We Heard You. Level 2 Is Now in Scope.

Since launching the L1 Turnkey package, one question has come up more than any other: "We handle CUI. Does Overwatch Tools have something for Level 2?"

For a long time, the honest answer was: not yet. The L2 compliance space is dominated by enterprise-scale solutions built for large organizations with dedicated IT departments, full-time security staff, and budgets to match. Small contractors handling modest amounts of CUI — a few people, a focused scope, a DoD contract that doesn't justify a $50,000+ C3PAO engagement — were largely left to figure it out on their own.

That changes today.

We're launching the L2 CUI Enclave Package — a complete CMMC Level 2 self-assessment solution built specifically for small defense contractors with limited CUI needs. Same philosophy as the L1 Turnkey: every artifact defined, every session with a purpose, platform-specific rather than generic. Just built for the depth and scope that Level 2 requires.

Who the L2 CUI Enclave Package Is Built For

Before we get into what's included, it's worth being specific about who this is — and isn't — designed for. Level 2 is a bigger undertaking than Level 1, and the right-fit matters.

Still not sure which level applies? That's more common than you'd think, and it's exactly what the free consultation is designed to sort out.

What Is a CUI Enclave — and Why Does It Matter?

A CUI enclave is a defined, isolated environment where all Controlled Unclassified Information is created, stored, processed, and transmitted. Instead of trying to apply CMMC Level 2 controls across your entire organization — every device, every user, every system — an enclave approach lets you draw a boundary around the CUI-handling environment and apply controls within that boundary.

For small contractors, this is the difference between a manageable compliance project and an enterprise-scale IT overhaul. You don't need to make every laptop, every phone, and every system in your business CMMC Level 2 compliant. You need to build and operate a secure, documented enclave where CUI lives — and keep everything else outside of it.

This is not a workaround or a shortcut. It's the correct approach for organizations with limited CUI needs, and it's how the DoD's own guidance expects small contractors to structure their compliance. The L2 CUI Enclave Package gives you every artifact, template, and configuration guide to build and document this enclave correctly.

What's Included in the L2 CUI Enclave Package

110 Practices. 182 Artifacts. What That Actually Means.

CMMC Level 2 is based on NIST SP 800-171 and covers 110 security practices across 14 domains: Access Control, Awareness & Training, Audit & Accountability, Configuration Management, Identification & Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System & Communications Protection, and System & Information Integrity.

That's a significant scope — and the reason most small contractors either avoid Level 2 entirely or hand it off to an expensive consultant who hands them back a stack of generic documents that don't reflect their actual environment.

The L2 CUI Enclave Package maps every one of those 110 practices to a specific, defined artifact — 182 total. Not "create a policy for this domain." A defined deliverable for each requirement: the specific policy, the specific configuration screenshot, the specific procedure document, the specific evidence item. You know exactly what you're building at every step.

Why Platform Specificity Matters at Level 2

CMMC Level 2 introduces requirements that go well beyond Level 1 — audit logging, configuration management, system protection controls, and more. The way you satisfy these requirements looks fundamentally different depending on whether your enclave runs on Google Workspace for Government or Microsoft 365 GCC High.

Generic compliance documents — the kind that say "configure your email platform to retain audit logs" without telling you which setting to click in which admin console — fail at Level 2. The requirements are too specific, and the verification too granular, for platform-agnostic guidance to hold up.

The L2 CUI Enclave Package is built around your chosen platform from the ground up. Configuration guides are written for the specific admin consoles, settings, and capabilities of Google Workspace for Government and M365 GCC High. You're not translating enterprise documentation into something that applies to your environment. It starts in your environment.

Consideration	Google Workspace for Government	Microsoft 365 GCC High
Best for	Teams already on Google, Chromebook-friendly workflows	Teams already on Microsoft, Windows-native workflows
CUI device	Dedicated Chromebook (CUI-only)	Dedicated Windows laptop (CUI-only)
Audit logging	Google Admin audit logs, Workspace alerts	Microsoft Purview, Defender for M365
Config management	Google Admin Console, Chrome Enterprise	Intune, Conditional Access, Defender
Included guides	✓ Google Workspace for Gov configuration guide	✓ M365 GCC High configuration guide

Not sure which platform is the right fit? We'll help you work through that in the kickoff consultation. Both are fully supported — the choice is yours.

No Enterprise IT Required. Seriously.

One of the most persistent myths about CMMC Level 2 is that you need enterprise IT infrastructure to comply. Active Directory. A SIEM. A full-time security engineer. A dedicated compliance team. For large defense contractors, that might be true. For small contractors with a defined CUI enclave, it's not.

The L2 CUI Enclave Package is explicitly designed for organizations without enterprise IT. Here's what that means in practice:

This doesn't mean Level 2 is simple. It means it's achievable for small organizations with a focused CUI scope — which is exactly what the enclave approach is designed to enable.

How the 12-Session Program Works

The L2 CUI Enclave Package follows the same session-based structure as the L1 Turnkey — defined focus per session, clear deliverables, bi-weekly cadence — but expanded to 12 sessions to cover Level 2's broader scope.

L1 Turnkey vs. L2 CUI Enclave: Which One Is Right for You?

If you're not sure which level applies to your situation, this comparison is a good starting point. The key question is whether your DoD contract involves CUI — and if so, whether your program is eligible for self-assessment.

Feature	L1 Turnkey Package	L2 CUI Enclave Package
CMMC Level	Level 1	Level 2
Information type	FCI (Federal Contract Information)	CUI (Controlled Unclassified Information)
Assessment type	Annual self-assessment	Annual self-assessment (eligible programs only)
Practices	15 practices	110 practices
Defined artifacts	142 artifacts	182 artifacts
Consulting sessions	8 bi-weekly sessions	12 bi-weekly sessions
Platform	Google Workspace or Microsoft 365	Google Workspace for Gov or M365 GCC High
SSP required	No	Yes — pre-filled template included
POAM / Risk Register	No	Yes — framework included
Enterprise IT needed	No	No
Price	$2,495/year (Save $500 limited time)	$3,495/year

Still not certain? The free consultation is built for this exact question. We'll review your contract requirements and your information environment and tell you directly which level applies and which package fits.

Our Full Product Lineup