USU protects Controlled Unclassified Information (CUI) in its Research Enclave, a virtual Windows 11 desktop hosted in Azure Government (GCC High). Researchers connect from their own computers, but the CUI never leaves the session, because copying to a local device, printing, removable media, and local saving are disabled by technical control. Most data-centric research fits this arrangement without a college providing dedicated rooms, hardware, or physical-security measures.
Research that requires CUI on paper, on a drive, or inside equipment needs a physical location, which then falls within USU’s CMMC assessment scope. USU does not currently operate such a space. Work through this guide before submitting a proposal, while the scope of the project can still be adjusted. It is a planning aid for principal investigators, research staff, and Office of Research personnel, and does not constitute a compliance determination. Questions can be directed to compliance@usu.edu.
The limits that genuinely rule out the Enclave are physical - CUI on paper, on removable media, inside equipment, or delivered to a sponsor in physical form. Bring us your requirements before you plan around the Enclave: compliance@usu.edu
Where CUI Work Can Happen
Virtual Research Enclave
AVAILABLE NOW
A managed Windows 11 Enterprise desktop session (Azure Virtual Desktop) in the GCC High tenant, running on a dedicated single-session host. Office, Teams, SharePoint and standard research software run inside the session, and no CUI is written to the researcher's own device. A session can also be configured to run Linux through Windows Subsystem for Linux (WSL 2) with Ubuntu LTS; this is arranged by request rather than enabled by default, and has already been done for a research workload in the Enclave.
Suited to: analysis, modeling, writing, coding, Linux-based data processing pipelines where a Linux environment has been arranged, reviewing drawings and specifications, and collaborating on documents.
Not permitted: downloading CUI to a local device, printing, USB or removable media, or connecting the session to lab instruments.
Physical CUI Space
NOT YET OPERATED AT USU
A controlled room in which CUI can exist on paper, on media, or inside equipment, using USU-managed endpoints enrolled in the same GCC High tenant. Such a room would extend the enclave’s authorization boundary; it would not be a separate system.
Needed for: hard-copy CUI, test fixtures, robotics, instruments, embedded devices that must hold CUI, and physical deliverables such as hardware, media, or printed reports returned to a sponsor.
What it requires: badge-controlled entry, a securable and monitored room, visitor escort, locked media storage, and documentation added to the System Security Plan before any CUI arrives. Establishing a space of this kind takes several months.
The distinguishing question is whether CUI can remain on a screen. If all of the CUI can stay inside a remote desktop session, the enclave will fit. If any CUI must exist on paper, on media, or inside equipment, the project requires a physical space, and the Office of Research should be consulted before the proposal is submitted.
What the Enclave Can Provide
Requirements beyond a standard session are considered on request rather than ruled out. What USU can provide depends on the cost being reasonable and the configuration being workable for USU IT and its supporting engineers, so the list below describes what can be arranged, not a fixed menu.
- Compute. Single-session hosts run Windows 11 Enterprise with 16 vCPU and 64 GB of RAM (Azure Standard_D16s_v5). Additional hosts can be added for a project, including a second host for redundancy.
- Linux. A session can be configured with Windows Subsystem for Linux (WSL 2) and Ubuntu LTS. Running containers inside the Ubuntu distribution can also be considered. Both are requested configurations and are subject to software approval.
- Additional software. Applications such as MATLAB can be installed, subject to software approval and a workable license path.
- Storage. Managed disks sized to the project, with 2 TB routine, plus SharePoint and OneDrive in the GCC High tenant.
- Connections to a sponsor's systems. The Enclave can read from and write to sponsor cloud storage, such as a bucket in AWS GovCloud. This requires afirewall rule, written confirmation from the sponsor that the storage sitsinside their assessed CUI boundary, and a data sharing agreement or DFARS flowdown covering the exchange.
- Bringing in existing tools and data. Files cannot be dragged in from Box or a USU computer, and drive and clipboard redirection are disabled. An existing toolchain or dataset is brought in once, through a defined path arranged with USU IT.
- Collaborators. Approved subcontractors and external collaborators can be given Enclave accounts. They complete the same onboarding as USU researchers (account, AUP, CUI training and background check) and connect from their own machine, which never holds the data.
- Cost and timing. Cost is per user, plus Azure compute for any dedicated hosts; the Office of Research can provide figures for a specific configuration. Onboarding and standing up hosts typically takes a few weeks. Connections to external systems and the agreements that go with them take longer and can proceed in parallel.
If a requirement is not listed here, ask anyway. Requirements that cannot be met are usually physical rather than technical, and we would rather review a request than have a project ruled out on an assumption.
Decision Map
1) Does the project involve CUI?
- You’ve identified CUI or equivalent data in the project; or
- You’ve confirmed with the sponsor that the project will actually feature the data.
Yes: Go to question 2
No: Outcome A
2) Will any CUI exist on paper or physical media?
- Hard-copy drawings or specs;
- Sponsor-shipped drives or discs;
- Hardware that arrives with CUI on it; or
- A need to print.
