A small defense subcontractor moves CUI into a cloud enclave that meets DFARS 252.204-7012, shrinks its assessment boundary and updates its SPRS score
A machining and assembly subcontractor of about 70 people supplying a prime defense contractor, with controlled technical data on an on-premises file server and in shared mailboxes.
- Scale
- About 70 staff, 18 CUI users, 1 cloud enclave, 110 requirements in scope, SPRS score from 81 to 106, 4 open one-point POA&M items
- Engagement
- Five months from scoping to the updated SPRS entry
The challenge
The firm had submitted an SPRS score of 81 two years earlier, calculated from a self-assessment against NIST SP 800-171, and the plan of action behind it had barely moved. Controlled unclassified information (CUI), mostly drawings and process specifications from the prime, still lived on a file server in the back office and in mailboxes shared with everything else, so the whole company was inside the assessment boundary. The owner wanted to host the data in the cloud, but DFARS clause 252.204-7012 requires an external cloud service provider that stores, processes or transmits covered defense information to meet security requirements equivalent to the FedRAMP Moderate baseline, and to support the clause's incident-reporting and media-preservation duties. A general-purpose commercial tenant would not do.
The DFARS clause 252.204-7012 sets two rules that surprise small firms. Covered defense information must be protected to NIST SP 800-171, and an external cloud provider that holds it must meet security requirements equivalent to the FedRAMP Moderate baseline. Moving to a cloud is therefore a compliance decision as well as a technology one, and the provider's evidence matters as much as its features.
Scoping decided the cost of everything else. By tracing each flow of CUI and sorting assets into the Department of Defense's categories, we found that 18 of the firm's 70 people ever needed the data. They became the enclave. The rest of the company, the shop floor and the corporate email stayed outside, which kept the assessment boundary small and the budget sane.
The provider's customer responsibility matrix was the most useful document in the project. It shows which of the 110 requirements the cloud provider covers, which are shared and which belong to the customer, so the firm could see that sign-in, device compliance, logging review and incident handling were still its own. Those became the build list for the enclave.
The incident duties are easy to miss. The clause asks for a report to the Department of Defense within 72 hours, a medium assurance certificate to file it, submission of malicious software to the DoD Cyber Crime Center and preservation of images for 90 days. We wrote that as a runbook and rehearsed it, because a firm that has never tried to file a report will not learn how at hour 60.
The SPRS update was the last step, not the goal. The system security plan, the data flow diagram, the plan of action and the score had to agree with what was actually built. We recalculated the score with the DoD Assessment Methodology and recorded each open item with an owner and a date, so the number in SPRS could be explained to the prime and, later, to an assessor.
What our team delivered
- A scoping exercise that traced where CUI enters, is stored, is processed and leaves, and sorted the firm's assets under the Department of Defense's CMMC scoping categories: CUI assets, security protection assets, contractor risk managed assets and out-of-scope assets. The result was an enclave for 18 people, not a company-wide environment
- Selection of a cloud service provider with a FedRAMP Moderate authorization at the government community level, the most direct way to satisfy the clause's equivalency requirement, and a review of its customer responsibility matrix, which showed which of the 110 requirements the provider meets, which are shared and which remain the firm's own
- A separate enclave tenant with its own identities, phishing-resistant multi-factor sign-in with FIDO2 keys for the 18 users, managed devices that comply with a baseline before they connect, FIPS-validated cryptographic modules for CUI at rest and in transit, and sensitivity labels with data loss prevention rules that stop CUI leaving the enclave by mail or sync
- A migration that moved CUI from the file server and from mailboxes into the enclave, rerouted CUI mail through it, and retired the old server with media sanitization following NIST SP 800-88 once the data was verified in place
- Audit logging for the enclave kept and reviewed weekly, plus an incident-response runbook for the clause's duties: report a cyber incident to the Department of Defense within 72 hours through the DIBNet portal using a medium assurance certificate, submit malicious software to the DoD Cyber Crime Center, and preserve images and packet captures for 90 days. A tabletop checked that the firm could do all three
- An updated system security plan with the enclave boundary and a data flow diagram, a refreshed plan of action and milestones, a re-score with the DoD Assessment Methodology, and a new SPRS entry made by a company official with the date the plan expects all requirements to be met
Result
The new score was 106 of 110, up from 81, with four open one-point items on the plan of action and an owner and a date for each. The assessment boundary fell from the whole company to the 18‑person enclave and the managed devices that connect to it, and the prime accepted the updated entry. The firm's cloud provider documentation, the customer responsibility matrix and the 72‑hour incident runbook went into the evidence file for a future assessment. This is readiness work, not a certification: only an authorized assessor or the government can grant a CMMC status, a score is only as good as the evidence behind it, and the phase-in dates and contract clauses should be checked against the 32 CFR Part 170 rule and the contract itself. This is an illustrative engagement that describes the kind of work our team does; details are composite.
Get this for your company
Related services with fixed prices and a written scope.
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Show 4 more
Cloud security review
A review of one Microsoft 365, Azure, AWS or Google Cloud tenant against recognized benchmarks.
Report within 7 business days of read-only access
$2,800 per tenant
Cloud management
We run your Microsoft 365, Azure, AWS or Google Cloud environment: access, cost, patching, backup and security settings. Priced per month for one tenant.
Onboarding within 15 business days
$1,900 per tenant, per month
Clayton Secure program
One monthly program that bundles monitoring, patching, backups, email protection and security awareness for your whole team. Priced per team member.
Onboarding starts within 10 business days
$150 per team member, per month
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Separate by region and by business unit
Each business unit lives in its own VRF and VLAN in every region, so a problem in retail cannot reach finance. Traffic between units has to pass a firewall that denies by default and allows only what is written down.
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
The evidence pack and who asks for what
Twelve artefacts a firm can show about its AI use, and the party that most often asks for each: an insurer at renewal, an auditor or client questionnaire, or a regulator. A typical pattern only; the exact list depends on the policy, framework and sector.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.