Defending the DIB: Implementing Zero Trust for CMMC Level 2 CUI Protection

Zero Trust moves the focus from the "Network" to the "Data Object." By implementing Micro-segmentation, you can isolate CUI within a Secure Enclave. This significantly reduces the Assessment Boundary—shrinking the set of systems whose controls you must implement, document, and affirm in SPRS, and keeping non-essential systems out of scope.

The Traditional Perimeter Model is Dead

The traditional network perimeter model assumes that everything inside the corporate network is trusted. This assumption is fundamentally incompatible with NIST SP 800-171's requirement to protect CUI from both external threats and insider risks. Zero Trust Architecture operates on the principle of "never trust, always verify"—every access request must be authenticated, authorized, and encrypted, regardless of network location.

Enclave Boundary Definition

A Secure Enclave is a logically isolated environment where CUI is processed, stored, and transmitted. The enclave boundary is defined by:

• Identity Controls: Only authenticated users with verified devices can access enclave resources
• Network Segmentation: CUI systems are isolated from corporate IT using VLANs, firewall rules, or cloud security groups
• Data Classification Labels: All CUI is tagged and subject to encryption and access policies
• Audit Trails: Every access attempt to enclave resources is logged with user identity, device posture, and data accessed

Assessment Boundary Optimization

By clearly defining your CUI enclave, you can exclude non-essential systems from your CUI boundary and assessment scope:

• Corporate email servers that don't process CUI
• HR and finance systems outside the enclave
• Development and test environments without production CUI
• Personal devices that access corporate resources via VDI only

This scoping discipline can reduce your assessment boundary by 60-80%. Under the current self-assessment regime, that means far fewer systems to implement, document, and defend when you affirm your SPRS score—and if third-party assessments return under a reformed program, a dramatically smaller footprint to assess.

Zero Trust for CMMC Level 2 is built on three technical pillars that align directly to NIST 800-171 control families. Each pillar addresses specific compliance requirements while creating defense-in-depth against modern adversary tactics.

Implementing phishing-resistant Multi-Factor Authentication (MFA) and conditional access policies that verify device health before granting access to CUI.

CMMC Control Alignment

• AC.L2-3.1.2: Enforce MFA for all access to CUI systems
• IA.L2-3.5.3: Use multifactor authentication for local and network access to privileged accounts
• AC.L2-3.1.1: Limit system access to authorized users and processes

Technical Implementation

Phase 1: Phishing-Resistant MFA (Weeks 1-2)

• Deploy FIDO2 security keys or certificate-based authentication for all privileged users
• Configure Conditional Access policies to require phishing-resistant MFA for CUI enclave access
• Block legacy authentication protocols (IMAP, POP3, SMTP AUTH) that cannot support modern MFA
• Create break-glass accounts with hardware tokens stored in physical safe

Phase 2: Device Compliance Gates (Weeks 3-4)

• Enforce device registration in Entra ID or comparable identity provider
• Require compliant device status before granting access:

- Disk encryption enabled (BitLocker, FileVault)

- Endpoint security agent installed and reporting healthy

- OS patch level within 30 days of latest release

- No jailbreak/root detection

• Configure network-based access control (802.1X) for on-premises enclave systems

Phase 3: Just-In-Time (JIT) Privileged Access (Weeks 5-6)

• Implement Privileged Access Management (PAM) for administrative accounts
• Require approval workflow for elevation to Domain Admin, Global Admin, or database sa accounts
• Enforce maximum session duration (2-8 hours) for privileged access
• Log all privileged commands to immutable audit trail

Evidence Artifacts for a Defensible Self-Assessment

• Conditional Access policy export showing MFA enforcement (EV-CA-POLICY-EXPORT-002)
• Sign-in logs demonstrating MFA challenges and device compliance checks
• PAM approval workflow records with ticket numbers and approver identities
• Monthly access review reports showing orphaned accounts removal

Using "Split-Knowledge" encryption where keys are managed separately from the data, ensuring that even a cloud provider subpoena cannot result in plain-text data exposure.