Yes: Go to question 6
No: Go to question 3
3) Must CUI be loaded onto, or produced by, equipment?
- Instruments;
- Test fixtures;
- Robotics;
- Embedded controllers; or
- Portable or field data-collection devices.
Yes: Go to question 6
No: Go to question 4
4) Will you deliver CUI back to the sponsor in physical form?
- Prototype hardware or devices holding CUI;
- Shipped drives or media; or
- Printed reports. Digital delivery from the enclave does not count.
Yes: Go to question 6
No: Go to question 5
5) Does everything the work needs run in a standard Enclave session?
- Office, MATLAB, Python, CAD viewers: usually yes; or
- A Linux environment, macOS-only tools, HPC or GPU jobs, unusually large storage, or dongle-licensed software: flag these. Flagging something here does not rule out the Enclave. It routes you to an accommodation review, where the request is assessed on cost and feasibility.
6) Can the work be restructured so CUI stays digital?
- Sponsor delivers into the enclave;
- Equipment is fed non-CUI or derived inputs;
- Only non-CUI results go to the bench; or
- Deliverables sent digitally.
Yes: Go to question 5
No: Outcome D
What Each Outcome Means
Outcome A. Not an enclave project
There is no CUI clause, no CUI marking, and no DoW or export-controlled technical data involved. Handle the project under USU's normal research-data practices. If the sponsor later adds a DFARS 252.204-7012-type clause, or sends anything marked CUI, return to question 1.
Outcome B. Virtual Research Enclave
All of the CUI is digital and all of the work can be performed in a Windows 11 session. Enclave access is requested by contacting compliance@usu.edu, since the number of seats is limited. Once access is approved, each user completes the Office of Research review, CUI training, and acknowledgment steps described in step 5 of the main page. Onboarding usually takes about two weeks from request to first sign-in, and longer when a background check is not already on file with Human Resources.
Outcome C. Enclave, with an accommodation review
The data fits the enclave, but some piece of software or compute does not run on a standard Windows 11 desktop. Describe what the work requires, including the tool, its license model, the data volume, and whether a GPU or a cluster is involved, and send that description to the Office of Research. The review will accommodate the requirement, defer it, or arrange for the work to be done outside the enclave. A software gap by itself does not create a need for a physical room. Requests of this kind are often met by adding the software or compute to the Enclave, where the cost is reasonable and the configuration is workable for USU IT and its supporting engineers.
Outcome D. A physical CUI space is required
Your project requires a physical CUI-compliant space if the CUI has to exist on paper, on media or inside equipment, or if it has to go back to the sponsor in one of those forms.
USU does not currently operate a physical CUI space. Projects in this position should be discussed with the Office of Research before the proposal is submitted, because the answer affects budget, timeline, and which college hosts the work. Two approaches are available:
- Convert a lab or work area. The room becomes part of USU's CMMC boundary. The Office of Research reviews the space against the physical CUI space checklist, a portion of which is verified by on-site inspection, and the college owns the room-side items.
- Perform the physical portion at the sponsor's facility or a partner's facility under their controls, keeping the data-analysis portion in the enclave, where the award allows it.
Converting a space: what is involved
- Controlled entry by badge reader or formal key control, with access logs retained
- A securable room with a solid door and full-height walls, locked when unattended
- Monitoring by camera, regularly reviewed access logs, or both, including the network closet or rack
- A named roster of who may enter, with visitors signed in and escorted
- Lockable storage for paper and digital media, and CUI markings applied to media
- An approved shredding or wiping path for disposal and reuse
- USU-managed, enclave-enrolled endpoints on an isolated network segment, with no personal or departmental computers
- An approved method for moving CUI to equipment, such as a monitored subnet or a FIPS-validated encrypted drive
- The room, its endpoints, and its equipment documented in the System Security Plan before CUI arrives
In either case, CUI cannot arrive at USU in physical form until the space and its documentation are in place.
Project Compatibility Checklist
Complete the Project Compatibility Checklist PDF and send it to compliance@usu.edu. Each step tells you where to go next, so most projects will not need every step.
What to Have Ready When You Contact the Office of Research
- The award or solicitation language on CUI, and the DFARS clauses it carries
- A description of the data: what it is, where it comes from, and roughly how much there is
- The software list, with anything that is not standard Windows 11 flagged
- Any equipment or instruments that would touch CUI, and where they sit today
- What the sponsor expects back, and in what form: data files, reports, or hardware
- The team roster, with each person's USU appointment. Accounts are normally issued to USU faculty and staff, and subcontractors or external collaborators can also be approved in advance; approved collaborators complete the same onboarding as USU researchers.
- Whether the data is export-controlled, in which case every team member must be a U.S. person
- The expected start date. Enclave onboarding usually takes about two weeks, longer if anyone still needs a background check, and establishing a physical space takes longer
- Any external system the project needs to exchange data with, such as a sponsor's cloud storage, and who operates it.
Questions about this guide, the Research Enclave, or CUI compliance can be directed to compliance@usu.edu.