Must Enterprise Networking Components Outside My Enclave Be in CMMC Scope?

Enclave Scoping: Good News for Complex Networks

If you've properly architected your CUI enclave with logical separation from your enterprise network, the enterprise components do not need to be in your CMMC assessment scope — even if encrypted CUI data traverses them.

Requirements for This Exception

• Logical separation: The enclave must be properly segmented from the enterprise network (firewalls, VLANs, ACLs)
• Proper encryption: CUI data must be encrypted before leaving the enclave (FIPS 140-2/140-3 validated)
• No CUI processing: Enterprise components must not process, store, or access CUI in unencrypted form

Practical Example

Your company has a dedicated CUI enclave with its own firewall. CUI data traverses your corporate WAN (encrypted via VPN) to reach another CUI enclave at a different site. The corporate WAN routers and switches do not need to be in your CMMC assessment scope, as long as the enclave is logically separated and CUI is encrypted in transit.

Why This Matters

This allows organizations to keep their CMMC assessment scope manageable. Without this provision, every piece of networking infrastructure between sites could be drawn into scope, making assessments prohibitively expensive and complex. Proper enclave design is one of the most effective CMMC scope reduction strategies.