Cloud or on-premises CUI environment for CMMC: which one fits your scope
Where your CUI lives is the first decision a CMMC Level 2 scope depends on. The choice between a cloud enclave, an on-premises environment or a hybrid is set by where CUI is processed and stored, and by what the assessment scope must include. Under 32 CFR 170.16(c)(2) and 170.17(c)(5), any cloud offering used for CUI at Level 2 must be FedRAMP Authorized at the Moderate baseline or higher on the FedRAMP Marketplace, or meet equivalent security requirements under DoD policy. Your organization owns its controls. An implementation partner can prepare systems, documentation and evidence, but only an independent C3PAO or DoD assessor issues assessment results.
Confirm the current requirement before you commit budget. On 13 July 2026 the Department of War suspended CMMC Phase II, which would have required Level 2 C3PAO certification for applicable contracts. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. Ask your contracting officer or prime which assessment type applies to your contract, and read the official CMMC Program final rule for the scoping rules that govern either path.
Plan for scope before you choose a platform. A cloud provider's authorization does not remove your responsibilities. Your own on-premises infrastructure that connects to the cloud or to an external service provider stays in the assessment scope, and your SSP must document the customer responsibility matrix for each provider. Under 32 CFR 170.16(c)(3) and 170.17(c)(6), a non-cloud external service provider's services are assessed within your scope against all Level 2 requirements. Narrowing that scope is the main lever for controlling cost, which is why the isolation of CUI systems into a separate security domain matters more than the hosting label.
How each environment type changes your assessment scope
A cloud enclave places CUI in a provider's cloud service, and the contract allows that only when the service meets the cloud rule. Under 32 CFR 170.16(c)(2) and 170.17(c)(5), a cloud offering used for CUI at Level 2 must be FedRAMP Authorized at the Moderate baseline or higher on the FedRAMP Marketplace, or meet equivalent security requirements under DoD policy. Confirm the authorization on the Marketplace yourself rather than relying on a marketing page, and record the exact package in your SSP.
- Provider authorization: Check the authorization level and boundary on the FedRAMP Marketplace for the specific service, region and deployment you plan to use.
- Your own connections: Any on-premises systems, endpoints or administrator workstations that reach the enclave remain in your scope.
- Customer responsibility matrix: Document which controls the provider inherits, which you implement, and which are shared, and reference that matrix in the SSP.
- Identity and access: Accounts, MFA, privileged access and tenant configuration are usually yours to build and evidence.
- Logging and configuration: Audit records, baselines and change records for the tenant are generally your evidence to produce.
Before committing, ask the provider for its FedRAMP package reference and its customer responsibility documentation, and confirm the service is covered at the level you need.
An on-premises CUI environment keeps the systems that store, process or transmit CUI in facilities and networks you control. No cloud authorization question arises, but every component that handles CUI falls inside your assessment boundary, and you must show that each Level 2 requirement is met with evidence in final form. Security requirements such as boundary protection, physical protection and media handling all apply directly to hardware you own.
- Full boundary ownership: Servers, network devices, endpoints, backups and facilities that handle CUI are all in scope.
- Physical controls: Access to data rooms, badge logs, visitor escorts and media storage are assessed as your own practices.
- Scope reduction options: You can isolate CUI components in a separate security domain with firewalls, subnetworks and information flow controls, as NIST SP 800-171 Rev. 3 section 1.1 describes, which limits how many systems the assessment must cover.
- Lifecycle work: Patching, maintenance, sanitization and hardware replacement all generate evidence you must keep current.
- Staffing: Operating the environment requires internal people or contracted staff who can produce and maintain these records.
Before designing this model, map which systems will touch CUI and decide whether segmentation can keep the boundary small, because the size of the in-scope network affects assessment cost.
A hybrid model keeps some CUI workloads on your own infrastructure and places others with a cloud or external service provider (ESP). It is common when a company already runs on-premises systems and adds a cloud collaboration or hosting service. The scope grows with each connection, and every provider adds documentation obligations on top of your own controls.
- ESP documentation: Under 32 CFR 170.16(c)(3) and 170.17(c)(6), a non-cloud ESP's use and services must be documented in your SSP, and its service description and customer responsibility matrix must be referenced.
- Assessed as part of your scope: ESP services are assessed within your scope against all Level 2 requirements, not as a separate exemption.
- Connection controls: The links between your on-premises systems and the cloud or ESP service stay in your scope, including gateways, firewalls and identity federation.
