CUI Enclaves: Understanding Their Role in Protecting Data

Cybersecurity requirements mandate that contractors who handle CUI must correctly implement NIST 800-171. With the Cybersecurity Maturity Model Certification (CMMC), CUI enclaves can be essential tools to ensure defense contractors and any company working with the Department of Defense are compliant.

Protecting Covered Defense Information (CDI), which encompasses Controlled Technical Data (CTI) and Controlled Unclassified Information (CUI), is vital for organizations that handle sensitive data. If you work (or want to work) with the Department of Defense, protecting your data — and providing proof — is no longer optional.

If you handle CUI, but don’t meet all the technical controls for DFARS 252.205-7012/ NIST SP 800-171 and CMMC Level 2 (per CMMC 2.0) you don’t “pass go”, collect your money, and move on.

You may not be awarded new contracts, or worse, you could get hit with hefty fines and legal ramifications.

What are CUI Enclaves?

CUI enclaves are specialized, purpose-built secure computing environments that process and store data, typically for sensitive data types like CUI. The purpose of an enclave is to separate data types from each other while providing an additional layer of security to ensure that data like CUI is protected from unauthorized access or disclosure.

Equally important is correctly documenting policies and procedures. Applying NIST SP 800-37 Tier 3 policies to the CUI enclave, for example, versus trying to apply them to the entire business, helps properly segment sensitive data and lowers the burden on those responsible for managing the infrastructure.

What is CUI?

CUI, as defined in Section 2002.4 of Title 32 CFR, is information that requires protection from unauthorized access or disclosure through special handling, protection, and dissemination control even though it isn’t classified information. 

This information may include things like Personal Identifiable Information (PII), trade secrets, or other sensitive data. 

The protection of CUI is especially important in the context of federal agencies and any company that works with the Department of Defense (DoD). With the emergence of CMMC compliance, all members of the Defense Industrial Base (DIB) who handle CUI must comply with several laws, regulations, and policies that govern the handling of this information.

To learn more visit: What is CUI?

Implementing Security Measures with CUI Enclaves

CUI enclaves are typically implemented using a combination of hardware and software security controls. These controls are designed to isolate the enclave from the broader network and ensure that only authorized individuals can access the information contained within the enclave. 

These controls may include:

• Access controls: Only authorized users are allowed to access the enclave.
• Cryptographic controls: The information contained within the enclave is encrypted, both at rest and in transit, to protect it from unauthorized access.
• Audit and monitoring controls: All activity within the enclave is logged, and these logs are reviewed to detect and investigate any unauthorized access or other security incidents.

Understanding a Basic Enclave Architecture

As illustrated in the above diagram, an enclave is designed to be isolated from the host network. Users are required to authenticate before they can gain access to the enclave, and once they are inside, they can only access the information that has been authorized for them. 

The information contained within an enclave is protected by cryptographic controls, and all activity is logged and monitored to detect any unauthorized access or security incidents.

One key feature of enclaves is that they are typically built to be tamper-proof. 

This means that the hardware and software components of the enclave are designed to detect and respond to any attempts to physically or electronically alter the system. 

This ensures that the integrity of the information contained within the enclave is maintained, even if an attacker attempts to gain access.

Another important aspect of enclaves is that they are designed to meet the security requirements of the organizations that use them, as well as any applicable laws, regulations, and policies that govern the handling of CUI, including DFARS 252.205-7012, NIST SP 800-171, and Cybersecurity Maturity Model Certification (CMMC) Level 2 and above. 

Enclaves are a critical tool for protecting CUI and are used in various contexts, including:

• Cloud computing: Enclaves can be used to create secure, isolated environments within a cloud computing platform, to protect sensitive data in the cloud.
• Privately Hosted and Virtual: Enclaves can also be virtually configured and accessed through Virtual Desktop Infrastructure to keep data within the enclave’s technical boundary.  
• Internet of Things (IoT): Enclaves can be used to create secure, isolated environments on IoT devices, to protect the data collected and transmitted by these devices.
• Mobile devices: Enclaves can be used to create secure, isolated environments on mobile devices, to protect the data stored and processed on these devices.

Maximizing Efficiency and Security with CUI Enclaves

An enclave provides a secure environment for the storage and processing of CUI, and can help protect your data from unauthorized access or disclosure, prevent data breaches, and protect sensitive information.

In addition to data protection, an enclave can help defense contractors comply with regulations and policies like the Federal Information Security Modernization Act (FISMA) and the Defense Federal Acquisition Regulation Supplement (DFARS), avoid regulatory fines and reduce expensive and time-consuming physical security measures.

So what’s the catch? Why doesn’t everyone just engineer a CUI enclave in-house?

Implementing a CUI enclave is a complex task, and requires significant time, deep technical expertise, and a serious budget and an enormous amount of management and monitoring resources. 

That’s where Cuick Trac can help.

With the evolving CMMC requirements, the Defense Industrial Base (DIB) needs solutions that are affordable, practical, and secure, and that can be implemented in a short amount of time, while not disrupting work flows.

Our team of NIST security experts has spent years engineering the most affordable, practical, and secure CMMC compliance solution that helps contractors, manufacturers, and engineers protect their Controlled Unclassified Information (CUI) in as little as 14 days.

Cuick Trac was built for businesses that handle CUI but lack the bandwidth and resources to implement and manage the required controls. 

At its core, Cuick Trac is a privately hosted, pre-configured virtual enclave that keeps CUI encrypted at rest and in transit, and allows for better control of CUI data flow (as CUI never touches the OSC’s (organization seeking certification) network or device.

Unlike a single application or tool, Cuick Trac satisfies all of the technical controls for  DFARS 252.205-7012/ NIST SP 800-171 and CMMC Level 2 (per CMMC 2.0).