Ready Before the Contract
No CUI today? If you want to compete for work that carries it, a small Level 2 enclave built on a solid Level 1 foundation lets you say "yes, we can handle that" without rebuilding your whole business first.
Picture a small defense contractor that has done everything right at Level 1. It handles Federal Contract Information (FCI), it has its 15 practices in place, and it affirms every year. It's good at what it does, and primes like working with it.
Then a prime calls about a bigger piece of work. The drawings are marked as Controlled Unclassified Information (CUI). The question comes up the way it always does: "Can you handle CUI?"
The honest answer today is "not yet." And "not yet" usually means the work goes to someone else.
In Part 1, we made the case for a Level 1 workplace with a small Level 2 enclave for companies that already hold CUI. This piece is about the companies that don't, at least not yet, and why the same design is one of the most practical ways to get ready for the work they want.
The Chicken-and-Egg Problem
Every Level 1 contractor who wants CUI work runs into the same loop:
- You don't hold CUI, so there's no contract forcing you to build a Level 2 environment.
- You don't have a Level 2 environment, so you can't credibly compete for work that carries CUI.
Most companies break the loop the expensive way. They wait until a CUI opportunity is in front of them, then try to build everything at once on someone else's timeline. The problem is that readiness doesn't work that way.
Readiness is checked before the work starts
When a contract requires a CMMC status, the contracting officer checks for it in the Supplier Performance Risk System (SPRS) before award, not after. On the subcontract side, DFARS 252.204-7012 has to be flowed down to any subcontract whose performance will involve covered defense information. When a prime hands you CUI, the safeguarding obligation comes with it. Primes know that, and they ask before they hand anything over.
And readiness takes lead time
A Level 2 environment means 110 practices, 182 defined artifacts, and roughly 176 files that have to describe your actual configuration. Even done well, that takes calendar time. A company that starts when the opportunity appears is usually still building when the decision gets made.
Build ahead, on your own schedule
Readiness built ahead of time is cheaper, calmer, and better documented than readiness built under a proposal deadline. You pick the platform, you size it, you pace it, and you finish it before anyone is waiting on you.
Why an Enclave Is the Affordable Way to Get Ready
Here's the trap on the other side. A Level 1 company decides to get ready for CUI work and starts converting the entire office to Level 2: every laptop, every account, every tool. It's the most expensive possible way to prepare for a contract that hasn't been awarded yet.
An enclave flips that. You keep running the business on your Level 1 foundation, and you build a small, separate Level 2 environment sized for the work you're pursuing:
- A dedicated cloud workspace on Google Workspace or Microsoft 365 GCC High, used only for CUI
- One or two dedicated CUI-only devices, Windows laptops or Chromebooks
- Accounts only for the people who would handle CUI, often just one or two to start
- A documented boundary that the rest of the business stays outside of
Assets that are physically or logically separated from CUI assets are out of scope for Level 2 under 32 CFR 170.19. Your everyday business keeps working the way it does today, and the cost of getting ready is the cost of a small environment, not a company-wide conversion. When the work grows, the enclave grows with it: another user, another device.
⚠️ Self-Assessment Programs Only. The L2 CUI Enclave Package is scoped for CMMC Level 2 programs eligible for annual self-assessment. Programs required to use a C3PAO are not in scope.
What "Ready" Actually Means
"Ready" is not a feeling or a line on a capability statement. It's a short list of things that either exist or don't:
- A Level 1 foundation in place, because Level 2 always sits on top of Level 1
- A configured enclave on Google Workspace or Microsoft 365 GCC High, built from configuration guides and not improvised
- Dedicated CUI-only devices, set up to the same baseline as the enclave
- A System Security Plan (SSP) that describes the enclave you actually built
- A scored self-assessment against all 110 requirements, with a POAM for anything still open
- Procedures for receiving CUI: where it lands, who can access it, and how it stays inside the boundary
- A named senior official who understands what they'll be affirming
The SSP is the piece that turns a configured environment into a ready one, and it's where most projects slow down. Describing what you actually built, requirement by requirement, is the thread running through Volume 2 of my CMMC Practical Guides, written for the contractor doing the Level 2 documentation themselves.
When all of that exists, you're no longer saying "we could probably handle that." You're describing an environment that's built, documented, and ready to receive CUI.
💡 Describe your status precisely
A self-assessment is not a certification, and a ready enclave isn't a CMMC status until a contract calls for one and you post it. In capability statements and teaming conversations, say exactly what's true: for example, "we maintain a documented CUI enclave, self-assessed against NIST SP 800-171." Precise claims build trust with primes. Inflated ones are a liability.
What Being Ready Gets You
Readiness doesn't win work by itself, and anyone who promises otherwise is selling something. What it does is take a "no" off the table.
A real answer to "can you handle CUI?"
When a prime asks, you can describe the environment, the platform, and your documentation instead of promising to figure it out after award.
More opportunities you can actually pursue
Work that carries CUI stops being an automatic pass. You can respond to opportunities and teaming requests you would have skipped before.
Speed when it matters
When the opportunity shows up, your energy goes into the proposal and the work, not into standing up an environment against the clock.
You control the cost and the timing
Built ahead, the enclave is a planned investment you pace yourself. Built under a deadline, it's a rush job priced accordingly.
Want to compete for CUI work?
Book a free 30-minute consultation. We'll look at the work you're pursuing, where your Level 1 foundation stands, and what a right-sized enclave would take for your business.
Book a Free 30-Minute Consultation →Keeping a Ready Enclave Ready
An enclave you build ahead of a contract still has to be maintained. Licensing, patching, account reviews, and evidence don't wait for the CUI to arrive. That's the honest cost of being ready, and it's the strongest argument for keeping the enclave small. One or two users and one or two devices is a maintenance load a small business can carry while it pursues the work.
