A PreVeil enclave is a protected, end-to-end encrypted email and file-sharing environment used only for Controlled Unclassified Information (CUI). For a small defense contractor it can shrink the part of the company that CMMC Level 2 has to cover. It does not make the company compliant on its own: the identity, endpoint, logging, training and documentation work in NIST SP 800-171 still applies to everything that remains in scope.
Disclosure: Cyberneza is an authorized PreVeil reseller. We wrote this the way we would advise a contractor choosing between options, including the cases where an enclave is the wrong choice.
What an enclave is, in plain terms
CUI is government information that requires safeguarding under law, regulation or government-wide policy; the National Archives maintains the CUI Registry. CMMC Level 2 (Cybersecurity Maturity Model Certification) requires contractors that handle CUI to meet the 110 security requirements in NIST SP 800-171 Revision 2 across the systems that store, process or transmit it. The CMMC rule, 32 CFR Part 170, decides which systems are in scope in section 170.19.
An enclave applies a simple idea: if CUI lives and moves in one deliberately small environment, fewer of your systems hold CUI, so fewer need to meet the full set of requirements. The rest of the business keeps using ordinary tools such as Microsoft 365 or Google Workspace.
What does PreVeil publish about its service?
These are PreVeil's own published statements as of October 2026. Verify current vendor documentation before repeating them in a contract or a System Security Plan.
- End-to-end encrypted email and file sharing.
- FedRAMP Moderate Equivalency.
- AES-256-GCM encryption through a FIPS 140-3 validated cryptographic module.
- Designed to run alongside Microsoft 365 or Outlook and Google Workspace or Gmail rather than replacing them.
“FedRAMP Moderate Equivalent” is not the same as holding a FedRAMP authorization. It matters because DFARS 252.204-7012, paragraph (b)(2)(ii)(D), requires an external cloud service provider that stores, processes or transmits covered defense information to meet security requirements equivalent to the FedRAMP Moderate baseline. A December 2023 DoD CIO memorandum describes the conditions under which DoD treats a provider as equivalent, so ask for the evidence behind the label instead of relying on it.
What does an enclave take out of scope, and what stays in?
Under 32 CFR 170.19, Level 2 scope is built from asset categories. CUI Assets store, process or transmit CUI. Security Protection Assets provide security functions for the CMMC environment. Contractor Risk Managed Assets, Specialized Assets and external service providers each have their own rules, and Out-of-Scope Assets are those that never touch CUI and are separated from it. An enclave helps by reducing the number of places CUI can be. It does not make the supporting pieces disappear.
| Component | Usually still in scope with an enclave? | Why |
|---|---|---|
| Computers used to read or edit CUI | Yes | They process CUI whenever a user opens it. |
| Identity provider and multi-factor authentication for enclave users | Yes | They are Security Protection Assets that control access to CUI. |
| Endpoint protection, logging and monitoring that cover in-scope assets | Yes | They protect the CMMC environment. |
| The enclave service itself | Treated as an external service provider | You document what the provider covers and what you still own. |
| Marketing site, CRM, general file shares, staff who never receive CUI | Generally no, if CUI cannot reach them | The separation has to be documented and defended. |
What work remains after an enclave?
For the environment that stays in scope you still need access control and identity governance, endpoint hardening and configuration baselines, audit logging and review, vulnerability management, security awareness training, incident response (including the 72-hour reporting duty described in our post on the three DFARS 7012 clocks), physical protection, and the written System Security Plan (SSP), Plan of Action and Milestones (POA&M) and supporting evidence. The value of an enclave is architectural: it shrinks the amount of environment those requirements apply to. For the full sequence, see CMMC Level 2 in plain English.
Enclave or GCC High: how do they compare?
| Option | Where CUI lives | Effect on scope | Usually fits when |
|---|---|---|---|
| Enclave beside your existing platform | A small protected environment for CUI email and files | Narrower environment; CUI kept out of ordinary mailboxes and drives | A small group handles CUI, mostly by email and files, and you want commercial tools for everything else |
| Microsoft GCC High or another government cloud | Your collaboration platform moves to a government cloud tenant | Broader environment, on one platform | CUI runs through many workflows, many users handle it, or a prime requires it |
Other architectures exist, so this is not exhaustive. Cost depends on user count, existing licensing and the resulting boundary, so we do not quote numbers here.
When does an enclave fit, and when does it not?
It tends to fit when a relatively small group handles CUI, CUI moves mainly through email and files, you want to keep your existing commercial platform for general business, and you want to compare enclave economics with a broader migration.
A broader environment tends to fit when CUI is embedded across line-of-business applications, a large share of users handle it routinely, a customer or prime dictates the platform, or other federal workloads make a government cloud worthwhile for other reasons.
What should you settle before choosing a platform?
- Do you actually receive CUI? Look for DFARS 252.204-7012 and 252.204-7021 in the contract and for CUI markings on what you receive. Federal Contract Information alone points to Level 1; see FCI vs. CUI.
- Where does CUI enter, where is it stored, and who sends it onward?
- How many people need access, and on which devices?
- Does your prime or contract require a specific platform or architecture?
- Do other federal workloads make a broader government cloud worthwhile?
Answer these first and the platform choice is usually short. Our page on CUI boundary definition describes this scoping step, and PreVeil for CUI and secure CUI collaboration cover the enclave option in more detail.
Where do enclave plans go wrong?
- CUI leaks around the enclave. It gets forwarded to an ordinary mailbox, saved to a shared drive or pasted into a chat tool. The boundary only holds if people's habits follow it, so train users and set clear rules for where CUI may go.
- Scoping the enclave but not what reaches it. The endpoints and identity systems that connect to it stay in scope.
- Treating a vendor statement as evidence. An assessor works from your SSP and your evidence, so the split of responsibilities with the provider has to be documented.
- Buying before scoping. The platform choice depends on the boundary, not the other way round.
Common questions
Does a PreVeil enclave make me CMMC compliant?
No. No single product satisfies all 110 NIST SP 800-171 requirements. An enclave narrows where CUI lives; you still have to meet the requirements for the systems, people and processes that remain in scope, document them in a System Security Plan, and pass the assessment your contract requires.
Is FedRAMP Moderate Equivalent the same as FedRAMP authorized?
No. PreVeil publishes FedRAMP Moderate Equivalency, which is a different claim from holding a FedRAMP authorization. DFARS 252.204-7012 requires an external cloud provider that handles covered defense information to meet security requirements equivalent to the FedRAMP Moderate baseline, so ask for the evidence behind any equivalency claim and confirm that your prime or contracting officer accepts it.
Do I still need Microsoft GCC High if I use an enclave?
Not necessarily. If CUI is limited to email and file exchange for a small group, an enclave beside your existing platform can be enough. If CUI is embedded across many applications and workflows, many users handle it, or your prime requires a specific platform, a broader government cloud environment may fit better.
Who decides what is in scope for my CMMC assessment?
The scoping rules in 32 CFR 170.19 define the asset categories, and your assessor evaluates the boundary you document. Your System Security Plan and your network and data-flow diagrams are the evidence. Choosing a product does not set scope on its own.
Is it PreVeil or Prevail?
The product is PreVeil, but it is often written Prevail. A PreVeil enclave and a Prevail enclave are the same thing.
Primary sources
- 32 CFR Part 170, section 170.19: CMMC scoping (eCFR)
- NIST SP 800-171 Revision 2 (NIST CSRC)
- DFARS Subpart 204.73: Safeguarding Covered Defense Information and Cyber Incident Reporting (acquisition.gov)
- National Archives CUI program and Registry
If you want help mapping your CUI flow and comparing options, send us a message.