The Shared File Server and the CUI Enclave
Helio Systems has 240 employees and a DoD contract requiring CMMC Level 2. It stores CUI on a segmented file server in a locked room, accessed by 35 engineering staff. The enclave uses its own Windows domain, but authentication for those accounts relies on the corporate Active Directory, which also supports HR, finance, and email. Backups for the CUI server are written to the corporate backup appliance in the same rack as non-CUI backups. The CISO wants to exclude the corporate AD and backup appliance from the assessment boundary because they are shared infrastructure and not CUI. The assessment is 60 days away. The company has implemented 82 of the 110 Level 2 practices; several access control and audit logging practices are partial because the shared AD group policy applies broadly. The CISO asks you to confirm the exclusion so the team can focus on the enclave.
1. Is the CISO's proposed exclusion defensible? Explain how you would draw the assessment boundary for Helio.
Read the worked answer
The proposed exclusion is not defensible. The assessment boundary includes systems and services that store, process, or transmit CUI and security services that protect it. The corporate AD authenticates the 35 engineering users who access CUI and applies group policy to their accounts; it therefore supports access control for CUI even though HR and finance also use it. The backup appliance stores CUI backups, so it directly stores CUI. Shared use does not make a service out of scope.
Helio has two compliant paths. First, fully segment: dedicated AD domain or forest for the enclave, separate administrative credentials, no trust to corporate AD, separate backup target and credentials, and documented isolation. Then the corporate AD and backup appliance can be excluded if no CUI dependency remains. Second, bring the shared AD and backup appliance into scope and assess the applicable Level 2 practices, including access control, identification and authentication, audit logging, and backup protection. The CISO should not ask for confirmation of an exclusion that the evidence does not support.
2. What remediation and evidence should Helio prioritize in the 60 days? Address the partial access control and audit logging practices.
Read the worked answer
Priority one is to settle the boundary and stop planning around an exclusion. Then fix the shared dependencies that affect the most practices: restrict CUI accounts to a dedicated OU, apply enclave-specific GPO, separate privileged roles, and send AD and file-server logs to a protected log store. For backups, encrypt CUI backups, restrict access to named backup administrators, separate credentials from corporate IT, and test a restore. Because 82 of 110 practices are implemented and several AC and AU practices are partial, the team should build evidence for the shared services now: configuration exports, group policy reports, log samples, access reviews, and restore records. Open items should go into a realistic POA&M, but foundational access control and audit gaps should be closed before the assessment. If Helio cannot segment or remediate in 60 days, it should move the assessment date rather than argue for an unsupported boundary.