How scoping works under 32 CFR 170.19
32 CFR 170.19 sorts Level 2 assets into five categories:
- CUI Assets — process, store or transmit CUI.
- Security Protection Assets — provide security functions for the CUI environment, such as identity systems, logging and endpoint protection.
- Contractor Risk Managed Assets — can, but are not intended to, process, store or transmit CUI because of policies and controls in place.
- Specialized Assets — such as IoT, operational technology, government property and test equipment.
- Out-of-Scope Assets — only when they cannot process, store or transmit CUI and are physically or logically separated from CUI assets.
An enclave works by making the boundary of CUI Assets small and the separation from everything else real.
What stays in scope
- All 110 requirements apply inside the enclave.
- The security tools and identity systems that protect the enclave are Security Protection Assets, so they are in scope too.
- A cloud service that stores, processes or transmits CUI must meet FedRAMP Moderate or equivalent under DFARS 252.204-7012(b)(2)(ii)(D).
When an enclave fits, and when it doesn't
It fits when CUI touches a small team or a few workflows, such as one engineering group or one contract.
It doesn't when CUI is everywhere in the business. Then the friction of moving work in and out of the enclave can outweigh the scope savings, and protecting the whole environment may be simpler.
Questions to ask any enclave provider
- Can I see your shared responsibility matrix, requirement by requirement?
- What is your FedRAMP status, and what evidence supports it?
- Which requirements do I inherit from you, which are shared, and which remain mine?