# DoD Contractors Isolate CUI Workflows

A 200-person architecture and engineering firm approaching a CMMC Level 2 assessment currently treats its entire workforce as in scope because many employees work on DoD projects. The key scoping question is whether controlled unclassified information (CUI) can reach an endpoint, not simply whether its user works on a DoD project. A virtual desktop infrastructure (VDI) enclave could isolate CUI workflows and reduce restrictions on other endpoints, but its technical controls, workflow design, cloud-service requirements, and scope should be coordinated with the C3PAO. The firm should complete its imminent assessment against its documented environment before making a post-assessment change.

- Contractors preparing for CMMC assessments should define and document where CUI can flow and which systems support that environment; project participation alone does not establish endpoint scope.
- A VDI enclave may offer a way to separate CUI workflows, but the enclave’s virtual desktops, file shares, identity path, logging, and backups remain in scope if they handle or protect that environment.
- For procurement and delivery planning, firms supporting DoD work should account for the security boundary and applicable cloud-service requirements when designing workflows, and coordinate proposed scope changes with their C3PAO.
- A community commenter summarized the boundary distinction: “The enclave (virtual desktops, file shares, identity path into it, logging, backups of that environment) stays fully in scope. The laptop does not, if you actually enforce the boundary.”

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 09, 2026

### Government Entities
- U.S. Department of Defense (DoD)
- Defense Information Systems Agency (DISA)

### Key Quotes
> The enclave (virtual desktops, file shares, identity path into it, logging, backups of that environment) stays fully in scope. The laptop does not, if you actually enforce the boundary.
> — Community commenter

### Sources
- [Level 2 scoping/environment question.](https://www.reddit.com/r/CMMC/comments/1x1lpiv/level_2_scopingenvironment_question) - reddit-cmmc