Published: October 9th, 2026
By Myles Rohleder, CCA, and CCP, Redspin
Introduction
A consistent theme from small Contractors working with the DoD (the Department) is the need to reduce implementation costs when complying with NIST SP 800-171 Rev.2. One of the most effective ways to cut costs while still protecting Controlled Unidentified Information (CUI) is to reduce the scope of your environment. In this post, we cover a few practical ways small businesses in the Defense Industrial Base (DIB) can do exactly that.
There is no “one size fits all” way to reduce scope. Every small business is different and provides a different product or service to the Department. Some are performing data analytics and may need only a small set of individuals to review CUI; others are building complex systems on a shop floor and may need a much wider set of individuals, systems, and processes. Refer to this blog, not as a step-by-step manual, but as a broad catalog, select the strategies that best apply to your environment. We will work through it in four parts: what touches CUI, who touches it, where it lives, and how to segment it once you know the answers to those questions.
Start With: What Devices Touch CUI?
Several types of devices can potentially process, store, or transmit CUI. The key to reducing scope is identifying these devices and determining the necessity of each. Common CUI assets include:
- Laptops and workstations
- Smartphones and smartwatches
- USB and other removable media
- Servers
- Printers
How Can You Reduce the Number of Devices in Scope?
Once you have identified the CUI assets in scope, evaluate the necessity of each device. For example, if your company receives CUI from suppliers through a shared portal and is only responsible for analyzing the data received, you probably do not need printers or USB drives in scope.
This step sounds rudimentary, but many Organizations Seeking Certification (OSCs) overlook it and leave unnecessary devices within scope. From an assessor’s point of view, leaving printers in scope implies that printing CUI is permissible in your environment. An assessor will then expect to see the printer in your network diagram, CUI flow diagram, and asset inventory. They will also expect a baseline configuration and applicable logical and physical security controls for the printer.
By preventing CUI from reaching the printer through logical controls, you can remove a large asset from scope and avoid spending time and resources controlling a device that does not support your business operations.
If you operate a small shop that only receives CUI through a shared portal with a client, you may be able to drastically reduce the number of devices that touch CUI. You may have no need to print CUI or access it on mobile devices. In that scenario, you can logically block laptops and workstations from connecting to office printers. You can also use a Mobile Device Management (MDM) solution to block mobile devices from accessing CUI.
Who Touches CUI?
Knowing who can access CUI in your environment is essential. Most small businesses only have a few key individuals who genuinely need CUI access. Limiting access to those individuals reduces more than headcount, it also reduces the number of devices with access to CUI, the number of people who need CUI training, and the number of individuals whose actions must be tracked and audited.
Small businesses may only have a limited number of contracts that involve CUI. Within your company, you may only need the IT team and a handful of engineers to have access to CUI within your environment. Selecting only a few individuals who work on CUI contracts can reduce the number of Virtual Desktop Infrastructure (VDI) needed for individuals to operate within the CUI environment. In addition to this, you reduce your attack surface and limit the scope of your environment.
Where Is CUI?
A key exercise for reducing implementation costs is mapping where CUI currently resides in your environment, similar to running a budget against your financials. Once you have completed this exercise, you may be able to reduce scope immediately by removing CUI from certain areas and restricting access to only the areas you have deemed safe for it to reside or flow.
Consider a different scenario: you may perform a CUI mapping exercise and determine that once CUI enters your environment, it has the ability to move throughout your company. This includes laptops, four USBs, three printers, four mobile phones, and a file share server. After doing this exercise, you determine that three of the USBs, all the printers, and all the mobile phones are unnecessary for your company’s operations.
“Reducing where your CUI resides and where it transits throughout your environment can drastically reduce the cost of implementing controls around protecting the confidentiality of CUI.”
Segmentation
The exercises above lead to this step. Once you know what devices should interact with CUI, who should access CUI, and where CUI currently resides, you are positioned to drastically reduce the scope of your enclave through segmentation. Segmentation lets any business tighten its environment and reduce the cost of maintaining NIST SP 800-171 compliance. Common approaches include:
- VLAN segmentation – an example of this would be utilizing a jump box to allow authorized users to connect to the CUI enclave. Another option for slightly larger businesses that already have infrastructure is to utilize a dedicated VLAN. Creating a separate VLAN via a layer three switch on the firewall will logically separate the two environments.
- Dedicated VDI – an example of a dedicated VDI would be purchasing three Azure Virtual Desktops (AVDs) within your Microsoft environment for your engineers to utilize when they interact with CUI.
- A separate tenant environment – an example of a separate tenant environment would be standing up a second Microsoft 365 tenant with its own Entra ID, dedicated solely to the individuals and applications that handle CUI. Your corporate tenant keeps its own identities, mailboxes, and SharePoint sites, while the CUI tenant has its own separate identity plane, its own conditional access policies, and no default trust relationship with the corporate side. Engineers who need CUI access get a separate account and log in to the CUI tenant, distinct from their everyday corporate account, so a compromise in one tenant does not automatically expose the other.
Deciding which approach is right for your team is a decision best made internally, considering your existing infrastructure and resources.
We hope this discussion helps as you work to comply with NIST SP 800-171 Rev. 2 while reducing the cost burden on your small business. If you’d like a second set of eyes on where your scope could shrink, Redspin conducts a monthly meeting open to the public, we encourage any small business in the DIB to attend, bring questions about complying with NIST SP 800-171, and walk away with practical next steps for your environment. Register for the next CMMC Connect.