CMMC Control Alignment

• SC.L2-3.13.11: Employ cryptographic mechanisms to protect the confidentiality of CUI at rest
• SC.L2-3.13.8: Implement cryptographic mechanisms to prevent unauthorized disclosure during transmission
• MP.L2-3.8.9: Protect the confidentiality of backup CUI at storage locations

The Split-Knowledge Architecture

Traditional encryption often stores keys in the same cloud environment as the encrypted data. If an adversary gains access to the cloud account (via credential theft or insider threat), they can decrypt all data. Split-Knowledge separates the encryption keys from the data:

• Data Plane: Encrypted CUI stored in cloud storage (SharePoint, S3, Azure Blob)
• Key Plane: Encryption keys stored in separate Hardware Security Module (HSM) or Key Management Service (KMS)
• Control Plane: Access policies enforced by identity provider, logging to separate SIEM

Technical Implementation

For Cloud Environments (Microsoft 365, AWS, Azure)

• Enable Customer-Managed Keys (CMK) using Azure Key Vault or AWS KMS
• Configure key rotation every 90 days with automated versioning
• Use Customer Lockbox to require your approval before Microsoft support can access your data
• Implement Double Key Encryption (DKE) for highest sensitivity CUI where your on-premises key server must authorize decryption

For On-Premises Environments

• Deploy self-encrypting drives (SED) with FIPS 140-2 validated encryption modules
• Use tape encryption for offline backups with keys stored in separate facility
• Implement application-layer encryption for databases (Transparent Data Encryption for SQL Server)
• Configure email encryption (S/MIME or PGP) for CUI transmitted via email

Evidence Artifacts for a Defensible Self-Assessment

• Key Vault configuration export showing CMK enablement and rotation policy
• Storage account encryption status report (all CUI containers encrypted at rest)
• Customer Lockbox approval logs (if applicable)
• Tape backup encryption verification report with separate key custody documentation

Moving from static logs to automated Security Information and Event Management (SIEM) that alerts on anomalous behavior within the CUI enclave in real-time.

CMMC Control Alignment

• AU.L2-3.3.1: Create and retain system audit logs to enable monitoring, analysis, investigation, and reporting
• AU.L2-3.3.2: Ensure audit events are reviewed and analyzed for indications of inappropriate activity
• SI.L2-3.14.6: Monitor communications at external boundaries and key internal boundaries
• IR.L2-3.6.1: Establish operational incident-handling capability for organizational systems

The SIEM Architecture for Small DIB Contractors

Many small contractors assume SIEM is only for large enterprises. This is false. Microsoft Sentinel (cloud-native SIEM) can be deployed at a modest monthly cost for a 10-person enclave, and provides:

• Automated log ingestion from Entra ID, Microsoft 365, firewalls, and endpoints
• Pre-built detection rules aligned to MITRE ATT&CK framework
• Automated response playbooks (e.g., disable compromised user account, isolate infected device)
• 90-day log retention to support the AU control family's log review, analysis, and retention requirements

Technical Implementation

Phase 1: Log Aggregation (Week 1)

• Enable Entra ID sign-in and audit logs (all authentication attempts, admin actions)
• Enable Microsoft 365 Unified Audit Log (file access, email send/receive, SharePoint sharing)
• Configure Windows Event Forwarding from all CUI endpoints to SIEM
• Integrate firewall and VPN logs showing network connections to/from enclave

Phase 2: Detection Rules (Weeks 2-3)

Enable analytics rules for:

• Impossible travel: User signs in from two geographic locations faster than physically possible
• Mass file download: User downloads >500 files in <1 hour (potential data exfiltration)
• Privileged account anomaly: Admin account used outside business hours or from new device
• Brute force: >10 failed authentication attempts within 5 minutes
• Legacy protocol usage: NTLM or SMBv1 detected (should be disabled in Zero Trust enclave)

Phase 3: Automated Response (Week 4)

Configure playbooks to:

• Auto-disable accounts showing credential stuffing patterns
• Isolate devices triggering endpoint security alerts (malware, ransomware)
• Create incident tickets in ServiceNow/Jira with enriched context
• Email security team with alert summary and recommended actions

Evidence Artifacts for a Defensible Self-Assessment

• SIEM data connector configuration showing all log sources ingested
• Analytics rule inventory with enabled detection logic
• Sample incident investigation showing alert, playbook execution, and remediation
• Monthly security metrics report (mean time to detect, mean time to respond)

Different organizational structures require different Zero Trust implementations. Here are three battle-tested patterns for CMMC Level 2 compliance.

