Infrastructure decisions are scope decisions
Every VM, subnet, and storage account inside your CUI boundary must satisfy — and evidence — the applicable controls. Architecture that ignores this fills your assessment with systems that never needed to be there. We design the other way around: the boundary defines the architecture, and segmentation does the compliance work that tooling alone can't.
What we build
- Landing-zone architecture — identity, network topology, logging pipelines, and Azure Policy guardrails deployed as a hardened, repeatable pattern aligned to 800-171 objectives.
- CUI enclave design — segmented environments that contain CUI workloads and their users, cutting the population of systems the full control set applies to.
- Network segmentation & boundary protection — the five-point controls (boundary protection, monitoring, session control) implemented in the fabric, not bolted on per-VM.
- Hardening & evidence — baseline configurations documented as they're deployed; the same artifacts feed your SSP and your assessor's testing.
- Azure Government migration — structured moves from commercial Azure or on-prem into the federal cloud, sequenced with your GCC High migration where both apply.
Questions contractors ask us
When do we need Azure Government instead of commercial Azure?
Same logic as GCC High: it's contract-driven. ITAR/EAR technical data and certain sovereignty requirements point to Azure Government; other CUI workloads can sometimes run in commercial Azure with the right configuration. The boundary and the contract clauses decide — not the vendor's preference.
What is a CUI enclave, and is it cheaper?
An enclave is a segmented environment where only CUI workloads and the users who touch them live — so the full weight of 800-171 applies to a fraction of your infrastructure. It's usually the biggest cost lever available: fewer systems in scope means fewer controls to implement, evidence, and assess.
Do you build landing zones from scratch?
We deploy a hardened landing-zone pattern aligned to NIST SP 800-171 control objectives — identity, networking, logging, and policy guardrails as code — then adapt it to your workloads. Pattern first, customization second: that's what keeps the timeline fixed.
Get your target-state architecture scoped.
Tell us what you run today and what your contracts require — a practitioner will map the enclave-vs-migration decision with real numbers. Or email rj@indirectit.com directly.