VLAN segmentation to wall the CUI machines off from the rest of the office, built-in intrusion detection, and an exportable activity log that gives you the SC (System & Communications Protection) and AU (Audit & Accountability) evidence an assessor asks for — with no monthly fee. It's the single highest-leverage box for most small shops standing up their first enclave.
When you want zero black boxes in your boundary — full control over firewall rules, VLAN tagging, and logging — this fanless appliance runs open-source pfSense or OPNsense. It's the pick for the shop with someone technical who wants to define the enclave rules explicitly and keep verbose logs for the SC and AU control families. More setup than the Firewalla, and far more control.
If your enclave is bigger — 10 to 50 seats, multiple VLANs, its own switching — the UDM Pro gives you firewall, network controller, and logging in one rack unit with a management console your team can actually run. This is the platform larger contractors standardize on as they add seats and need the segmentation documented cleanly across a growing environment.
I'll be straight with you, because getting this wrong on your SSP is how you fail an assessment while thinking you passed.
Map each tool to the control it actually satisfies and your SSP tells the truth — which is exactly what an assessor is checking for. A firewall that segments and logs is boundary protection. It is not encryption of CUI. Keep those two ideas in separate boxes on your diagram and in separate control write-ups, and you'll never trip over this.
Take a 40-person shop where 6 people actually touch CUI. The full-network approach puts all 40 endpoints in scope: 40 seats of tooling, an SSP describing 40 machines, training and evidence for 40 users, and a C3PAO assessing a 40-asset environment. The enclave approach puts 6 endpoints in scope behind one firewall.
The controls are identical. The count is roughly one-sixth. Tooling licenses, internal labor hours, and — critically — the C3PAO's assessment time all scale with that count. That's where the 40 to 60 percent comes from. It isn't a discount. It's the cost of assessing six machines instead of forty.
Want the full dollar breakdown behind those consultant quotes? Read CMMC Compliance Cost for Small Business (2026) — it lays out every line item and shows where the enclave method cuts each one. And before you build anything, get a baseline: the free SPRS score estimator tells you where you stand against the 110 controls in about two minutes.
Building the boundary is the easy half. The half that passes the assessment is the paperwork: a System Security Plan written to your enclave, the 20 required policies, a POA&M template, and the per-control SPRS scorer. The CMMC Level 2 DIY Compliance Kit is all of it, editable, built for a small shop doing this itself.
A CUI enclave is a small, segmented part of your network — often a few workstations, one file location, and a controlled connection — where all Controlled Unclassified Information is stored, processed, and transmitted. Because CMMC only assesses systems that touch CUI, isolating it into an enclave shrinks the assessment boundary and cuts the number of controls you have to implement, document, and prove.
Yes. Cost scales with the size of your assessment boundary. Every endpoint, server, and user inside scope must meet all 110 NIST 800-171 controls and be assessed. Cutting a 40-seat company down to a 6-seat enclave removes dozens of assets from scope, which typically reduces tooling, licensing, internal labor, and C3PAO assessment time by 40 to 60 percent.
They help you satisfy segmentation, boundary protection, and logging controls, but they do not make you compliant on their own and they are not FIPS 140-2 or 140-3 validated cryptographic modules. Use them to build and enforce the enclave boundary. Use FIPS-validated encryption for protecting CUI itself, and pair the hardware with documented policies, an SSP, and the assessment.
Not right now. DoD suspended Phase 2 on July 13, 2026, so no contract currently imposes the third-party certification requirement. If it returns after the review, a certified third-party assessment organization (C3PAO) would assess you, and the enclave method would not replace that audit — it makes the audit dramatically smaller, faster, and cheaper because there are fewer assets and users in scope. The same scoping also shrinks the self-assessment you owe today.
No date is in force right now. Phase 2 — which would have made Level 2 C3PAO third-party certification a required condition of award — had been set to begin November 10, 2026, but DoD suspended it on July 13, 2026 pending a 60-day review. Phase 1 self-assessment and affirmation requirements are unchanged and still appear in contracts today, alongside NIST SP 800-171, your SPRS score, and DFARS 252.204-7012. The certification is suspended; the standard is not.
As small as the work honestly requires. Many small contractors run an enclave of two to eight users who actually touch CUI, backed by one segmented VLAN or a dedicated firewall, one encrypted file location, and phishing-resistant MFA. The rule is simple: if a device or person never touches CUI, keep them out of the enclave and out of scope.