- Duplicate controls: Identity, logging and configuration may exist in two places, so define one authoritative source for each control.
- Boundary diagrams: Keep a current data flow diagram that shows where CUI moves and which party controls each segment.
Before finalizing a hybrid design, ask each provider for its written responsibility matrix and confirm whether any part of its service is outside the scope you are documenting.
A non-cloud external service provider, such as a managed service provider or an outsourced hosting operator, can handle CUI on your behalf without offering a FedRAMP cloud service. Under 32 CFR 170.16(c)(3) and 170.17(c)(6), that provider's use and services must be documented in your SSP and its service description and customer responsibility matrix. The provider does not reduce your obligations, so you must show the full set of Level 2 requirements for the services it supplies.
- SSP documentation: Describe what the provider does, which CUI flows it touches and how you verify its controls.
- Responsibility matrix: Obtain the provider's written matrix and map each Level 2 requirement to the party that performs it.
- Full Level 2 assessment: Assessors test the provider's services against all Level 2 requirements within your scope.
- Contract terms: Include security, incident reporting and access provisions in the agreement so you can collect evidence.
- Evidence access: Confirm in advance that the provider will supply logs, configuration records and personnel evidence when assessors ask.
Before signing, ask the provider how it will support an assessment and whether it has been through a third-party review you can review.
What FedRAMP Moderate and non-cloud service providers mean for scope
For a cloud offering that stores, processes or transmits CUI at Level 2, the rule is strict: the offering must be FedRAMP Authorized at the Moderate baseline or higher on the FedRAMP Marketplace, or it must meet equivalent security requirements under DoD policy. Your assessor will not accept a provider's marketing claim or a sales deck in its place. Check the Marketplace listing yourself, confirm the baseline (Moderate, High or a higher impact level), and confirm the authorization covers the specific service and region you will use, not only the parent brand. Save the listing and the date you checked it, because the assessor will ask for the same evidence. If you plan to rely on the equivalency path instead, expect the provider to produce documentation that maps its controls to the Level 2 requirements, and treat that documentation as something you must review, not accept on trust.
A non-cloud External Service Provider, such as a managed IT or managed security provider that administers your systems from its own facilities, is not exempt because it is not a cloud product. Under the CMMC rule, its use and services must be documented in your System Security Plan, and its services are assessed inside your scope against all applicable Level 2 requirements. In practice, this means you need the provider's written service description and its customer responsibility matrix, which states which controls the provider implements, which it shares and which remain yours, and you must reference both in your SSP. Ask the provider to confirm in writing whether it is an ESP for CMMC purposes, what CUI access its staff have, and where its administrative tooling runs. Confirm these answers with the provider before you sign, because they determine how much of its operation your assessor will examine.
Whichever provider you choose, your own on-premises infrastructure that connects to the cloud or ESP service stays in scope. Firewalls, identity connectors, endpoints and the network path into the provider are yours to document and assess. The responsibility matrix narrows what the provider covers, but it does not remove the gaps it leaves behind, so map each provider line item to a named owner in your environment before the assessment begins.
When US-person clouds and ITAR change the answer
Some clouds restrict who can administer them, and some data falls under export rules whatever the hosting choice. Before you pick a provider or an on-premises design, check who must be able to touch the environment and how the technical data will be protected in transit and at rest.
GovCloud access depends on people
AWS says GovCloud (US) requires a separate account and credentials, is restricted to customers who are US persons not subject to export restrictions, and is managed by US citizens. That affects who on your team and your subcontractors can hold accounts, administer the environment, or support it. Confirm each named administrator's status against the provider's current terms before you design around GovCloud, and document the result in your SSP.
Microsoft GCC High requires eligibility
Microsoft says its Office 365 GCC High and DoD environments are offered to the US Department of Defense and to contractors holding DoD CUI or subject to ITAR. They are sold through Volume Licensing after an eligibility validation process, and trials are not available. Plan the procurement timeline around that validation, and ask Microsoft or your reseller to confirm your eligibility in writing before you commit to a migration date.
ITAR encryption safe harbor
Under ITAR 22 CFR 120.54(a)(5), sending, taking or storing unclassified technical data is not an export if it is secured with end-to-end encryption using FIPS 140-2 (or successor) compliant modules, or other means of at least AES-128 strength. The data must also not be intentionally sent to or stored in a country proscribed in 22 CFR 126.1. Decide where keys are held and who can access them, because encryption that a foreign-person administrator can decrypt may not meet the test.