Best for: Contractors with 5-50 employees, minimal on-premises infrastructure, CUI exclusively in collaboration tools (email, SharePoint, Teams).

Architecture Components

• Identity Plane: Entra ID (Azure AD) with Conditional Access and MFA
• Data Plane: SharePoint Online GCC High for document storage, Exchange Online for email
• Endpoint Plane: Intune-managed Windows 11 devices with BitLocker encryption
• Network Plane: No VPN required—all access via HTTPS with identity verification
• Monitoring Plane: Microsoft Defender for Cloud Apps + Sentinel SIEM

Compliance Advantages

• FedRAMP-authorized platform: Microsoft 365 GCC High provides an inheritable baseline for many infrastructure controls—but the platform alone does not create compliance; your configuration, policies, and evidence still carry the self-assessment
• No on-premises infrastructure in CMMC scope (reduces AC.L2-3.1.20 physical security requirements)
• Built-in DLP policies prevent accidental CUI sharing with unauthorized recipients
• Managed encryption with customer-managed keys (no need to operate your own KMS)

Cost Profile

• Licensing: commercial licensing at a predictable per-user cost (GCC High E3 or E5)
• Implementation: lowest one-time implementation effort of the three patterns (Conditional Access, Intune, SIEM setup)
• Annual Operations: lowest ongoing operational cost of the three patterns (quarterly access reviews, incident response retainer)

Implementation Timeline

• Weeks 1-2: Provision GCC High tenant, migrate users and data
• Weeks 3-4: Configure Conditional Access, MFA, and device compliance policies
• Weeks 5-6: Deploy Sentinel SIEM, enable DLP, conduct user training
• Week 7: Independent readiness review against NIST SP 800-171 and assembly of the self-assessment evidence package

Best for: Contractors with legacy applications requiring on-premises servers, engineering workstations with CAD/CAM software, or specialized hardware interfacing.

Architecture Components

• Identity Plane: Entra ID synchronized with on-premises Active Directory
• Data Plane: SharePoint Online for collaboration, file server for engineering files
• Endpoint Plane: Mix of Intune-managed laptops and Group Policy-managed workstations
• Network Plane: Site-to-site VPN or ExpressRoute connecting on-premises to Azure
• Monitoring Plane: Sentinel SIEM ingesting logs from both cloud and on-premises

Micro-Segmentation Strategy

Use firewall rules or Azure Network Security Groups to isolate CUI systems:

• CUI VLAN: Engineering workstations, file server, database server
• Management VLAN: Domain controllers, patch server, backup server
• Corporate VLAN: HR systems, finance, general internet access

Enforce inter-VLAN firewall rules:

• CUI VLAN → Internet: DENY (except approved cloud services via explicit allow list)
• Corporate VLAN → CUI VLAN: DENY (users must authenticate via VDI or jump host)
• Management VLAN → CUI VLAN: ALLOW (for patch deployment and backup)

Compliance Advantages

• Supports legacy systems that cannot be migrated to cloud (e.g., custom manufacturing software)
• Lower data egress costs for large engineering files (no cloud storage/bandwidth charges)
• Physical control over encryption keys (HSM appliance in your data center)

Cost Profile

• Licensing: lowest per-user licensing cost of the three patterns (Microsoft 365 E3 + Entra ID P1)
• Infrastructure: substantial up-front hardware investment (firewall, network switches, VPN concentrator)
• Implementation: highest implementation effort of the three patterns (network segmentation, SIEM, policy configuration)
• Annual Operations: highest ongoing operational cost of the three patterns (firewall rule reviews, patch management, SIEM tuning)

Implementation Timeline

• Weeks 1-3: Network segmentation design and firewall configuration
• Weeks 4-6: Migrate CUI systems to dedicated VLAN, configure network access control
• Weeks 7-9: Deploy SIEM, integrate cloud and on-premises logs
• Weeks 10-12: User training, pilot testing, independent gap assessment against NIST SP 800-171

Best for: Contractors with remote employees, BYOD policy, or high-risk threat environment requiring air-gapped CUI access.

