Can You Have CUI and Non-CUI on the Same Endpoint? Enclave vs. Enterprise
Yes, but the rule sorts whole assets, not folders. How CMMC Level 2 decides what's in scope, a machine shop scoped three ways, how to justify out of scope, and the rule's line on locked-down VDI endpoints.
Yes, one laptop can hold both CUI and ordinary company work. What it can’t do is hold them separately in the eyes of an assessor. CMMC sorts whole assets, not folders: a device that processes, stores or transmits Controlled Unclassified Information is a CUI Asset, assessed against all 110 Level 2 requirements, and everything else that device does comes along for the ride.
That’s why the real question isn’t about one endpoint. It’s about where you let CUI go, because that decision sets the size of your assessment.
How Level 2 sorts your assets
The rule puts every asset into a category (Table 3 to 32 CFR § 170.19(c)(1)). Work through it in order, and the first “yes” decides:
Sorting any asset, in order
- Does it process, store or transmit CUI?Yes → CUI AssetAssessed against all 110 requirements. (Specialized Assets like OT and test equipment are the exception: documented, not tested.)
- Does it protect assets that do?Yes → Security Protection AssetAssessed against the requirements relevant to what it does: your firewall, SIEM, endpoint tools, and the admins who run them.
- Could it handle CUI, but your policy and practices keep it from doing so?Yes → Contractor Risk Managed AssetDocumented in your inventory, SSP and network diagram. If well documented, the assessor does only a limited check.
- Is it physically or logically unable to?Yes → Out of scopeBe ready to justify the separation. Intent isn’t enough here: the test is inability.
Two lines in the rule do most of the work. Assets are out of scope when they “cannot process, store, or transmit CUI because they are physically or logically separated” from the systems that do (§ 170.4). And “assets that fall into any in-scope asset category cannot be considered an Out-of-Scope Asset,” so a server that both runs your security tools and sits in the office network is still in.
Enterprise or enclave
You can certify your whole enterprise or just an enclave. The rule’s preamble says so directly: contractors “can achieve a specific CMMC Status for their entire enterprise network or an enclave(s), depending upon where the information to be protected is processed, stored, or transmitted.” NIST had the same idea long before CMMC, noting that organizations “may limit the scope of the security requirements by isolating the designated system components in a separate CUI security domain” (NIST SP 800-171 Rev 2, § 1.1).
The trade-off is simple to state and hard to get right. An enterprise scope is easier to design and harder to assess: every laptop, printer and shop-floor PC that can reach CUI is in. An enclave shrinks the assessment but has to genuinely contain the CUI, and the separation has to be real. The DoD’s Scoping Guide describes logical separation as data transfer “prevented by non-physical means such as software or network assets (e.g., firewall, routers, VPNs, VLANs),” and physical separation as assets with “no connection (wired or wireless).”
Two things an enclave doesn’t escape. Its security tools and the people who run them are in scope even if they live in the enterprise: the Scoping Guide’s own example is a central anti-malware tool, where “the people in the IT group who maintain it” and its management server could be in the assessment scope. And an enclave “may be able to leverage some elements of the enterprise assessment… but it cannot inherit the enterprise certification” (89 FR 83141). A certificate covers the scope that was assessed and nothing more.
The VDI line
One sentence in the rule changed a lot of enclave designs. In the out-of-scope row of Table 3: “An endpoint hosting a VDI client configured to not allow any processing, storage, or transmission of CUI beyond the Keyboard/Video/Mouse sent to the VDI client is considered an Out-of-Scope Asset.”
That means a laptop that only displays a virtual desktop, where CUI never lands on the device, can stay out of scope. Some earlier guidance treated these endpoints as Contractor Risk Managed Assets; the final rule settled it. But the configuration has to hold. If the session allows saving, printing, copying or file transfer to the endpoint, CUI has reached the device and it’s a CUI Asset again.
A worked example: one machine shop, three scopes
Take an illustrative 40-person machine shop. Six engineers receive controlled drawings from a prime, work on them in CAD, and send programs to the CNC machines on the shop floor. Everyone else runs the office, the front desk and the floor. Here’s how the same company looks under each design.
