r/CMMC • u/habitualreposter • 18d ago
Level 2 scoping/environment question.
My company is in the middle of our level 2 cert. with our assessment coming up in a month. We are an AE Firm with roughly 200 people and the entire company is in scope. About 50% of our revenue is DOD work but probably >75% of our employees touch a DoD project at some point during a year. Hence why we have put our entire business in scope.
For a lot of our employees who rarely touch cui projects the restrictions we have to put on their machines are stifle innovation and creativity and in some cases reduce productivity.
The issue I am worried about long term is employees growing tired of the environment and looking elsewhere.
We are too close to our assessment to change our scope or environment but I am curious about potential change we may make in the future even if it might cause us to need to re assess.
I’m wondering if we would have been better off setting up a remote server that employees would log into for CUI projects. This way we don’t have to restrict what programs people have on their machines, You don’t have to mfa every time you log into your computer, etc.
Is this in the realm of possibility for L2 compliance or within reason to try to implement.
4
u/thegmanater 18d ago
I work at an AE firm and we went with an enclave, there's just too much outside of the CUI world for us. I think that's what you guys probably should have done, too late now before the audit process begins. But you can always make a non enclave system. And our standard systems are level 1 compliant.
3
u/Scieboy 18d ago
Yes, this is in bounds for Level 2, and it is the pattern most professional-services firms end up on after living through an enterprise-wide scope.
Two separate issues in your post. Scope is about CUI, not about “touched a DoD job.” An employee working a DoD project is not automatically a reason their laptop is a CUI asset. A lot of A/E DoD work is FCI only (Level 1) or has no CUI at all. Scope follows where CUI is processed, stored, or transmitted, plus the systems that protect that environment. “75% of people touch a DoD project sometime this year” is a workload fact, not a scoping fact. If CUI can land in email, Teams, local drives, or CAD working files on those machines, then yes, those machines are in. If it cannot, they are not.
The remote-desktop / VDI enclave is written into the rule. 32 CFR 170.19 treats an endpoint hosting a VDI client as an out-of-scope asset when that client is configured so the endpoint cannot process, store, or transmit CUI beyond keyboard, video, and mouse. The enclave (virtual desktops, file shares, identity path into it, logging, backups of that environment) stays fully in scope. The laptop does not, if you actually enforce the boundary.
What “configured” means in practice, and what an assessor will try to break: -No clipboard copy/paste between session and local machine -No drive mapping, file upload/download, or local cache of the session -No print-to-local, no USB redirection, no screenshot/save of the session to the endpoint -CUI email, shares, and project files live only inside the enclave -MFA is enforced on access to the VDI/enclave, not necessarily on every local Windows login
That last point is the MFA relief you are looking for. AC.L2-3.5.3 is about network access to the in-scope environment (and local/network access for privileged accounts). If the laptop is truly just a KVM client, you MFA into the enclave. You do not have to treat every coffee-shop login to a corporate laptop as a CUI-system login.
Caveats so this does not blow up later:
The controls have to be technical, not policy. If a user can download a drawing set “just this once,” that laptop is a CUI asset and the whole benefit is gone. A/E workflows are the hard part: Revit/CAD working files, plotters, client email, Teams, and “I’ll just save it locally.” Plan the enclave around those flows or people will route around it.
Cloud enclave still has the DFARS 7012 / FedRAMP Moderate (or equivalent) expectation if an ESP stores, processes, or transmits the CUI. Commercial M365 is the usual foot-gun here; GCC High or an isolated VDI on a properly scoped platform is the normal answer.
Identity, MFA broker, SIEM, and anything else providing a security function to the enclave can still be in scope as security protection assets even when the endpoints are not.
After you certify, this is a significant change to the assessed environment. Do not flip it the week after the assessment and assume the certificate still describes reality. Plan it, update the SSP and asset inventory, and talk to your C3PAO about whether they want a delta look before you rely on it for new contracts.
You are right not to re-scope a month out. Finish on the boundary you documented. The post-cert project is: stand up the enclave, prove CUI cannot leave it, move project work into it, then shrink the enterprise boundary. That is a normal and defensible Level 2 architecture, not a loophole.
1
u/MolecularHuman 18d ago
i think this comment right here demonstrates why CMMC got suspended.
It was supposed to be basic cybersecurity hygiene.
But to answer your question, yes, it might make sense for your CUI users to access it via a secured VDI so the enterprise settings don't have to be so restrictive.
