Managed CUI Enclave for NIST SP 800-171 and CMMC
SENTRE (Secure Enterprise Resource) is a dedicated, fully managed CUI enclave: a server stack you own, managed by ITG and built on the environment a C3PAO assessed at 110 of 110 NIST SP 800-171 requirements.
A federal IT integrator since 1984, with independently assessed security and quality systems
CMMC Final Level 2 (C3PAO)
ISO 9001 · 27001 · 20000-1
CMMI-DEV & SVC ML3
Cyber AB RPO
What is SENTRE?
SENTRE, the Secure Enterprise Resource, is a dedicated, fully managed CUI enclave built by ITG. ITG installs it, trains your team and manages it; your team does its CUI work inside it. It gives defense contractors one boundary for CUI, the information DFARS 252.204-7012 requires you to protect under NIST SP 800-171 Rev 2.
Instead of rebuilding your whole network to NIST SP 800-171, you move CUI work into a dedicated CMMC enclave. The contracts, files and people that touch CUI work inside it, while the rest of your business keeps its current systems and stays outside assessment scope.
1
A dedicated server stack you own: your hardware, your software licenses, your CUI.
2
SSP, POA&M, policies and procedures that have already been through a C3PAO assessment, adapted to you.
3
Work instructions for handling CUI across awards, orders, supply chain, invoicing and project delivery.
4
Managed by ITG: maintenance, change management and service desk support, in ITG’s secure facility or your own secure room.
How does SENTRE meet NIST SP 800-171 and CMMC requirements?
CMMC compliance requirements rest on NIST SP 800-171 Rev 2. SENTRE implements the 110 NIST controls inside the enclave; the Shared Responsibility Matrix shows which requirements ITG, your team or both are responsible for.
- FIPS-validated cryptography protecting CUI
- Multi-factor authentication for privileged and network access
- Threat detection that alerts your administrator to attacks and unauthorized use
- Centralized logging, monitoring and evidence collection built into daily operations
- Media protection, backup and recovery with documented procedures
Proven on ourselves first
ITG built SENTRE for its own federal contracts: more than 10 months, 4 dedicated IT and business consultants and 5 part-time staff, ending in CMMC Final Level 2 (C3PAO), 110 of 110 requirements, enterprise scope, assessed December 16, 2025.
We did the long build once, so yours starts from a working, documented enclave, not from a binder of templates. Yours is built from the same assessed design, documentation and operating model. Read the customer-zero case study →
110/110
NIST SP 800-171 requirements met
Dec 2025
Independent C3PAO assessment
1984
Federal IT integrator since
What comes with a managed SENTRE enclave?
The enclave arrives with ITG’s managed services: a review of how it fits your operations, documentation that stays current, and a path to whatever assessment your contracts require next.
Fit and Integration Review
- Discovery maps your CUI contracts, systems and processes to SENTRE
- Recommends where your enclave should sit: ITG’s facility or yours
Documentation and Evidence
- SSP, POA&M, policies and procedures kept current with the enclave
- Evidence produced by daily operations, organized for a DCMA or voluntary C3PAO assessment
Ready for What Comes Next
- Built on an environment that has already passed a C3PAO assessment
- One environment for Level 2 (Self) today or a third-party assessment if a prime or DoW (DoD) asks
Why does NIST SP 800-171 still matter if CMMC is changing?
In 2026 the Department of War suspended CMMC Phase 2 and began removing or revising CMMC requirements in its contracts. What changed is how compliance is checked, not what you must protect.
The baseline has not moved
DoW (DoD) is removing or revising CMMC requirements in its contracts; NIST SP 800-171 Rev 2 under DFARS 7012 remains the baseline. DCMA can still assess you. CMMC status →
What you represent is a legal statement
Every offer under DFARS 7012 represents that you implement NIST SP 800-171. If that overstates what is in place, the False Claims Act can reach any contract that requires you to protect CUI. False Claims Act risk →
Your SPRS score has to hold up
Where a contract requires CMMC Level 2 (Self), an official affirms your Supplier Performance Risk System (SPRS) score each year, and DCMA results outrank it. SPRS score guide →
How do SENTRE and CENTRE work together?
SENTRE is the enclave that contains and processes CUI. CENTRE, ITG’s Common Enterprise Resource, is the system of record your team uses for contracts, orders, supply chain and service requests.
CENTRE
Common Enterprise Resource
Contracts, supply chain, ITSM, records
SENTRE
Secure Enterprise Resource
CUI enclave, controls, monitoring
CMMC compliance FAQs
Is SENTRE a cloud service?
No. SENTRE is a dedicated server stack you own: your hardware, your software licenses, your CUI. Nothing runs on infrastructure used by other customers, and there is no migration to a government cloud environment. The stack sits in ITG’s secure facility or in your own secure room, and Discovery recommends which.
Does SENTRE make us CMMC certified?
No vendor can do that for you. Your CMMC status comes from your own self-assessment and annual affirmation or, where a contract requires it, your own C3PAO assessment. SENTRE gives you an environment and documentation that have already been through a C3PAO assessment, so your assessment starts from requirements that are implemented and working.
Who manages SENTRE?
ITG does. ITG installs the enclave, trains your people on the work instructions and manages the hardware and software: maintenance, change management and service desk support, with annual control audits and an SSP kept current. Your team does its CUI work inside the enclave, and the Shared Responsibility Matrix lists which requirements each party is responsible for.
Does ITG have access to our CUI?
No. ITG personnel have no access to your CUI. ITG manages the hardware and software, while your data stays on equipment you own, under accounts and permissions your team controls. Managing the enclave does not require ITG to open, read or move your CUI.
What does the Shared Responsibility Matrix show?
It lists the NIST SP 800-171 requirements and who is responsible for each one: ITG, your team, or both. It shows how much of the work ITG carries as part of the managed service, and which requirements stay with your organization, such as how your people handle CUI and who may enter your facilities.
How do we start?
With Discovery, a no-obligation fit and integration review. We map your CUI contracts, systems and processes, show how SENTRE plugs into them and recommend where your enclave should sit. You receive the findings in writing before you decide anything about implementation.
See how SENTRE fits your contracts, systems and processes, and where your enclave should sit. Discovery is a no-obligation fit and integration review.