The Federal CUI Security Factory

We ran it on ourselves first.

Four stations from an undrawn CUI boundary to evidence an assessor can test, objective by objective.

NIST SP 800-171 Rev. 2 and Rev. 3 · CMMC Level 2 · GCC High Built by practitioners who passed CMMC Level 2 in their own environment.

IThe boundary

Scope is the first engineering decision.

Every asset inside the CUI boundary carries all 110 controls. Drawn around the whole network, the boundary makes the whole company the assessment. Drawn around where CUI actually lives, it is an enclave you can build, document, and defend.

27of 27 assets in scope

Where does CUI actually go? Drawings go to the shop floor Quotes carry customer drawings Suppliers email CUI to anyone

Each yes pulls that zone back inside the line, with all 110 controls attached.

EngineeringIn scope

Four CAD workstations, the PDM server, the GCC High tenant

EmailIn scope

Commercial mail tenant, mail gateway

Finance, guest, buildingIn scope

ERP, payroll, guest Wi-Fi, cameras, HVAC

Shop floorIn scope

Three CNC controllers, the CMM station, a shop PC

Front officeIn scope

Eight laptops, one printer

Sample environment: a 60-person machine shop. Illustrative, not a client.

IIThe target state

Six planes, engineered as one system.

In GCC High and Azure Government the 110 controls are implemented in six places. We design the target state across all six before anything is deployed, so every control has one home.

1
Entra ID
Identity for the tenant: least privilege, MFA, and session control on every sign-in.
2
Intune
Enrolls and configures every endpoint inside the boundary, and reports that it did.
3
Purview
Labels, protects, and audits CUI wherever it travels.
4
Defender
Detection and response across endpoints, identities, and email.
5
WDAC
Application control: deny by default, run only what is approved.
6
Audit & logging
Collects, keeps, and reviews the record, so evidence is a byproduct of operations.

IIIBuild and write

The SSP is written from the running configuration.

We deploy and harden first, then write each control statement from the setting that implements it. The document describes the environment because it was taken from it.

The technical baseline is a 12 to 14 week build. Improvised, the industry-typical range is 6 to 18 months.

Intune · Endpoint security · Disk encryption: BitLocker required on OS and fixed drives
Method: XTS-AES 256

3.13.16

Protect the confidentiality of CUI at rest.

CUI at rest on in-scope endpoints is protected by BitLocker (XTS-AES 256), required by an Intune disk encryption policy assigned to every enrolled device.

Entra ID (GCC High) · Conditional Access: Require MFA
Users: all · Apps: all cloud apps

3.5.3

Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.

Network access for every user requires multifactor authentication, enforced by a Conditional Access policy covering all cloud apps in the GCC High tenant. Privileged local sign-in uses Windows Hello for Business.

WDAC · Application control policy: Default: deny
Allow: approved publishers

3.4.8

Apply deny-by-exception policy to prevent unauthorized software, or deny-all, permit-by-exception policy to allow authorized software.

In-scope endpoints enforce a deny-all, permit-by-exception WDAC policy. Only software signed by approved publishers executes.

Sample excerpt. Settings are representative, not a client configuration.

IVEvidence, then hold

An assessor does not grade policy titles.

SP 800-171A breaks the 110 controls into assessment objectives, and each one is tested on its own. We collect evidence against every objective, then keep it current under managed compliance, so readiness is a condition you hold rather than a deadline you sprint at.

320 assessment objectives, tested one at a time

Sample: the six objectives behind control 3.1.1. Evidence sources are representative.
Objective	Determine if	Evidence
3.1.1[a]	authorized users are identified	Entra ID user export, reviewed quarterly
3.1.1[b]	processes acting on behalf of authorized users are identified	Service principal inventory
3.1.1[c]	devices authorized to connect to the system are identified	Intune device inventory
3.1.1[d]	system access is limited to authorized users	Conditional Access policy export
3.1.1[e]	system access is limited to processes acting on behalf of authorized users	App consent settings
3.1.1[f]	system access is limited to authorized devices	Compliant-device requirement

Every station above ran on our own environment first.

The proof

110/110

Assessed at 110 of 110. On our own environment first.

Then Allyon's, on the same runbook: CMMC Level 2, June 2026. Our SSP, POA&M, evidence package, and GCC High tenant were assessed the way yours will be.

The practitioners

The people who ran ours run yours.

The team accountable for inDirectIT's own assessed environment is accountable for client delivery. You do not meet senior practitioners in the sale and a different team in the work.