Scoped as one enterprise. Every laptop, desktop and printer on the network can reach the drawings, so every one is a CUI Asset: roughly 45 endpoints, the file and email systems, and the network gear that protects them, all assessed against 110 requirements. Simple to draw, expensive to run, and every new hire’s laptop joins the assessment.
Scoped as an enclave. The six engineering workstations, a CUI file share and the CAD license server sit in a segment of their own, with a firewall that blocks traffic from the office network. Those are the CUI Assets. The firewall, the identity system, the endpoint protection console and the log platform are Security Protection Assets, in scope for what they do. The office PCs, separated by that firewall, are out of scope. The CNC machines are the interesting part: if the programs they receive are derived from controlled drawings, treat those programs as CUI until your prime says otherwise, which makes the machines Specialized Assets. They’re documented in your inventory, SSP and network diagram rather than tested against every requirement.
Scoped with VDI. The engineers do their CUI work in a virtual desktop, and their laptops run only the locked-down client, so the laptops are out of scope under the rule’s VDI line. The virtual desktop hosts and storage are the CUI Assets. It’s the smallest scope of the three, but test it honestly: CAD over a virtual desktop can be demanding, and the moment an engineer prints locally or drags a file to the desktop, that laptop is back in.
The design that wins is the one whose boundary actually matches how the work gets done. An enclave that engineers route around every week is a bigger problem at assessment than an honest enterprise scope.
Justifying out of scope
Table 3 tells you to “prepare to justify the inability” of an out-of-scope asset to handle CUI. In practice that means showing the control that stops the data, not describing the intent:
- The network diagram, with the boundary drawn where it really is.
- The enforcing configuration: firewall rules, segment access lists, conditional access policies, or the VDI settings that block file transfer, printing and clipboard.
- A test you can repeat in front of an assessor, such as trying to reach the CUI share from an office PC and showing it fail.
A Contractor Risk Managed Asset needs a different kind of proof. It can reach CUI, so you show the policy, procedures and practices that keep it from doing so, list it in your inventory, SSP and network diagram, and be ready for the assessor’s limited check. The rule says that check “shall not materially increase the assessment duration nor the assessment cost,” but it can still find a problem.
What an enclave can borrow
An enclave doesn’t have to rebuild everything the enterprise already does well. The preamble says it “may be able to leverage some elements of the enterprise assessment by inheriting some requirements from the enterprise network” (89 FR 83141). Think of shared identity, training or physical security. The Scoping Guide adds the limit: “If a process, policy, tool, or technology within the enclave would invalidate an implementation at the Enterprise level, that requirement cannot be inherited.” And if the enclave’s CUI lives in the cloud, that cloud service has to meet the FedRAMP Moderate requirements in DFARS 252.204-7012, whoever runs it. (More on that in is my MSP CMMC compliant?)
Where scoping goes wrong
Treating policy as separation. A rule that says “don’t put CUI on that machine” can support a Contractor Risk Managed Asset. It can’t make the machine out of scope, because the out-of-scope test is inability, not intent. And the category isn’t a shortcut: the preamble is clear it “is not intended to reduce the level of protection.”
Buying a product instead of drawing a boundary. A secure file share or an encryption add-on doesn’t move a laptop out of scope while CUI still reaches it.
Forgetting the people and the paper. Printers, removable media, email and the administrators’ workstations are where CUI escapes enclaves. Every form CUI takes is in scope, including the printed one.
Scope is the decision that sets the cost of everything after it, which is why we start every readiness engagement there. If you’re weighing an enclave, a mock assessment is a good way to test whether the boundary holds before an assessor tests it for you.
Sources: 32 CFR Part 170, § 170.4 and § 170.19(c)(1), Table 3; CMMC Program final rule, 89 FR 83092 (October 15, 2024), preamble at 83140, 83141 and 83169; DoD CMMC Scoping Guide, Level 2, version 2.13 (September 2024); NIST SP 800-171 Revision 2, § 1.1.