Architecture Components

• Identity Plane: Entra ID with phishing-resistant MFA (FIDO2 keys)
• Data Plane: All CUI stored in Azure Virtual Desktop (AVD) or Citrix DaaS environment
• Endpoint Plane: Personal devices (laptops, tablets) access VDI via HTML5 browser
• Network Plane: Zero Trust Network Access (ZTNA) broker validates device posture before VDI connection
• Monitoring Plane: VDI session recording, SIEM ingesting authentication and file access logs

Zero Trust Access Flow

1. User authenticates to Entra ID with FIDO2 security key

2. Device posture check verifies endpoint security agent (CrowdStrike, SentinelOne) is healthy

3. ZTNA broker establishes encrypted tunnel to AVD gateway

4. User receives VDI session with CUI access—no data stored on personal device

5. Session ends: All clipboard and file transfer activity logged, no data persistence

Compliance Advantages

• BYOD support without personal devices entering CMMC scope (CUI never touches endpoint)
• Remote workforce enabled with same security posture as on-premises
• Session recording provides video evidence of user activity for incident investigation
• Geo-fencing can restrict VDI access to approved countries (block access from adversary nations)

Cost Profile

• Licensing: highest per-user licensing cost of the three patterns (AVD, Entra ID P2, Defender for Endpoint)
• Infrastructure: moderate up-front infrastructure investment (AVD host pool, gateway, storage)
• Implementation: moderate implementation effort (VDI image build, ZTNA configuration, session recording setup)
• Annual Operations: moderate ongoing operational cost (image patching, capacity planning, user support)

Implementation Timeline

• Weeks 1-2: Provision AVD environment, build gold image with approved software
• Weeks 3-4: Configure ZTNA broker, Conditional Access policies, MFA
• Weeks 5-6: Migrate CUI data to VDI file shares, configure DLP
• Weeks 7-8: Pilot with 5-10 users, tune performance and policies
• Week 9: Full rollout, user training, self-assessment readiness review

Zero Trust Architecture requires upfront investment but delivers measurable cost savings and risk reduction over the CMMC compliance lifecycle.

Traditional Network Security Costs (3-Year TCO)

Traditional perimeter security front-loads spending into firewall hardware, IDS/IPS, VPN concentrators, and network segmentation in Year 1, then keeps consuming budget through maintenance contracts, firewall rule audits, patch management, hardware refresh cycles, and growing policy complexity. Over a three-year horizon it is the more expensive path—and the spend buys perimeter defense, not CUI-centric protection.

Zero Trust Architecture Costs (3-Year TCO)

Zero Trust shifts spending toward cloud SIEM, Conditional Access, Intune, and a ZTNA broker, with implementation services concentrated in Year 1 and comparatively light ongoing costs for SIEM licensing, identity governance, and continuous monitoring. Over the same three-year horizon, total cost of ownership runs meaningfully lower than the traditional approach—while delivering stronger, data-centric protection.

Cost Avoidance and Risk Reduction

• Assessment boundary reduction: fewer systems in scope means less control implementation, documentation, and evidence maintenance today—and lower assessment costs if third-party assessments return under a reformed program
• Incident response efficiency: automated playbooks reduce mean time to respond from 4 hours to 15 minutes
• Reduced data breach risk: a well-bounded enclave dramatically shrinks the likely blast radius—and the recovery cost—of a small-contractor breach
• Regulatory penalty avoidance: a smaller, defensible boundary shrinks the False Claims Act exposure surface from inaccurate SPRS affirmations—the affirming official signs personally

Net ROI Over 3 Years

Traditional approach: higher spend + high breach/penalty risk

Zero Trust approach: lower spend + substantially reduced breach and penalty exposure

Net benefit: lower total cost of ownership combined with materially reduced risk—Zero Trust wins on both sides of the ledger

Zero Trust Architecture is conceptually simple but operationally complex. Avoid these mistakes that cause schedule delays and cost overruns.

