Who needs a CUI enclave?
Start with the information your team handles, then choose the environment and operating model that fit your work.
CUI is the starting point
Controlled unclassified information (CUI) is government-related information subject to safeguarding or sharing controls under applicable authorities. It is different from classified information and from ordinary commercial information that a business simply considers confidential. The National Archives explains the CUI program.
A CUI enclave is a defined environment for the users, applications, and information involved in controlled work. It can help separate that work from everyday commercial operations. The design starts with your contracts, the information you receive or create, and where that information needs to go.
When a dedicated enclave is a good fit
- A defined group handles CUI. Your project team needs a place for controlled email, documents, and applications while the rest of the company continues ordinary work.
- You are adding a controlled project. A new subcontract or research effort introduces information-handling requirements beyond your current workspace.
- You want a managed operating model. Your team prefers a packaged cloud workspace, user support, and provider documentation over running those elements internally.
The useful question is which people and workflows need the environment. Include reviewers, managers, and support roles that need access, along with the staff producing the deliverables.
Who may not need a separate CUI enclave
| Your situation | A practical next step |
|---|---|
| Public or ordinary commercial work | Use the environment appropriate to that work. A defense-industry label alone is not a reason to buy a CUI enclave. |
| Federal contract information (FCI), with no CUI in scope | Review the applicable safeguarding requirements and your existing environment. FCI-only work does not automatically call for a dedicated CUI workspace. |
| An existing environment already supports the required controlled work | Evaluate its capacity, documented scope, controls, and support before adding another environment. |
| Controlled work is performed entirely in a customer-provided system | Confirm how you access it and whether any files, messages, screenshots, or outputs leave that system. |
| Classified work | Use the approved classified environment and the program’s security process. Castilix Secure Enclave is an unclassified cloud workspace. |
Federal contract information includes nonpublic information provided by or generated for the government under a contract. Your contract and information flow determine the safeguarding and assessment requirements. A separate enclave is one architecture choice; the required outcome is an appropriately protected and managed environment for the actual work.
Resolve the data boundary before choosing a plan
- Identify the contract or subcontract requirements and the information your team will receive, create, store, or share.
- Resolve unclear designations or handling instructions with the responsible customer, prime contractor, or contracting office.
- Map the applications, users, connecting devices, and external recipients involved.
- Compare your current environment with the needed scope and select a managed subscription or custom deployment.
DFARS 252.204-7012 addresses covered defense information, safeguarding, incident reporting, and applicable subcontract flow-downs. Use the clauses in your own agreement when defining the scope.
Cloud selection follows those requirements. GCC High is a platform choice within that design, rather than a universal requirement for every company doing government work.