Cloud & As-a-Service · Sovereign CMMC & CPCSC Enclaves
Sovereign CMMC and CPCSC Enclaves,
Secure Clouds for Regulated and Defense Data.
Isolated cloud environments in the United States, Canada, the UK and Australia for regulated data that must stay in-country, including CUI and controlled goods. Engineered to support CMMC Level 2, CPCSC Level 2, ITAR and the Controlled Goods Program. Self-managed, co-managed or fully managed, and bring your own licenses.
What Is a Sovereign CMMC and CPCSC Enclave?
A sovereign enclave is a secure, isolated cloud environment where your data, backups, logs and administration stay in one country, under that country's laws. For defense suppliers, the same enclave becomes the place where controlled unclassified information (CUI) and controlled goods data are stored and worked on. Users connect through secure virtual desktops, so data stays inside the boundary and endpoints are access devices only. Moving CUI into an enclave limits your assessment scope to the enclave instead of your whole company.
Enclaves are hosted on infrastructure aligned with ISO 27001, 27017 and 27018, SOC 2 Type II and SOC 1 Type II. They are engineered to support CMMC Level 2 and CPCSC Level 2 controls based on NIST SP 800-171 and ITSP.10.171, ITAR, the Controlled Goods Program and, when deployed on Government of Canada-authorized infrastructure, GC Protected B.
Enclaves at a Glance
4countries: the U.S., Canada, the UK and Australia
110NIST SP 800-171 Rev 2 requirements at CMMC Level 2
0CUI stored on user devices
4–8 weekstypical onboarding
Certification is awarded to your organization by an assessor, not to a product. Protected B suitability depends on deployment on GC-authorized infrastructure. Timelines vary with scope.
What's Included
The environment, the controls and the evidence, in every delivery model.
In-country residency
Data, backups, DR copies and logs stay in the country you choose.
Isolated environment
Segregated multi-tenant or dedicated single-tenant, with hypervisor-level isolation, segmented networks and AES-256 encryption.
Secure virtual desktops
Desktops inside the enclave, including GPU options for CAD and engineering tools. VDI licensing included.
Access controls
MFA, role-based access control, identity segmentation and device checks.
Audit evidence
Full logging, SIEM integration and documentation to support your assessment.
Secure collaboration
Share CUI with primes, subcontractors and partners inside the enclave, supported by personnel with security clearances.
Choose How Your Cloud Is Run
Same secure platform, four ways to run it. Mix models across workloads.
| Self-managed | Co-managed | Fully managed | Dedicated | |
|---|---|---|---|---|
| Tenancy | Segregated multi-tenant | Segregated multi-tenant | Segregated multi-tenant | Single-tenant, isolated hardware |
| Who runs day-to-day | Your IT team | Shared: your team and Altanora | Altanora | Altanora or shared, your choice |
| Platform, security and patching | Altanora | Altanora | Altanora | Altanora |
| Licensing | VDI licensing included; bring your own Microsoft 365, Adobe and app licenses | VDI licensing included; bring your own app licenses | VDI licensing included; bring your own app licenses | VDI licensing included; bring your own app licenses |
| Best for | Cost-conscious teams with in-house skills | Teams that want to keep control with expert backup | Organizations that want it handled end to end | Enterprise, defense and regulated workloads |
Support is 8x5 as standard, with 24x7 premium support available. Minimum of 5 users for desktop services.
Everything as a Service, Inside the Boundary
Pick the services you need. Each one stays in the same sovereign environment.
Infrastructure as a Service
Sovereign virtual servers and storage, with IaaS or dedicated bare metal.
Desktop as a Service
Secure virtual desktops and apps inside the boundary, so data never lands on devices. Hosted DaaS.
Backup as a Service
Encrypted, immutable backups kept in-country. BaaS.
Disaster Recovery as a Service
Replication and tested failover inside the same jurisdiction. DRaaS.
Monitoring and SIEM
24x7 monitoring, full audit logging and SIEM integration.
Sovereign AI and GPU
Private AI and LLM workloads and GPU desktops, with data, prompts and outputs kept in-country.
How Enclave Onboarding Works
A typical path from scoping to operations.
Scope
Identify regulated data and CUI flows and define the enclave boundary.
Build
Deploy the enclave, desktops, identity, logging and backup.
Migrate
Move data, apps and users into the enclave, with Microsoft 365 integration.
Operate
Run, monitor and maintain evidence for your assessor.
From Our Clients
“Every interaction with Altanora has consistently exceeded my expectations. Their deep technical expertise, combined with a comprehensive understanding of our business challenges, allows them to deliver practical solutions and reliably meet their commitments.”Frederic St-Jean, Director of Information Technology
Why Altanora for Sovereign CMMC and CPCSC Enclaves
Founded in 2006, Altanora designs, hosts and manages secure clouds for 250+ clients, from offices in Fort Lauderdale and Montreal, with data centers in the United States, Canada, the UK and Australia.
Your choice of model
Self-managed, co-managed, fully managed or dedicated, mixed across workloads.
Defense-ready
Enclaves designed for U.S. and Canadian defense supply chains, with assessment-ready evidence for ITAR, Controlled Goods, CMMC and CPCSC.
Bring your own licenses
Keep your Microsoft 365, Adobe and engineering application licenses; VDI licensing is included.
Sovereign CMMC & CPCSC Enclaves FAQ
What is a sovereign enclave?
A secure, isolated cloud environment where data, backups, logs and administration stay in one country, under that country's laws.
What is a CMMC enclave?
An isolated cloud environment where CUI is stored and processed, so your CMMC assessment scope is limited to the enclave.
Does the enclave make us CMMC compliant?
CMMC certification is awarded to your organization by an assessor, not to a product. Altanora enclaves are engineered to support CMMC Level 2 and CPCSC Level 2 controls.
What is CPCSC?
The Canadian Program for Cyber Security Certification, based on ITSP.10.171, which aligns with NIST SP 800-171.
Do you support ITAR and the Controlled Goods Program?
Yes. Enclaves are engineered to support ITAR and Controlled Goods Program requirements, with cleared support personnel.
Where are the enclaves hosted?
In the United States, Canada, the United Kingdom and Australia. CMMC and CPCSC enclaves are hosted in the United States or Canada. You choose the country, and your data stays there.
What delivery models are available?
Self-managed, where your team runs day-to-day operations; co-managed, where we share the work; fully managed, where Altanora runs it end to end; and dedicated single-tenant environments for enterprise and defense workloads.
Can we bring our own licenses?
Yes. Bring your own Microsoft 365, Adobe and engineering application licenses. VDI licensing is included in the per-instance price.
How long does onboarding take?
Typically 4 to 8 weeks, depending on scope and the number of users.
Can we run AI in a sovereign enclave?
Yes. Private AI and LLM workloads, including GPU, can run inside the enclave, with data, prompts and outputs kept in-country.
What is the status of CMMC in 2026?
CMMC Phase 1 self-assessments began in November 2025. In July 2026 the planned Phase 2 certification requirements were suspended pending a review, but DFARS 252.204-7012 and NIST SP 800-171 still apply.
What is the minimum size?
Desktop services start at 5 users. Infrastructure, backup and DR services are sized to your workloads.
Keep Regulated Data In-Country
Scope a sovereign CMMC and CPCSC enclave that fits how your team wants to run it.
Plan My Enclave