Mistake: Attempting to implement Zero Trust across the entire corporate network in a single phase.

Impact: 6-12 month delays, budget overruns, user resistance due to sudden workflow disruptions.

Solution: Start with the CUI enclave only. Implement phishing-resistant MFA and device compliance for the 5-20 users who touch CUI daily. Once stable, expand to corporate IT incrementally. Use the "enclave-first" approach to stand up a defensible, self-assessable CUI enclave within 90 days while deferring broader Zero Trust rollout to Year 2.

Mistake: Enforcing MFA but allowing unmanaged devices (personal laptops, BYOD phones) to access CUI.

Impact: AC.L2-3.1.1 and AC.L2-3.1.20 gaps you cannot honestly affirm—unmanaged devices are not "authorized" systems, and a DIBCAC review, a selected government-led assessment, or a prime contractor's supplier review will surface them.

Solution: Require device registration in Entra ID or comparable MDM. Configure Conditional Access to block unmanaged devices from accessing SharePoint sites, Teams channels, or VDI sessions containing CUI. Provide company-owned devices to all CUI users, or implement VDI for BYOD scenarios where the personal device never stores CUI.

Mistake: Deploying SIEM and enabling alerts, but no documented response procedures or automated playbooks.

Impact: IR.L2-3.6.1 gap—incident response capability exists on paper but is not operational. Under scrutiny—a DIBCAC review, a selected government-led assessment, or a prime's supplier review—the question will be: "Show me what happens when this alert fires." If the answer is "We review it manually," expect a finding.

Solution: Document runbooks for each alert type (e.g., "User downloads >500 files: disable account, isolate device, create incident ticket, notify security manager"). Implement automated playbooks in Sentinel or comparable SIEM to execute first-response actions within seconds. Test playbooks quarterly and retain evidence of test executions.

Mistake: Enabling encryption at rest/transit but storing keys in default cloud provider KMS without rotation or access controls.

Impact: SC.L2-3.13.11 finding—encryption is present but key management does not demonstrate cryptographic material protection.

Solution: Implement customer-managed keys (CMK) with documented key rotation schedule (90 days recommended). Configure key access policies to restrict decryption operations to specific identities or IP addresses. For highest assurance, use Hardware Security Module (HSM) with FIPS 140-2 Level 3 validation. Retain key rotation logs and access audit trails.

You don't need a 6-month consulting engagement to begin. Here's a low-commitment pilot program to validate Zero Trust ROI before committing to full implementation.

Week 1: Scoping and Baseline

• Identify CUI users: List all employees who create, receive, or process CUI (typically 20-40% of staff)
• Catalog CUI systems: Document SharePoint sites, file shares, databases, and applications containing CUI
• Baseline current controls: Export existing MFA policies, device management status, and log retention configuration
• Define pilot success criteria: e.g., "5 users accessing CUI via Conditional Access with device compliance within 14 days, zero user complaints"

Week 2: Identity Hardening

• Deploy FIDO2 security keys to 5 pilot users (a Yubico Security Key is a low, one-time per-user hardware cost)
• Configure Conditional Access: Require phishing-resistant MFA for access to designated CUI SharePoint site
• Block legacy auth: Disable IMAP, POP3, SMTP AUTH for pilot users
• Test access flow: Verify users can authenticate and access CUI, log all sign-in attempts

Week 3: Device Compliance and Monitoring

• Enroll pilot devices in Intune or comparable MDM
• Configure compliance policy: Require BitLocker, endpoint security agent, OS patch level <30 days
• Update Conditional Access: Add device compliance requirement to CUI access policy
• Deploy SIEM connector: Ingest sign-in logs and file access events to Sentinel or Splunk

