Security and shared responsibilities
A managed cloud workspace, clear operating ownership, and documentation your team can use.
A defined place for controlled work
Castilix Secure Enclave brings dedicated Windows 365 Government Cloud PCs together with Microsoft 365 GCC High, enclave email and storage, Microsoft applications, security management, and user support. Castilix manages the cloud workspace; your organization directs who uses it and how it supports your business.
Start with the approved users, applications, and data flows. Document where information enters, how it is used, and how approved recipients receive it. That boundary provides the basis for operating responsibilities and your wider readiness work.
How responsibilities are shared
| Area | Castilix | Your organization |
|---|---|---|
| Cloud workspace | Manage the included Cloud PCs, Microsoft licensing and applications, enclave email and storage, and enclave security. | Identify authorized users, business workflows, required applications, and the information the workspace will handle. |
| Access decisions | Administer the managed workspace within the agreed service scope. | Approve access, identify role changes and departures, and communicate required access changes. |
| Physical devices | Offer physical-device management as a separately scoped service. | Assign device-management ownership and include connecting devices in scope and access planning. |
| Support and escalation | Provide subscription user support and the published outage-escalation process. | Report problems through the agreed channel, identify business impact, and maintain customer escalation contacts. |
| Provider documentation | Supply architecture documentation, control descriptions, and a responsibility matrix. | Incorporate provider material into your organization’s SSP and maintain customer policies, approvals, and records. |
| Readiness and assessments | Offer customer-specific SSP development, policy work, implementation coordination, and evidence preparation through a separate engagement. | Own applicable requirements, organizational implementation, and completion of the required assessment process. |
Make access and information handling explicit
Agree how users reach the workspace and how files move between people and systems. Include local downloads, clipboard use, printing, removable media, external sharing, and connections to other applications in that review. Record the approved methods in the operating procedures and responsibility matrix.
Connecting devices and your commercial IT team remain part of this planning. A defined workspace is most useful when everyone knows which work belongs inside it, which systems support it, and who approves changes.
Know where to turn when you need help
Secure Enclave user support is available Monday–Friday, 8 a.m.–8 p.m. Eastern time, excluding U.S. federal holidays. Routine after-hours assistance is provided on a best-effort basis. Complete enclave outages affecting an entire customer organization and critical outages affecting multiple customers receive immediate escalation.
Keep customer contacts and incident responsibilities in the agreed operating process. Your organization owns its contractual reporting obligations; the responsibility matrix identifies the provider coordination needed to support that process.
Review support and activation terms. For customer-specific documentation and evidence preparation, explore CMMC readiness services.
Bring the operating model into your proposal
Review the users, applications, data flows, physical devices, support contacts, and documentation you need. The subscription covers the packaged enclave; migration, custom applications, physical-device management, and customer-specific readiness work are separately scoped.
For an environment in your own tenant, Enterprise solutions provide a custom proposal with its own operating responsibilities.