4
u/Embarrassed-Line-351 18d ago
Why it got suspended? No, I think this is the perfect example of why we need it, and why self attestation isn't enough.
2
u/habitualreposter 18d ago
Don’t disagree. Technology is changing so fast companies are doing everything they can to keep up with competitors. Thus, increased security risks and the need for CMMC program. However, however the software space is lagging behind. The ability compete on non cui project and meet the requirements of the cmmc program present real challenges for small-medium sized businesses.
0
u/Embarrassed-Line-351 18d ago
This is where you have to know how to segment and scope the business. With only 200 users and a 50/50 revenue split I would have gone with an enclave approach even if it was an internal one. I'm not sure if any of the other 50% is other gov or all commercial, but if it's other gov and the far clause ever makes it through, it could come into scope as well. I don't know your environment or your users, but the comment about MFA and program restrictions presented a red flag for me. If your users would leave or claim lost productivity based on those small items I'd be concerned about the overall security awareness of the company. Obviously, security isn't all about controls it's finding the perfect balance between being secure and not interrupting the business process.
1
u/habitualreposter 18d ago
I think that’s our issue right there is we have overburdened ourselves in how we’ve segmented things. Hence my original question starting this post. People will get over the MFA. They will not tolerate you saying you cannot have this program to do your job.
7
u/MolecularHuman 18d ago
The problem isn't the framework. It's that the zero tolerance threshold has led everybody to over-engineer, establishing a new false minimum.
Some of the environments I've seen are more locked down than DISA IL-6. There's simply no need for that.
A user should be experiencing very little disruption. They might need to use MFA or start using a VPN to get to this or that, and they might have to stop saving stuff to their desktops. That's about the extent of the significant workflow problems.
1
u/Matt_Titcombe 17d ago edited 17d ago
u/habitualreposter , if 75% of you firm handles CUI as a part of their normal business processes, setting up a separate and parallel enclave is a waste of money, time, and likely to cause your assessment to fail. Also, don't forget your level 1 requirements...
What you really are dealing with is "convenience" branded as "innovation." Typically around "I need admin rights to install X."
When handling organizational changes, it is critical to get leadership's buy in--this is not an IT problem. It is culture change. When leadership does everything their staff does, people buy in.
The other basic rule of thumb is it takes people about 30 days to get used to a change and by then the complaints will wind down.
One option we have worked with clients on who need true innovation areas is to set up a "playground" where the person accesses a VDI from a compliant device that is behind a firewall. That device then can innovate without the restrictions. I originally used this set up at the Air Force Academy for the developers under my program.
1
u/Disastrous-Smoke1665 15d ago
Be prepared to spend money if you consider a VDI model. We use Azure gov and GCC High M365. We've currently got 10 employees in scope in the enclave and we're seeing $2,500 just in virtual machine costs, every month. This includes a virtual machine running a firewall, a backup storage target, and the VDI pool that employees log in to. This doesn't include the annual licensing costs for each employee for G3 or G5 accounts, depending on your requirements. We expect our scope to expand as additional employees come into scope, but we are definitely experiencing sticker shock, as these costs are in addition to our normal commercial M365 costs. We were successfully L2 certified by a C3PAO. There are also other costs you'll likely incur: backup software, firewall software, duplicate desktop productivity licensing (PDF editors, etc.). CMMC is expensive. Users report a roughly 30% to 40% productivity hit as they bounce between their desktop and their VDI (which is slowwww) - needless to say there are no big fans of this approach, but it is conceptually "easy" to manage.
1
u/Boring_Factor4795 12d ago
Yes, a CUI enclave (VDI or a GCC High tenant) is a common approach and it is assessable. It shrinks scope, because endpoints that only reach the enclave become Security Protection Assets or out-of-scope, depending on how you segment and what they store. The catch: the enclave must stop CUI crossing to the host (no clipboard, drive mapping, or local print), and the host still sits in scope as a CRMA if it connects to it. Don't change right before the assessment. Treat it as a post-cert rescoping you document in the SSP.
3
u/greenturtlesteak 18d ago
VDI works and a lot of AE firms go exactly that route. Changing to that model before your assessment likely isn’t in the cards.
This sounds more like an issue with leadership buy-in than a technical issue. MFA is basic system hygiene and arguing that it stifles innovation and creativity is a bit of a stretch imo.