Once you know what is in scope, the next decision is where it lives. The boundary model you choose determines how much you build, how much you inherit from a provider, and how much of the 110 controls you are on the hook for yourself. There are three common patterns. None is universally right.
The three models
Government-cloud productivity (e.g., a GovCloud-tier Microsoft tenant). You move CUI handling — email, documents, collaboration — into a cloud environment built for it. The provider's certifications let you inherit a meaningful share of controls, which shrinks what you have to implement and document. The trade-offs are licensing cost, migration effort, and operating inside a more constrained environment than your team may be used to.
On-premises enclave. You build a segmented environment in your own facility — your hardware, your network boundary, your controls. You keep full control and avoid per-seat cloud licensing, but you inherit nothing: every control is yours to implement, monitor, and prove. This can suit shops with strong existing IT and a small, stable set of CUI users.
Hybrid. A government-cloud tenant for productivity and collaboration, with an on-prem or specialized segment for the things that cannot move — a CNC controller, a CAD workstation tied to licensed hardware, a lab system. Most manufacturers land here, because the shop floor rarely fits neatly into a cloud.
How to actually choose
Skip the brand debate and answer four questions:
- Where does CUI need to be used, not just stored? Engineering workstations and machine controllers anchor part of your boundary in the physical world whether you like it or not.
- How many people truly need access? Cloud licensing scales with seats; keep the access list honest and the math changes.
- What can you realistically operate? Inherited controls are only a saving if you would otherwise have to run them yourself — and only if you actually configure the environment correctly. Inheritance is not automatic.
- What is your timeline? Migrations take longer than vendors promise. Building an on-prem enclave well takes longer than that.
Inheritance is earned, not granted
The most common misconception is that moving to a government cloud "handles compliance." It does not. It lets you inherit certain controls — but only if your tenant is configured to the right baseline, your identity and access are set up correctly, and you can produce evidence that the inherited controls are actually in force for your environment. A misconfigured government-cloud tenant can score worse than a well-run on-prem enclave.
This is exactly the kind of decision where the right delivery partner matters — an enclave architect or a managed security provider who builds these boundaries for a living. Choosing and standing one up well is specialized work, and it is worth matching the build to a partner who does it every day rather than learning on your own environment.
Weighing the options for your shop? A discovery call is the fastest way to a clear recommendation. Let's talk.