Week 4: Validation and Expansion Planning

• Generate evidence artifacts: Export Conditional Access policies, compliance reports, SIEM dashboards
• User feedback survey: Measure authentication time, workflow disruption, support tickets generated
• Cost analysis: Calculate per-user cost (licensing + implementation time)
• Expansion roadmap: Document rollout plan for remaining CUI users (Weeks 5-8) and corporate IT (Month 3-6)

Expected Outcomes

• 5 users successfully accessing CUI via Zero Trust controls within 14 days
• Zero security incidents during pilot (no unauthorized access, no MFA bypasses)
• Evidence artifacts demonstrating compliance with AC.L2-3.1.2, IA.L2-3.5.3, AU.L2-3.3.1
• User acceptance: <2 hours average onboarding time, <5 minutes daily authentication overhead

If the pilot succeeds, expand to all CUI users. If it reveals gaps (e.g., legacy applications incompatible with Conditional Access), adjust architecture before full rollout.

On July 13, 2026, the DoD CIO suspended CMMC Phase II—the Phase II transition, pending Phase II requirements, future CMMC milestones in solicitations and contracts, the planned expansion of Level 2 C3PAO assessments, and planned Level 3 government assessments. The November 10, 2026 Phase II start date is suspended, not rescheduled—do not build your plan around it in either direction. A CMMC Reform Task Force is reviewing the program (industry RFI responses are due August 14, 2026, with recommendations expected within 60 days), but permanent changes require rulemaking, and the suspension may last well beyond that.

What the suspension did not pause: NIST SP 800-171 (Rev 2) remains contractually binding under DFARS clauses, DFARS 252.204-7012 still requires adequate security, 72-hour incident reporting, and flowdown, SPRS scores and affirmations remain live, and the affirming official remains personally accountable—with False Claims Act exposure—for their accuracy. During the review, acquisition organizations use Level 1 and Level 2 self-assessments, and DoD continues selected government-led assessments.

None of that changes the engineering. Perimeter-based security is insufficient for CUI protection, and the NIST SP 800-171 requirements (MFA, device authorization, encryption, continuous monitoring) are impossible to satisfy efficiently without Zero Trust principles. Zero Trust is evergreen security engineering—its value does not depend on the assessment schedule. Under a self-assessment regime it is arguably worth more: a well-bounded architecture is what makes your self-assessment defensible when a DIBCAC review, a selected government-led assessment, or a prime contractor's supplier review comes asking for proof. For the full regulatory picture, see [The CMMC Suspension: What Changed and What Didn't](/cmmc-shift).

Key Takeaways

1. Identity is the new perimeter: Micro-segmentation and Conditional Access reduce assessment scope by 60-80%

2. Split-knowledge encryption: Protects CUI even if cloud provider is compromised or subpoenaed

3. Continuous monitoring: SIEM with automated playbooks satisfies AU and IR control families with minimal manual effort

4. Three architecture patterns: Cloud-first, hybrid, and VDI-based approaches support different organizational contexts

5. Measurable ROI: lower three-year total cost of ownership plus substantial cost avoidance and risk reduction

Next Steps

Blue Heron Defense specializes in rapid Zero Trust implementations for small DIB contractors—the operating and evidence layer that lets a small company handle CUI securely, make defensible attestations, and withstand government or prime scrutiny without an enterprise-sized compliance program. Our 30-day pilot program includes:

• Architecture design session with your IT team
• Conditional Access and device compliance configuration
• SIEM deployment with pre-built detection rules
• Evidence artifact templates mapped to NIST SP 800-171 requirements—the same evidence backbone as our Defensible Self-Assessment
• 90-day post-implementation support

Fixed-price engagement (covers up to 10 CUI users).

Contact us to schedule a free 45-minute architecture consultation where we'll review your current environment and recommend the Zero Trust pattern that fits your organization.

Protect the data. Prove the controls. Preserve the contract.

---

Classification: UNCLASSIFIED // TECHNICAL ARCHITECTURE

Distribution: Approved for public release; distribution unlimited.

Point of Contact: Blue Heron Defense | [Contact Us](/contact)