NIST SP 800-171 Since Conception CISSP® INCOSE ESEP® PMP® CYBER AB RP

Practical CMMC Level 2 Enclave-in-a-Box

Built for suppliers, estimators, engineers, and vendors (1 to 15 users) bidding Department of War (DoW) work. The wisest way to tackle CMMC Level 2 is de-scoping your boundary from Day 1 to a clean, digital-only enclave. We knock out the mandatory Day-1 technical pass/fail controls at a price that makes sense for your wallet, without exorbitant GCC High migrations or laggy VDI screens.

San Diego Local Priority Rollout • Stop Putting It Off

Waited Out the CMMC Noise? Good. Now Let's Get You Working and Move On. For years, small businesses were pitched top-dollar, overcomplicated overhauls that caused teams to freeze up and do nothing. We are rolling out our turnkey enclave to local San Diego businesses first so we can deliver a working setup in person and get compliance off your plate for good.

✓ Invisible Security That Stays Out of Your Way: One bad STIG setting can brick a PC. After decades of hardening systems inside DoW environments, we bake security in quietly so your team can just do their jobs.
✓ Faster Than VDI Across Any Network: Work on fast local computers while our micro-tunnel de-scopes wired, wireless, and 5G networks alike.
✓ No-BS Documentation & Real Facility Checks: We write SSPs and policies mapped to your actual setup (not AI-generated fiction) and walk your physical doors, server racks, and telecom closets in person.
✓ Built From Our Own CMMC Level 2 SPRS Playbook: These are the exact foundational practices and SPRS package standards we rely on as the starting point for our own security posture.
Unwrap the Enclave Today & Book 15-Min Scoping → Text or Call: (619) 304-7300
Powered by Stick-to-itiveness (and Coffee): Real-world IT hits roadblocks. We do not sell fake overnight promises or doomsday fear. We run a lean, focused operation and partner with your team until the job is done right.

De-Scoped Level 2 Stack

FIPS 140-2 / 140-3
  • 1. FIPS 140-2/140-3 Validated Encrypted CUI Enclave End-to-end encrypted boundary for CUI emails and project files right alongside your current M365 or Google Workspace.
  • 2. Always-On Zero-Trust Endpoint Micro-Tunnel & Secure DNS Gateway De-scopes wired, wireless, and 5G networks alike right from the device network adapter.
  • 3. 24/7 Cloud Identity & Enclave SIEM Log-Aggregation Engine Centralizes security event logs across enclave machines and cloud identity without disrupting your current setup.
  • 4. Tuned Native OS Defenses or Next-Gen Autonomous EDR Works with properly configured Windows Defender and native macOS/iOS/Android protections, or adds Autonomous EDR where needed.
  • 5. Field-Tested Local STIG/NIST 800-171 OS Hardening & Compliant Admin Care Usable local OS lockdown, real-world SSP documentation, and hands-on on-site engineering partnership.

What Actually Counts as CUI & Which Clauses to Watch

Skip the government jargon. If you see these files or DFARS clauses in your bid package, you need a Level 2 enclave.

Plain-English Definition • Level 2 Sensitive Data (CUI)

What is Controlled Unclassified Information (CUI) in Real Life?

In construction, engineering, and supply contracts, CUI is simply the sensitive project files the military does not want leaked: MEP blueprints, military base site security plans, CAD drawings, technical specifications, and sensitive parts lists. Protecting these files requires addressing the 110 NIST SP 800-171 security controls and completing an annual self-attestation or third-party assessment.

Clause 01 • The Foundation

DFARS 252.204-7012

Mandates safeguarding CUI under the 110 NIST SP 800-171 security controls and requires 72-hour cyber incident reporting to the DoW.

Clause 02 • Your SPRS Score

DFARS 252.204-7019 & 7020

Requires an active Assessment Score posted in SPRS (Supplier Performance Risk System) before contract award and grants the DoW audit access to verify your score.

Clause 03 • Award & UID

DFARS 252.204-7021 & 7025

Enforces your required CMMC certification level at contract award and requires including your CMMC Unique Identifier (UID) directly inside your bid proposal.