Proscribed country storage limits
The ITAR safe harbor fails if the technical data is intentionally sent to or stored in a country proscribed under 22 CFR 126.1, even when the data is encrypted. For a cloud provider, this means confirming the physical regions that will hold backups, replicas, logs and support copies, not only the primary region. Ask the provider to list every region and support location that can hold customer data.
Counsel confirms the ITAR position
Whether a given data set is ITAR-controlled, and whether a hosting design meets the exemption, is a legal determination that depends on the data, the people involved and your export registration. Engage export counsel before you sign a provider contract, and record their conclusions in your scoping documents. Your CMMC assessor will test what you documented, so an unsupported assumption about export status creates scope and contract risk.
Provider terms need written confirmation
Eligibility rules, US-person requirements and data handling commitments can change, and a sales statement is not the same as a contract term. Ask each provider for written confirmation of who may administer the environment, where data and support access occur, and which documents you can give an assessor. Keep those confirmations with your SSP and customer responsibility matrix so the scope you describe matches what the provider has promised.
What a CMMC cloud or on-premises environment costs and who gets paid
This table compares the main cost components of a CMMC environment, who gets paid for each, whether the cost is one-time or recurring, and what drives it up or down. Use it to build a quote request that separates assessor fees from preparation work and platform spend. The main takeaway is that scope size, meaning the systems and networks in the assessment boundary, drives most of the cost, and the 2024 final rule notes that network size and complexity affect assessment costs.
| Cost component | Who is paid | One-time or recurring | What drives it, and what to ask for in a quote |
|---|---|---|---|
| Certification assessor | C3PAO for Level 2 certification, or DoD assessor for Level 3 | One-time per assessment, repeated on the assessment cycle | Size and complexity of the network in scope. Ask the assessor how it estimates scope, what evidence it samples, and what it charges for re-assessment. |
| Implementation partner | Firm that prepares systems, configurations, SSP and evidence | One-time build, plus recurring support if retained | Number of enclaves, endpoints and boundary devices to configure. Ask for a fixed-scope written deliverable list and who owns the final SSP. |
| Cloud, hardware and licensing | Cloud provider, Microsoft licensing channel, or hardware and software vendors | Mostly recurring (subscriptions, compute, storage, backup); hardware is one-time | Seat count, data volume, retention periods and redundancy. Ask which licenses include FIPS-validated encryption and which are separate SKUs. |
| Internal staff time | Your own employees (no outside payee, but a real cost) | Recurring, including audit preparation and evidence upkeep | Number of administrators, change volume and log review load. Ask your partner to list the recurring tasks you must own after handover. |
| Managed service or ESP | MSP or external service provider that operates part of the environment | Recurring service fee | Which controls the provider covers versus which stay with you. Ask for a customer responsibility matrix and confirm it is referenced in your SSP. |
| Scope reduction work | Partner or internal engineers who isolate CUI systems | One-time, with ongoing change control | Segmentation, separate security domains and removing non-CUI systems from the boundary. Ask how the design reduces the number of assessed systems. |
How to decide between cloud, on-premises and hybrid
This sequence turns a vague question about where to run CUI into a documented boundary that your SSP, your provider responsibilities and your assessor can all agree on before you commit budget. Each phase produces an artifact you can check.
Map every system and person that touches CUI
Start with the data, not the platform. Your team lists each place CUI is created, received, processed, stored or transmitted, plus every user, administrator, service account and connected system that reaches it. Include email, collaboration tools, endpoints, backups, ticketing and any managed service. The output is a data flow diagram and an asset inventory tied to named owners. You know this step is done when every CUI path on the diagram has a system, a person and a boundary attached to it.
Decide where CUI is processed and stored
Using the map, decide which environments will hold CUI and which will only see it briefly or not at all. Options include a cloud enclave, an on-premises environment or a hybrid where some components stay local and others run in a provider's environment. Keep the set of CUI-bearing components as small as the business allows, because every one of them comes into scope. The output is a short written decision record that names each component and its location. Confirm the choice with leadership before any provider is shortlisted.
Check FedRAMP, DoD equivalency, ITAR and US-person needs
For every cloud or external service in the decision record, check its authorization status on the FedRAMP Marketplace or its documented DoD equivalency. Under the CMMC rule, a cloud offering used for CUI at Level 2 must be FedRAMP Authorized at the Moderate baseline or higher, or meet equivalent requirements under DoD policy. Also check whether your data is ITAR-controlled and whether the provider's support or administrative access is limited to US persons. The output is a compliance matrix per service showing the authorization, the evidence you hold and any gaps. Ask the provider to confirm each entry in writing.
