# DoD Clarifies CMMC Enclave Scope

The Department of Defense’s CMMC final rule clarifies that using a CUI enclave does not automatically require a managed service provider (MSP) to obtain its own CMMC Level 2 certification. If an MSP’s systems process, store, or transmit CUI, its services fall within the customer’s assessment scope and must meet the safeguards required by the contract. An MSP that does not handle CUI generally does not need its own CMMC assessment, though its relevant services may still be assessed as Security Protection Assets. An enclave has a distinct assessment boundary: it may inherit qualifying control implementations, but not the customer’s enterprise-wide CMMC certification.

- Contractors should determine whether an MSP’s systems handle CUI and document the resulting assessment scope; an enclave alone does not settle the MSP’s certification status.
- Procurement teams can use this distinction when defining CMMC obligations in solicitations, contracts, and MSP agreements, tying safeguards to the services and systems that actually handle CUI.
- MSPs and contractors should distinguish inherited control implementations from certification inheritance when planning assessments and evaluating service-provider responsibilities.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** November 06, 2026

### Government Entities
- Department of Defense (DoD)
- Defense Contract Management Agency (DCMA)
- Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)
- CMMC Program Management Office (CMMC PMO)

### Key Quotes
> If an OSA utilizes an ESP, including a Cloud Service Provider (CSP), that does not process, store, or transmit CUI, the ESP does not require its own CMMC assessment. The services provided by the ESP are assessed as part of the OSC's assessment as Security Protection Assets.
> — Original poster (pasted Federal Register final rule)

### Sources
- [Do I need a cmmc L2 MSP if I have an enclave?](https://www.reddit.com/r/CMMC/comments/1xpewwt/do_i_need_a_cmmc_l2_msp_if_i_have_an_enclave) - reddit-cmmc