How Boundary De-Scoping Works

No single tool checks all 110 boxes by itself. We shrink your audit boundary to a digital-only enclave, lock down the technical rules, and inspect your physical setup in person.

Pillar 01 • Digital Baseline

No-Print, No-USB, No-Cloud-Leak

CUI stays strictly inside your FIPS 140-2/140-3 Encrypted CUI Enclave. Turning off USB thumb drives, local CUI printing, and unapproved cloud uploads eliminates dozens of physical audit headaches from Day 1.

Pillar 02 • Zero Bricked PCs

Usable STIG Hardening That Stays Invisible

Anyone can download a public STIG list, but one wrong setting will brick a PC. Our decades of DoW hardening experience let us lock down Windows, Mac, iOS, and Android so quietly your users barely notice it is there.

Pillar 03 • Log Aggregation

Non-Disruptive SIEM & Identity Integration

Keep M365 or Google Workspace as is. If your business already has Level 1 locked down, we leave your working setup alone and add our 24/7 Cloud Identity & Enclave SIEM Log-Aggregation Engine for audit visibility.

Pillar 04 • Network De-Scope

De-Scopes Wired, Wireless & 5G Alike

Our Always-On Zero-Trust Endpoint Micro-Tunnel & Secure DNS Gateway encrypts traffic right at the computer network card, de-scoping office Ethernet, Wi-Fi, and 5G field connections alike.

Pillar 05 • Boots on the Ground

Compliant Admin & Real Facility Checks

You log in as a Standard User while we hold Privileged Admin (AC.L2-3.1.5). We also walk your office, front door, server rack, and telecom closet in person so your physical security and SSP match reality.

Supported Enclave Computers & Mobile Terminals

When configured with sound security practices, built-in OS protections on Windows, Mac, iOS, and Android do a solid job. Here is how we lock each platform down without hurting usability.

Windows 11 Pro & Enterprise (Desktops & Laptops)

Hardware TPM 2.0 MFA

Uses built-in TPM 2.0 multi-factor authentication (Windows Hello fingerprint, facial recognition, or cryptographic PIN) with full-disk encryption and tuned Windows Defender or Autonomous EDR policies. (Windows Home and EOL Windows 10 are excluded).

Why This Beats VDI & Full Overhauls

Built around daily operations and real-world engineering so your team can get work done.

Requirement Materik De-Scoped Enclave GCC High & Cloud VDI Overhauls Paperwork-Only Consultants
Budget Impact Digestible & Custom-Scoped Exorbitant migration & VDI hosting costs High fees for unconfigured binder templates
User Experience ✓ Fast Local Speed & Zero Bricked PCs ✗ Clunky VDI lag on large PDF drawings ✗ Raw STIG scripts that break user apps
SSP & Policies ✓ Written to Actuals (Holds Up to Audit) ✗ Handed off to junior analysts ✗ AI-hallucinated fiction & blank templates
Network Scope ✓ De-Scopes Wired, Wireless & 5G Alike ✗ Expensive office firewall replacements ✗ Pulls your entire office LAN into scope
Ongoing Admin Care ✓ Compliant Admin & On-Site Facility Reality Checks ✗ Steep annual enterprise management fees ✗ Never sets foot in your server room

Start with the Digital-Only Baseline

De-scoping to a digital-only boundary is the fastest, wisest starting point for businesses that review CUI digitally.

✓ Ideal Fit (Digital CUI Workflows)

Suppliers, Estimators, Engineers & Vendors

  • • Construction Estimators, General B & MEP/Low-Voltage Subs: Bidding NAVFAC, USACE, or military base work and reviewing CUI MEP blueprints and site plans on laptops or iPads.
  • • Suppliers, Vendors & Value-Added Resellers: Handling digital CUI purchase orders, parts lists, and RFPs.
  • • Systems Engineering, Architecture & R&D Firms: Producing digital CAD drawings, specifications, and technical reports.
✗ Not A Fit for This Baseline Package

CNC Machine Shops & Paper Plotter Floors

If your shop floor must copy CUI G-code or CAD files onto physical USB thumb drives to walk out to CNC mills, or must print D-size paper CUI blueprints on plotters, this baseline package will not fit that workflow.