Choose isolation and VDI options
Decide how to limit the number of systems in scope. Options include a separate security domain with subnetworks, firewalls, information flow controls and physical or logical separation, as NIST SP 800-171 Rev. 3 describes for designated CUI components. Where users only need to view a remote desktop, VDI can keep CUI off the endpoint. The rule treats an endpoint running a VDI client that passes nothing beyond keyboard, video and mouse traffic as out of scope at each level. The output is a boundary diagram with every in-scope and out-of-scope component labeled. Confirm the VDI arrangement against the rule text with your assessor before relying on it.
Document the SSP and responsibility matrices
Write the system security plan to cover your in-scope environment, including any external service provider you use. Record each provider's use and services in your SSP, and obtain the provider's service description and customer responsibility matrix. Map each Level 2 requirement to the party that implements it, and mark any requirement that stays with you even when a provider runs the platform. Your own on-premises infrastructure that connects to a cloud or service provider stays in scope either way. The output is a current SSP and a responsibility matrix that you have reconciled line by line. Verify that every responsibility assigned to you has an owner and a piece of evidence.
Confirm scope with the assessor before buying
Before you sign provider contracts or buy hardware, walk the boundary diagram, the decision record and the SSP through with your assessor or the relevant assessment body. Ask how the assessor will treat each provider, the VDI arrangement and any shared infrastructure. The size and complexity of the network in scope affects assessment cost, so an accurate boundary is also your cheapest way to control price. The output is written confirmation or a list of open questions with dates for resolution. Note that the Department of War suspended CMMC Phase II on 13 July 2026, and a 60-day review by a CMMC Reform Task Force began that day, so confirm which requirements currently apply to your contracts before you commit spending.
Common questions about cloud or on-premises CUI environments for CMMC
Does using a FedRAMP authorized cloud remove my CMMC controls?
No. A FedRAMP Moderate or higher cloud offering can be used for CUI at Level 2, but the provider only covers the controls it owns. Your organization still owns its controls, its system security plan and the customer responsibility matrix that splits duties between you and the provider. Under 32 CFR 170.16(c) and 170.17(c), your own on-premises infrastructure that connects to the cloud stays in your assessment scope, and the provider's services must be documented in your SSP. Ask the provider for its customer responsibility matrix early, then map each line to a requirement in your environment. Before relying on any authorization, confirm its status on the FedRAMP Marketplace yourself.
Is an on-premises CUI environment cheaper than a cloud enclave for CMMC?
It depends on scope size and staffing, not on the deployment model alone. The 2024 final rule says the size and complexity of the network in assessment scope affects assessment costs, so a small, tightly bounded enclave is usually cheaper to assess than a broad internal network. On-premises costs include hardware, facilities, physical protection, patching labor and staff time for logging, backups and key management. A cloud enclave shifts some of that to a subscription, but it still needs your configuration, identity and monitoring work. Ask any quote to separate one-time build costs from recurring operations and to show how each option changes the number of in-scope assets.
Does a company that only handles ITAR data have to use AWS GovCloud?
Not necessarily. ITAR and CMMC are separate obligations, and ITAR does not require a specific hosting provider in every case. Under 22 CFR 120.54(a)(5), storing or sending unclassified technical data is not an export when it is protected with end-to-end encryption using FIPS 140-2 (or successor) compliant modules or AES-128 strength, and it is not sent to or stored in a proscribed country. Providers such as AWS GovCloud (US) restrict access to US persons, which may matter for your staff and for support access. Confirm eligibility and the encryption and access conditions with your export counsel and the provider before choosing a platform.
Can our internal team prepare for CMMC without outside help?
Yes, an internal team can prepare systems, controls and evidence, and many organizations do much of that work in-house. What they cannot do is issue the assessment result. Level 2 certification assessments are performed by C3PAOs authorized or accredited by the CMMC Accreditation Body, and self-assessments are performed by the organization itself under the rule. Preparation work that an implementation partner can take on includes building the environment, hardening it, producing evidence and documenting the SSP. Independent assessors remain responsible for the findings. Decide early which parts your staff will own and which will be contracted on a fixed-scope basis.
How long does it take to set up a compliant CUI environment?
