A practical approach to CMMC Level 2 compliance that balances security requirements with operational efficiency.
CMMC is how the Department of War (DoW, formerly the Department of Defense) checks that contractors protect sensitive information. The program changed in 2026. The security requirements underneath it did not.
The Cybersecurity Maturity Model Certification is the DoW's program for verifying that contractors protect federal contract information and CUI.
Controlled Unclassified Information is government information that needs safeguarding but is not classified.
Third-party certification is paused, but the obligation to protect CUI is in force today and is being enforced.
Whatever the reform produces, every system that touches CUI has to meet NIST SP 800-171. Keeping that footprint small pays off under any version of the program.
Applying CMMC Level 2 controls across your entire organization is expensive, disruptive, and often unnecessary. There's a smarter approach.
Separate your corporate operations from CUI handling with a purpose-built enclave. Keep business running smoothly while meeting the most stringent compliance requirements.
Users seamlessly transition between networks based on their work requirements. The experience is straightforward while the security is comprehensive.
Log into GREEN network as normal for regular work
Click to access PURPLE environment when needed
Azure Virtual Desktop opens in browser or app
Full compliance within the secure enclave
Close AVD session, back to normal work
Separate government cloud built to DoD Impact Level 4 controls for defense contractors handling CUI
Secure remote access with no CUI on personal devices
Identity-based security with device compliance checks
Separate accounts for clear audit trails and access control
The business keeps its main domain. CUI gets its own subdomain, hosted in a separate government cloud tenant with its own mailboxes, sign-ins, Teams, and SharePoint.
Someone who handles CUI has two email addresses and two sign-ins. Everyone else keeps the one they have today.
Jordan Lee
Program Manager · everyday identity
Jordan Lee
Program Manager · CUI identity
The rule is simple. CUI goes to and from the PURPLE address. Everything else uses the GREEN address. These are the situations people run into.
Nothing changes. Scheduling, invoices, proposals, and general correspondence stay on the GREEN address, in the same Outlook people use today.
The customer is given the PURPLE address for CUI. The message lands in the enclave mailbox, which is opened only inside the virtual desktop. Replies and forwards stay inside the enclave.
People who handle CUI list both addresses in their GREEN signature, so customers know where CUI belongs.
Seats follow the work, not the org chart. A person needs a PURPLE identity only if they create, receive, store, or send CUI.
In an organization of 120 people, 18 need a PURPLE seat. That is about 15% of the company.
Illustrative numbers. Discovery sets the real count.
The enclave model delivers compliance without compromise — protecting what matters while preserving operational efficiency.
Only users handling CUI need PURPLE network licenses and infrastructure. No need to overhaul your entire organization.
Your GREEN network continues operating without restrictive controls. Most employees experience zero disruption.
Clear audit boundaries and documented controls make assessment preparation straightforward. Know exactly where CUI lives.
A structured approach to understanding your requirements and building your compliance roadmap.
Identify which business units, contracts, and users need CMMC compliance
Score current state against NIST SP 800-171 Rev. 2, the basis for the SPRS score
Size the PURPLE enclave and define implementation approach
Align timeline and investment with business priorities