This package enforces a strict No-Print, No-USB, Digital-Only boundary so you can pass your Level 2 technical requirements without facility-wide media sanitization overhead.

Rollout Milestones & Hardware Rules

Guided by CISSP®, INCOSE ESEP®, PMP®, and Cyber AB RP professionals who act as a real partner in your corner.

Milestone 01

Boundary & SIEM

De-scope your CUI boundary, connect our 24/7 Cloud Identity & Enclave SIEM Engine, and deploy the Zero-Trust Micro-Tunnel across wired, wireless, and 5G networks.

Milestone 02

Enclave & OS Lock

Encrypted CUI Enclave setup, field-tested STIG/NIST 800-171 OS hardening, No-Print/No-USB lock, and tuned native OS security or Autonomous EDR.

Milestone 03

No-BS SSP & SPRS

Walk your physical doors and telecom closets, write a no-BS SSP and policy set mapped to actuals, post your SPRS score, and prep your CMMC UID.

Ongoing Partnership

Compliant Admin Care

Continuous 24/7 SIEM log watch, Least-Privilege Admin oversight, and hands-on on-site engineering checks to keep your enclave audit-ready.

Mandatory DoW Hardware Eligibility & Turnkey Procurement

1. Corporate-Owned Hardware Only (No BYOD / Turnkey Hardware Available) ▼

Enclave devices must be 100% company-owned (AC.L2-3.1.5, CM.L2-3.4.2, MP.L2-3.8.7). Personal BYOD computers and phones are excluded. Need dedicated enclave hardware? As an authorized California Technology Reseller and certified DVBE, we source, pre-harden, and deliver dedicated Windows 11 Pro laptops, Macs, iPads, or Samsung Knox/Pixel devices ready for CUI.

2. No End-of-Life (EOL) Operating Systems or Hardware ▼

Under NIST SP 800-171 Flaw Remediation (SI.L2-3.14.1), unsupported systems trigger an automatic audit failure. Enclave devices must run actively patched Windows 11 Pro/Enterprise (with TPM 2.0) or current vendor-supported macOS, iOS/iPadOS, or Android OS. Legacy Windows 10 and Windows Home are excluded.

3. NDAA Section 889 Foreign-Adversary Hardware Ban ▼

Per NDAA Section 889 (FAR 52.204-25), we do not onboard hardware from prohibited foreign-adversary manufacturers (including Huawei, ZTE, Hikvision, Dahua, Hytera, Xiaomi, OnePlus, or TCL). Android devices are strictly limited to FIPS-validated Samsung Galaxy Knox and Google Pixel models.

Straight Answers

Does this cover all 110 NIST 800-171 controls?

We are completely upfront: no software box covers all 110 controls by itself because physical building locks, telecom closets, and company policies are part of the rule. Our enclave covers the mandatory Day-1 technical pass/fail controls while we inspect your physical setup and write no-BS policies mapped to how you actually work.

Will OS hardening break our computers or annoy our staff?

No. We have seen amateur STIG scripts brick computers with a single bad checkbox. Built from our own CMMC Level 2 SPRS package and decades of DoW hardening experience, we focus on operations and usability first so your team never complains.

Reaching Our Lean Engineering Team (Text, Voicemail or Form)

We run a lean, hands-on operation across Managed IT, Cybersecurity, C-7 Low-Voltage, and DVBE procurement, and our phone gets hammered daily by AI sales pitches and spoofed vishing calls. Feel free to text (619) 304-7300 (plain text only, no links), call and leave a voicemail with your company and project details so we can vet and return your call promptly, or use this form.

Unwrap the Enclave Today & Book Your 15-Min Scoping Call

Tell us how many users handle CUI so we can register your project scope and prepare a custom quote.

For security reasons, web URLs or links are not permitted in message details.