CMMC LEVEL 2 · NIST SP 800-171 · GOOGLE CLOUD MARKETPLACE

A CMMC Level 2 enclave you don't have to engineer yourself.

A locked-down, monitored desktop for CUI, deployed from Google Cloud Marketplace into your own account. Your team exchanges CUI with the government through DoD SAFE. The rest of your company stays out of scope.

THE PROBLEM

You won the DoD work. Now you have to protect the CUI that comes with it.

CMMC Level 2 means 110 security practices. Apply them to your whole company and every laptop, file share and email inbox is in scope. That’s an enormous IT effort for a small company or lab.

Most small teams only touch CUI on a handful of contracts. The common way to handle that is an enclave: a small, separate environment where CUI lives, built to the standard, while the rest of the business carries on as before. Building one yourself takes cloud networking, Linux hardening, identity, logging and audit evidence. Few small firms or labs have that person on staff.

Hours to build, not months. You deploy it; the enclave hardens itself.

THE SOLUTION

The parts an assessor asks about, ready to deploy 

FIPS mode, enforced

Ubuntu Pro FIPS 22.04 on a Google Shielded VM with Secure Boot and a virtual TPM. The build stops if FIPS mode isn't on.

Two-factor sign-in and lockout

User accounts, 2FA and offboarding run through JumpCloud. Unbind a person there and they lose access within minutes.

Default-deny network, both directions

One way in, filtered to the U.S. and your own addresses. Out, only a named allowlist. Known-malicious and sanctioned-country traffic is dropped. Every decision is logged.

Application allowlisting

Only approved programs can run. Anything else is refused and recorded.

Integrity checks and antivirus

File-integrity monitoring catches unexpected changes to the system. Antivirus scans files as they are opened.

Monitoring that reaches a person

43 alert policies by email, with optional Jira tickets: failed sign-ins, deleted or re-permissioned CUI, exfiltration attempts, configuration drift.

Audit logs and backups

A locked 365-day audit log bucket and scheduled VM backups, both in your Google Cloud project.

Built for a FedRAMP Moderate boundary

You deploy it into a Google Cloud Assured Workloads folder you create, which keeps data in the U.S. and limits Google support to adjudicated staff.

Deploying the enclave doesn't make you CMMC compliant on its own. Smarter Reality CUI Enclave handles most of the technical controls, and our Responsibility Reference lists exactly what's left for your policies, training and incident response.

Request Early Access

Launching soon on Google Cloud Marketplace. New DoD contracts can already require a CMMC Level 2 self-assessment. Tell us about yours and we'll be in touch. You'll need a Google Cloud organization and a JumpCloud account.