02 / Build / CMMC readiness / CUI scoping and enclave design
CUI Scoping andEnclave Design
The cheapest way to comply is to reduce what is in scope.
Scoping decides which people, systems and vendors an assessor will examine, so we do it first.
What you get
- A map of where CUI enters, lives and leaves your business
- A list of assets and vendors that fall in scope
- Secure enclave design and build, or integration of FedRAMP-authorized cloud solutions, to align your infrastructure with CMMC requirements
- A clear view of how scope changes cost and timeline
How it works
We interview your team, trace the data, and give you a scope decision you can defend. Next steps are covered on our CMMC page.
The five CMMC asset categories
CMMC scoping sorts every asset into one of five categories. Where an asset lands decides how much work it needs.
- CUI Assets: assets that process, store or transmit CUI
- Security Protection Assets: assets that provide security functions to the CUI environment, such as firewalls, identity and logging
- Contractor Risk Managed Assets: assets that can, but are not intended to, handle CUI, managed under your own risk-based policies
- Specialized Assets: IoT and industrial equipment, government-furnished equipment, restricted systems and test equipment
- Out-of-Scope Assets: assets that cannot handle CUI because they are properly separated from it
Common scoping mistakes
- Leaving CUI to spread across the general network instead of containing it
- Assuming a cloud service is covered without confirming who is responsible for each control
- Forgetting that the tools and service providers that protect the CUI environment are in scope too
- Writing documentation that does not match how the environment actually runs
We run our own enclave
Logos Systems operates its own CUI enclave, so we build and run what we advise. For client enclaves, our shared responsibility matrix documents which controls we cover and which stay with you.
Bring us the complicated part.
Talk with a credentialed CISO and an accountable team. Email [email protected] or call 877-855-CMMC.