Level 2 Secure Enclave Build

• CUI Scoping Workshop: A guided working session to define exactly where CUI lives, flows, and is stored — the foundation for a right-sized enclave. 
• GCC High Tenant Deployment or Enclave Configuration: Full deployment of a new Microsoft GCC High tenant, or secure enclave configuration within an existing GCC High environment. 
• Identity, Access & Device Management: Microsoft Entra ID, Conditional Access, and Intune configured together to enforce least-privilege, risk-based access and compliance across every enrolled endpoint. 
• Threat Detection & Data Protection: Microsoft Defender XDR and Purview deployed to deliver continuous threat visibility alongside data classification and protection aligned to CUI handling requirements. 
• Secure Collaboration & Monitoring: SharePoint and Teams configured for compliant collaboration, with device onboarding and audit logging/monitoring in place to support ongoing visibility across the enclave. 

• A Working Environment, Not Just a Design: You end this engagement with a deployed, operational enclave — configured, connected, and ready for day-to-day use. 
• Faster Path to Assessment Readiness: A technically sound enclave gives your compliance program a real foundation to build documentation and policy on top of. 
• Documentation & Knowledge Transfer Included: Technical implementation documentation and administrator knowledge transfer ensure your internal team can operate and maintain the environment with confidence. 
• Evidence Collection Jumpstart: Initial technical artifacts are gathered during the build, giving your assessment preparation a head start. 

As a Microsoft Solutions Partner with deep experience in GCC High migrations and CMMC-aligned environments, ECF Data has guided defense industrial base (DIB) organizations through the technical realities of NIST SP 800-171 compliance — not just the theory. We build enclaves that hold up to real-world use and real-world assessments, backed by a team that understands both the Microsoft stack and the compliance requirements layered on top of it. 

What's Included vs. What's Not 

Deliverable: A deployed and operational CMMC-ready enclave. 

Not included in this build: 

• Final System Security Plan (SSP) 
• Final Plan of Action & Milestones (POA&M) 
• Policy development 
• Formal assessment readiness 

These items are addressed as part of complementary compliance documentation and assessment-readiness engagements — ask us how to bundle them. 

1. Does this SKU include GCC High or Microsoft 365 licensing? This SKU covers the engineering and configuration work to build your secure enclave. GCC High or Azure Government licensing is required and can be provisioned separately through ECF Data. 

2. Will this get us fully certified for CMMC Level 2? This build delivers the technical environment CMMC Level 2 requires, but certification also depends on documentation (SSP, POA&M), policy development, and a formal third-party assessment — none of which are included in this SKU. Ask us about pairing this build with our documentation and assessment-readiness services. 

3. What happens after the enclave is deployed? Your team receives full technical implementation of documentation and hands-on knowledge transfer, so administrators can confidently manage the environment going forward. 

4. Does this help with our SPRS score? Yes. The controls configured during this build — identity, access, endpoint management, monitoring, and data protection — map directly to multiple NIST SP 800-171 control families, supporting the evidence needed to improve your SPRS score.