The Enclave Build · Part 2 of 6

Be ready before the CUI arrives

No CUI today? A small Level 2 enclave on a solid Level 1 foundation lets you compete for the work without rebuilding your whole business.

By Rob Maupin · Author of the CMMC Practical Guides series

Picture a small contractor that has done everything right at Level 1. It handles Federal Contract Information (FCI), its 15 practices are in place, and primes like working with it. Then a prime calls about a bigger piece of work, the drawings are marked as Controlled Unclassified Information (CUI), and the question comes up: "Can you handle CUI?"

The honest answer is "not yet." And "not yet" usually means the work goes to someone else.

In Part 1 we made the case for a Level 1 workplace with a small Level 2 enclave. The same design is one of the most practical ways for a Level 1 company to get ready for CUI work.

Readiness comes first

No CUI means no contract forcing you to build. No environment means you can't credibly compete. Most companies break that loop the expensive way: they wait for an opportunity, then try to build everything on someone else's timeline.

But readiness is checked before the work starts. When a contract requires a CMMC status, the contracting officer checks for it in the Supplier Performance Risk System (SPRS) before award. And when a prime hands you CUI, DFARS 252.204-7012 flows down with it, so primes ask before they hand anything over. Readiness also takes lead time: roughly 176 files have to describe your actual configuration.

Why an enclave is the affordable way to get ready

Converting the whole office to Level 2 for a contract you haven't been awarded is the most expensive way to prepare. An enclave flips it. Keep running the business on your Level 1 foundation, and build a small, separate Level 2 environment beside it: a dedicated workspace on Google Workspace or Microsoft 365 GCC High, one or two CUI-only devices, and accounts only for the people who would handle CUI. When the work grows, the enclave grows with it.

What "ready" actually means

• A Level 1 foundation in place
• A configured enclave and dedicated CUI-only devices
• A System Security Plan (SSP) describing what you actually built
• A scored self-assessment against all 110 requirements, with a POAM for anything open
• Procedures for where CUI lands and who can access it

The SSP is where most projects slow down. Describing what you actually built is the thread running through Volume 2 of my CMMC Practical Guides.

Where to start this month: write down the work you're pursuing, ask your primes what a credible "yes" looks like to them, confirm your Level 1 baseline, and name the one or two people who would handle CUI. Those answers size the enclave.

Describe your status precisely. A self-assessment is not a certification. Say exactly what's true, such as "we maintain a documented CUI enclave, self-assessed against NIST SP 800-171." Precise claims build trust with primes.

The build order

1. Level 1 foundation. The Turnkey CMMC Level 1 Package: 15 practices, 142 artifacts, Microsoft 365 or Google Workspace templates, 8 configuration guides, an Evidence Locker, and 8 bi-weekly sessions. $2,495/year (limited time, save $500 off $2,995). Most clients complete Level 1 in 2–4 weeks, depending on infrastructure and responsiveness.

Our Analysis — not a commitment.

2. The enclave. The L2 CUI Enclave Package: configuration guides for Google Workspace or GCC High, 110 practices, 182 artifacts, a pre-filled SSP, a POAM framework, and a Risk Register. No Active Directory, no SIEM, no enterprise IT. You implement with our guides and consulting. $3,495/year, or $5,990/year combined with Level 1.

3. The documentation, guided. For qualifying self-assessment programs, L2 CUI Enclave — Guided Documentation ($5,495/year) keeps everything in the package the same, including your consulting sessions and your signature. What changes is the drafting: you answer structured questions about how your enclave is configured, and your answers become your documentation. We review it, and you sign. Three roles, and you hold the last one.

The boundary: The tool runs outside your CUI boundary. No connection to your tenant, no access to your systems, and it never touches CUI. Its only inputs are your answers about how your environment is set up. It produces documentation about the enclave. It never operates inside it. Before you buy, we confirm it fits: configure first, then document.

Coming up in The Enclave Build

Part 3: Why Level 2 self-assessments stall on the documentation, not the technology.

Part 4: Same practices, same artifacts, same signature: the guided tier in full.

Part 5: One enclave, scope to signature, with both platforms side by side.

Part 6: Who the guided tier fits, and where everyone else should go.

Talk soon,

Rob Maupin

Founder, Overwatch Tools · Author, CMMC Practical Guides: Volume 1 · Volume 2

Overwatch Tools | CMMC Compliance Solutions

Sent October 13, 2026. Reflects requirements in force at the time of sending; guidance may change. General information, not legal advice. Whether information you hold is CUI is determined by your contract and your contracting officer or prime.