The Managed CUI Enclave for NIST SP 800-171, Powered by CENTRE
A CMMC enclave is a defined boundary that keeps Controlled Unclassified Information (CUI), and the systems that handle it, apart from the rest of your business. SENTRE is that boundary as a dedicated server stack you own, managed by ITG, in ITG’s secure facility or yours.
What is in the SENTRE enclave?
SENTRE (Secure Enterprise Resource) is a dedicated CUI enclave, fully managed by ITG. It combines a hardened server stack, CUI workstations and boundary hardware you own with documentation that has been through a C3PAO assessment and the work instructions your team follows day to day. It includes the required transaction processing, incident management, endpoint and network security, and communications software, as well as SIEM software.
It is not a software product and not a cloud service. It is a managed solution: the hardware, the documentation, the work instructions, the training and ITG’s managed services, delivered as one assessment-ready environment. You own the hardware and the software licenses, and your CUI stays on the stack.
Inside the boundary, SENTRE implements the 110 security requirements of NIST SP 800-171 Rev 2, the baseline DFARS 252.204-7012 sets for contractors that handle CUI for the Department of War (DoW, also DoD). The contracts, files and people that touch CUI work inside the enclave; the rest of your business keeps its current systems.
SENTRE is the environment ITG built and had assessed for itself: CMMC Final Level 2 (C3PAO), 110 of 110, enterprise scope customer-zero case study →. You start from that environment, adapted to your organization, not from a reference design.
| Architecture | Dedicated enclave (SENTRE) | Cloud enclave | Enterprise-wide |
|---|---|---|---|
| Where CUI lives | A server stack you own, in ITG’s secure facility or your secure room | A provider’s cloud environment | Across the company network |
| Hardware and licenses | Yours | The provider’s | Yours |
| Assessment scope | The enclave and the systems that protect it | The cloud environment plus your endpoints and connections | Every system that touches CUI, often most of the company |
| DFARS 7012 cloud rule | No external cloud provider holds your CUI | Provider must meet FedRAMP Moderate equivalent security | Applies to any cloud service that holds CUI |
| Effect on the rest of the business | Systems outside the boundary stay as they are | CUI work moves into the cloud workspace | Every in-scope system is brought to NIST SP 800-171 |
| Who manages it | ITG, as a managed enclave | The provider, for the platform | Your IT team |
Where does the enclave sit, and who does what?
You choose between two placements: ITG’s secure facility, which is inside the scope of ITG’s own C3PAO assessment, or your own secure room. Discovery recommends one based on your sites, contracts and staff. In both, the stack, the software licenses and the CUI are yours, and ITG manages the enclave.
ITG installs and configures the enclave in five phases, trains your team on the work instructions, then manages it: maintenance, change management and service desk support for the hardware and software. The Shared Responsibility Matrix lists each NIST SP 800-171 requirement and whether ITG, your team or both are responsible for it.
Your team does its CUI work inside the enclave, with CENTRE as the system of record. ITG personnel have no access to your CUI: managing the hardware and software does not require ITG to open, read or move it.
What does SENTRE include?
From day one your organization inherits a proven infrastructure stack, a complete documentation set and ITG’s working knowledge of NIST SP 800-171 and CMMC Level 2, so your team focuses on the mission, not on building compliance from scratch.
1
Physical infrastructure: servers, networking, CUI workstations and boundary hardware you own
2
The 110 NIST SP 800-171 requirements implemented, configured and documented
3
Ongoing managed services: maintenance, change management and service desk support
4
Assessment support: evidence organized for a DCMA assessment, your affirmation or a voluntary C3PAO assessment
Who is a dedicated CUI enclave for?
SENTRE fits defense contractors and subcontractors that handle CUI on a defined set of contracts and want it inside one boundary they own, without rebuilding the whole company network.
- DoW (DoD) primes and subcontractors with DFARS 7012 in their contracts
- Contractors whose CUI work involves a defined team, not the whole company
- Organizations that prefer to keep CUI off cloud platforms
- Teams that want documentation and work instructions from an assessed environment
What does CENTRE add to the enclave?
CENTRE (Common Enterprise Resource) is ITG’s ERP for federal contracting. In SENTRE it is the system of record that ties business, contractual, IT and security processes to the evidence your assessment needs.
Human Resources
Timesheet entry, approval workflows and labor reporting for CUI-related work, traceable for internal reviews and external audits.
Change Management
Structured approval, impact analysis and traceability for every configuration change, linking each change back to its requirements.
Supply Chain Management
Visibility over purchasing, logistics and inventory: approved vendors, approvals, receipts and movements for CUI-related supply chains.
Contract Management
Sales orders, federal awards, delivery orders and purchase orders in one lifecycle, integrated with purchasing and inventory.
IT Service Management
Incident, event and request records with SLA tracking, for documented resolution of the IT services that support CUI work.
Document & Records Control
A version-controlled repository for your System Security Plan (SSP), policies, procedures and records, linked to the requirements they support. CMMC documentation →
Self-Service ITSM Support 24/7/365
ITG’s service desk portal lets your team open service requests for the SENTRE hardware and software at any time, with or without an equipment serial number, check open requests and verify warranty coverage. Requests are handled by ITG as part of its managed services.
CUI enclave FAQs
What does an enclave take out of scope?
Systems that do not store, process or transmit CUI, and do not provide security for the systems that do, can stay outside the boundary as your scoping documents define it. CUI work moves inside the enclave, and the rest of the business keeps its current systems and stays outside assessment scope.
Can the enclave sit in our own secure room?
Yes. SENTRE can sit in your own secure room or in ITG’s secure facility, which is inside the scope of ITG’s C3PAO assessment. Discovery recommends which, based on your sites, contracts and staff. ITG installs and manages the enclave in both placements, with remote support when it sits in your room.
Who manages the enclave?
ITG does. After implementation ITG manages the enclave’s hardware and software: maintenance, change management, service desk support and annual control audits, with the SSP kept matched to the live environment. Your team does its CUI work inside the enclave, and ITG personnel have no access to your CUI.
Is SENTRE a GCC High alternative?
For contractors who want CUI off cloud platforms, yes. Instead of migrating CUI work to a government cloud environment, it moves into a dedicated stack you own, and the rest of your business keeps its current systems. Discovery shows whether a dedicated enclave fits your contracts and how it connects to your current tools.
Do we need new workstations?
SENTRE includes hardened CUI workstations configured for the enclave, with endpoint protection and encryption. Discovery confirms how many your team needs, who uses them and how they connect to the enclave, so the workstation count follows your actual CUI work rather than a generic estimate.
What happens after go-live?
Your team uses SENTRE for its CUI work with the work instructions ITG trained it on, and CENTRE becomes your system of record. ITG manages the enclave: maintenance, change management, hardware and software troubleshooting, and service requests through the portal. The SSP is kept current as the enclave changes, so your documentation keeps matching the system you run.
Find out where SENTRE would sit in your organization and how it plugs into your systems and processes. Discovery is a no-obligation fit and integration review.