The timing depends on the environment you choose, how much of it already exists, and the assessment schedule your contracts require. Build time generally grows with scope, the number of in-scope systems, identity integration and the amount of evidence you need to collect. Because CMMC requirements are changing, confirm the current assessment timing with your contracting officer and the current DoW CIO guidance before you set milestones. A written, fixed-scope plan with agreed deliverables gives you a clearer timeline than a general estimate. Ask any provider to show its assumptions about your environment.
What do we need to provide before an engagement can start?
A useful scoping discussion needs a clear picture of where CUI lives today. Prepare an inventory of systems, users, data flows, external service providers and their FedRAMP status, and the boundaries you want to draw. Identify your existing identity provider, network layout, endpoint types and any OT or test equipment that touches CUI. Name the people who will own decisions and approve evidence, and gather current policies and the draft SSP if one exists. DeployOpen plans, implements and documents self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks, and scopes each engagement in writing before work starts. It does not issue audit reports or certifications.
What usually inflates scope and delays the environment
Most delays in a CMMC environment trace back to a small set of scoping decisions made early, often before anyone has asked the assessor how the boundary will be judged. The cards below cover the mistakes that pull more systems into assessment, add cost, and push back the date a CUI environment is ready for review.
Unmapped systems that drag into scope
Any system that stores, processes or transmits CUI, or that provides security protection for those systems, sits inside the assessment boundary. Teams often discover late that a file share, an identity connector, a backup server or a ticketing tool holds CUI or can reach it. Build a data flow diagram that traces where CUI enters, moves and rests, then list every component along the path before choosing the environment. Ask the assessor to confirm how they will treat adjacent systems that are not part of the enclave.
External providers without a responsibility matrix
A non-cloud External Service Provider (ESP) whose services touch CUI must be documented in your System Security Plan, and its service description and customer responsibility matrix must show which Level 2 requirements the provider covers and which remain yours. Many contractors sign with a managed service provider that cannot produce this matrix, leaving gaps that surface only during assessment. Before signing, request the written responsibility matrix and confirm that each requirement has a named owner and supporting evidence.
Assuming FedRAMP covers the whole boundary
A FedRAMP Moderate or higher authorization applies to the cloud service itself. It does not cover your identity configuration, administrator workstations, the on-premises network that connects to the cloud, or the policies and evidence your organization produces. Treat the cloud provider's authorization as one input to the assessment, then map each Level 2 requirement to either the provider, your organization, or both. Confirm the service appears on the FedRAMP Marketplace at the required baseline before relying on it.
CUI on a shared network without isolation
When CUI systems sit on the same flat network as general business applications, the whole network can fall into scope. Isolation options include a separate security domain with its own subnetworks, firewalls or boundary devices, information flow controls, and physical or logical separation. NIST SP 800-171 Rev. 3 describes this approach for limiting requirement scope, and the same logic applies to Level 2 under Rev. 2. Map the separation before deployment and confirm with the assessor that the design limits what they must test.
Building before confirming scope
Architecture chosen before the scope is agreed often has to be rebuilt, which costs time and creates evidence that may need redoing. Scope decisions drive how much infrastructure must be hardened, documented and tested, and the size and complexity of the network in assessment scope affects assessment cost. Write the scope statement, confirm the boundary with the C3PAO or assessor where practical, and only then provision production systems. Ask for the assessor's view in writing so later disputes have a record.
How DeployOpen helps
DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside your own infrastructure, whether that is your cloud accounts, your data center or an air-gapped network. For a cloud or on-premises CUI environment, that work usually covers the enclave boundary, identity and MFA, logging and time sync, configuration baselines, the separation between CUI and non-CUI systems, and the system security plan that describes how each Level 2 requirement is met. The work runs under a fixed scope agreed in writing before it starts, so you know which systems, deliverables and timelines are included before a dollar is committed.
DeployOpen prepares systems and evidence for assessment, but it does not issue reports, attestations or certificates. Level 2 results come from an independent assessor, and the organization owns its controls and its scoping decisions. A useful first step is to ask a partner to map every system, service and customer responsibility matrix entry that touches CUI, including the on-premises connections that stay in scope with any cloud or external service provider. That map is the input to the scoping and cost decisions on this page, and it should be settled before any hardening work starts.
If you want outside help, ask for a written scope that names the environment boundary, the assessment objectives each deliverable supports, the evidence each control will produce, and who performs each task. Confirm with your assessor and the current CMMC guidance on the Department of War's CIO site which assessment steps apply to your contract in the current period, since the program timeline has changed. DeployOpen can support that preparation and the ongoing testing and upgrades that keep the evidence current, while the final determination stays with the independent assessor.