Once you hold a Level 2 self-assessment status under a contract, the cadence under 32 CFR 170.16 applies: a self-assessment every three years, an affirmation every year, and evidence kept for six years. A small boundary keeps every one of those cycles manageable.
Who this fits, and who it doesn't
This approach fits a Level 1 company that's actively pursuing work that carries CUI, or that has primes asking the question, and that has someone who can follow configuration guides. It doesn't fit a company with no plans to pursue CUI work. If that's you, put your effort into a strong Level 1 program and revisit this when the opportunity is real. It also doesn't fit programs required to use a C3PAO; those are outside what our Level 2 package covers.
Where to start this month
- Write down the work you're pursuing. Which primes, which programs, which kinds of CUI tend to come with them. Readiness is sized to a goal, not built in the abstract.
- Ask your primes what they expect. If a prime has already asked "can you handle CUI?", ask them what a credible yes looks like to them, and keep the answer.
- Confirm your Level 1 baseline. The enclave sits beside it, so it has to be solid first.
- Name who would handle CUI. Usually one or two people. That number sizes the enclave.
- Pick a platform direction. Google Workspace or Microsoft 365 GCC High, based on what your primes use and what your team knows.
The Build Order: Foundation, Enclave, Documentation
Get the order right and each step makes the next one easier.
1. The Level 1 foundation
The workplace your whole business runs in, and the base the enclave sits beside. The Turnkey CMMC Level 1 Package breaks all 15 practices into 142 defined artifacts, with Microsoft 365 or Google Workspace templates, 8 device and network configuration guides, an Evidence Locker, and 8 bi-weekly consulting sessions. $2,495/year (limited time, save $500 off the regular $2,995). Most clients complete their Level 1 assessment in 2–4 weeks, depending on existing infrastructure and responsiveness.
Our Analysis — not a commitment.
Not sure where your Level 1 stands? Our free CMMC Assessment Tool checks all 15 practices in under 30 minutes.
2. The enclave
The L2 CUI Enclave Package gives you configuration guides for a dedicated enclave on Google Workspace or Microsoft 365 GCC High, plus 110 practices mapped to 182 artifacts, a pre-filled SSP, a POAM framework, a Risk Register, an evidence checklist, and time estimates on every task. It's built for limited CUI needs: no Active Directory, no SIEM, no enterprise IT. We provide the templates, guides, and consulting. You implement, and the CUI-only devices are yours to buy. $3,495/year, or $5,990/year combined with the Level 1 Turnkey Package.
📘 Building it yourself?
Volume 1: CMMC Level 1: the foundation your business runs on today.
Volume 2: CMMC Level 2: the Level 2 practices and documentation for the enclave you're building toward.
Kindle from $12.99. See the full series →
3. The documentation, guided
Once the enclave is configured, it needs a full Level 2 documentation set describing it. For qualifying self-assessment programs, L2 CUI Enclave — Guided Documentation ($5,495/year) keeps everything in the L2 CUI Enclave Package the same: the same practices, the same 182 artifacts, your consulting sessions, and your signature on the affirmation. What changes is the drafting. You answer structured questions about how your enclave is actually configured, and your answers become your documentation. We review it against what you built, and you sign. Three roles, and you hold the last one.
The tool runs outside your CUI boundary. No connection to your tenant, no access to your systems, and it never touches CUI. Its only inputs are your answers about how your environment is set up. It produces documentation about the enclave. It never operates inside it.
Before you buy, we confirm it fits your environment. That's why the order matters: nobody should end up with documentation describing an environment they haven't built yet. Configure first, then document.
⚠️ Self-Assessment Programs Only. The L2 CUI Enclave Package is scoped for CMMC Level 2 programs eligible for annual self-assessment. Programs required to use a C3PAO are not in scope.
The Bottom Line
The CUI contract and the readiness to handle it don't arrive in that order. Readiness comes first. For a Level 1 company, the affordable way to get there is not to convert the whole business. It's to keep a strong Level 1 foundation, build a small Level 2 enclave beside it, and document that enclave properly. Then, the next time a prime asks "can you handle CUI?", the answer is yes, and you can show them.
Let's plan your readiness.
In a free 30-minute consultation, we'll talk through the work you're pursuing, your Level 1 baseline, and what a right-sized enclave on Google Workspace or Microsoft 365 GCC High would look like for you.
Schedule Your Free 30 Minutes →Coming Up in The Enclave Build
- Part 3: The Self-Assessment Path Is Open. Finishing Is the Hard Part. Why Level 2 self-assessments stall on the documentation, not the technology.
- Part 4: Same Practices, Same Artifacts, Same Signature. The guided documentation tier in full.
- Part 5: Building a Level 2 CUI Enclave, Start to Signature. One enclave, phase by phase, with both platforms side by side.
- Part 6: We'll Tell You If It Isn't the Right Fit. Who the guided tier is for, and where everyone else should go.
Sources & Further Reading
- DFARS 252.204-7012: Safeguarding Covered Defense Information and Cyber Incident Reporting
- 32 CFR 170.19: CMMC Scoping
- 32 CFR 170.16: CMMC Level 2 Self-Assessment and Affirmation Requirements
- Class Deviation 2026-O0025, Revision 3 (September 3, 2026)
- NIST SP 800-171 Rev. 2
- DoD CIO: About CMMC
This article is general information, not legal advice. Whether your contracts require a Level 2 self-assessment, and whether information you hold is CUI, is determined by your contract and your contracting officer or prime. Questions of contract interpretation should go to your attorney.
