CMMC Enclaves and GCC High
A CMMC enclave puts all of your Controlled Unclassified Information inside one small, well-defined environment and keeps everything else out of scope. Instead of hardening every laptop, mailbox and SaaS tool in the company against 110 requirements, you harden the handful of systems where CUI is allowed to exist. Done well, it is the single biggest lever on what CMMC costs.
The decision sits alongside a second one: which cloud the enclave runs on. Microsoft 365 GCC High is the most common answer for defense contractors, but it is not the only one, and choosing it before deciding the boundary is a common and expensive ordering mistake.
Enclave or whole environment?
The question is how many people and systems genuinely need CUI to do their jobs.
- Enclave fits when CUI is handled by a defined group (engineering, contracts, a program team), arrives through a small number of channels, and the rest of the business can work without it.
- Whole environment fits when most staff touch CUI daily, when production systems and shop-floor equipment consume technical data, or when separating the data would break how the company actually works.
- Hybrid is common: an enclave for engineering data, with a small number of hardened endpoints on the shop floor that are inside the boundary.
You cannot answer this without knowing where CUI enters and where it comes to rest. Start with finding CUI in your systems before choosing an architecture.
What goes inside an enclave
- Identities: a separate set of accounts, or tightly scoped groups, with multi-factor authentication on every login.
- Endpoints: managed, encrypted devices (or virtual desktops) that are the only machines allowed to open CUI.
- Storage and collaboration: the file shares, email and document libraries where CUI is permitted.
- Security protection assets: the logging, endpoint protection, vulnerability scanning and identity services that protect the enclave. These are in scope even though they do not hold CUI.
- Controlled paths in and out: how CUI arrives from customers and leaves to suppliers, enforced technically rather than by policy alone.
Where GCC High fits
Microsoft offers three relevant clouds for US defense work: commercial Microsoft 365, GCC and GCC High. GCC High runs in a separate sovereign environment with US-person support and carries Microsoft’s contractual commitments around DFARS 252.204-7012, including incident reporting. That is why contractors who keep CUI, and especially export-controlled technical data, in Microsoft 365 usually end up there.
GCC High is not free of trade-offs. Licensing costs more than commercial plans, migration is a project in its own right, some third-party apps and integrations are not available, and collaboration with outside organizations takes more setup. Those costs are why it pairs naturally with an enclave: you license and migrate the people who need it, not the whole company. See the CMMC cost guide for how much this swings a budget.
Alternatives to GCC High
- Purpose-built CUI enclave services that provide encrypted email and file sharing for a small group, alongside your existing commercial tenant.
- Virtual desktop enclaves where CUI is only ever opened inside a hosted desktop, so local devices never store it.
- On-premises enclaves for organizations whose CUI is tied to engineering or production systems that cannot move to the cloud.
Whatever the option, the provider’s role matters. A cloud service that stores CUI must meet FedRAMP Moderate or equivalent under DFARS 252.204-7012, and a managed service provider that administers the enclave can bring itself into scope. The CMMC guide for MSPs covers how that works.
For a product-level comparison of one enclave service against Microsoft’s government cloud, see PreVeil vs GCC High.
The integration trap
Most enclaves fail quietly, months after they are built. Someone forwards a drawing to a commercial mailbox, a sync client copies a folder to a personal laptop, a ticketing system attaches a CUI file to a support request, or an ERP integration exports technical data into a system nobody scoped. Each of those widens the boundary without anyone deciding to.
Design for this from the start: block forwarding and external sharing outside the enclave, restrict sync to managed devices, check every integration that touches enclave data, and review the boundary whenever a new tool or supplier is added. Then document the boundary in your System Security Plan so the SPRS score you post describes the environment you actually run.
How to decide
Map the data first, count the people who need it, list the systems that would have to change, and price both options. A CMMC readiness assessment does exactly that as its first step: it scopes the CUI boundary, then scores the 110 requirements against whichever architecture you choose.
Frequently asked questions
What is a CMMC enclave?
A CMMC enclave is a deliberately small environment where CUI is allowed to live: a defined set of users, devices, applications and storage that meets all 110 NIST SP 800-171 requirements, while the rest of the business stays outside the assessment boundary.
Do I need GCC High for CMMC?
Not always. GCC High is the Microsoft cloud most often chosen when CUI or export-controlled data must live in Microsoft 365, because of its US-person support model and contractual DFARS 252.204-7012 commitments. Contractors whose CUI lives in a separate enclave product, or who do not use Microsoft for CUI at all, may not need it.
Is an enclave cheaper than securing the whole company?
Usually, when the number of people who genuinely need CUI is small and the data flows can be enforced. It stops being cheaper when most staff need CUI every day, or when integrations keep copying CUI back into commercial systems.
Does an enclave change my SPRS score?
The score is calculated the same way, but it describes the enclave. Your SPRS entry and System Security Plan must state the scope the score covers, and assessors will test whether CUI really stays inside it.