Post 1 of 5 in the “Control Is the Product” series
Your Controlled Unclassified Information does not merely need to be accessible. It needs to remain under your custody, inside an environment you can control, defend, and prove.
That is the difference between access to data and custody of data.
A public-cloud tenancy gives you a contractual right to use infrastructure owned and operated by someone else. A dedicated on-premises or co-located CPE Level 2 gives you a controlled boundary designed specifically for CUI. Control is not a hosting preference. It is the product.
The CMMC Pause Did Not Pause CUI Protection
The CMMC Phase II assessment pause is codified through November 9, 2028. However, the assessment schedule changed; the obligation to protect CUI did not.
Depending on the terms of your contract, DFARS 252.204-7012, NIST SP 800-171 Rev. 2, SPRS reporting, and annual affirmations remain fully in force. The Department of Defense CMMC program information and the applicable NIST SP 800-171 Rev. 2 requirements continue to define the cybersecurity baseline for organizations handling CUI.
The assessment was deferred. Protecting CUI was not.
What “Control Is the Product” Means
When CUI sits in a public cloud, your organization may control identities, applications, and selected configurations. But the cloud provider still controls the underlying facility, hypervisor, administrative plane, hardware lifecycle, service availability, and much of the evidence needed to prove what happened.
That creates a custody gap.
With CPE Level 2, Planet Security creates a clean-slate, dedicated environment with:
- 100% coverage of all 110 CMMC 2.0 Level 2 requirements and 320 assessment objectives
- 900+ security hardening steps
- Deny-by-default network boundaries and purpose-built segmentation
- No public-cloud key custody; encryption keys remain inside the enclave
- Native, ultra-fast file transfers without cloud round-trips
- Resilience against provider, ISP, and public-cloud disruptions
- Managed cybersecurity, network security, and compliance operations
- Yoo-Jin AI monitoring using AI-obfuscated data
- A deployment path measured in 4–8 weeks
- 100% C3PAO success on properly deployed enclaves, according to Planet Security deployment results
The Shared Responsibility Trap: Six Questions Cloud Providers Cannot Fully Answer
Cloud providers use the phrase “shared responsibility” accurately, but organizations often misunderstand what they are still responsible for proving. The provider may secure the cloud; you remain responsible for the custody, configuration, evidence, and contract-specific protection of your CUI.
1. Can You See and Control Provider Administrator Access?
Cloud provider administrators may have privileged access to the infrastructure supporting your tenancy. You may receive assurances, reports, or contractual controls, but you do not own the entire administrative boundary.
CPE answer: Your enclave is a dedicated custody boundary. Administrative access is limited, governed, and operationally accountable within the environment built for your organization.
2. Do You Have Tenancy, or Actual Custody?
A cloud tenant is an account or logical partition. It is not the same as having physical and operational custody of the systems processing your CUI.
CPE answer: CPE Level 2 is designed around custody. Your CUI remains inside a dedicated protected environment instead of being placed into a shared public-cloud operating model.
3. Who Owns the Audit Evidence?
A provider may generate platform-level records, but access, retention, format, and availability of evidence can depend on the service tier and provider policies. When an assessor asks what happened, “the provider has that information” is not a strong answer.
CPE answer: The environment, evidence, and operational responsibility are aligned. Planet Security manages the compliance and monitoring framework so your organization has a defensible path to documentation.
4. What Happens When the Configuration Changes?
A cloud environment can change rapidly through provider updates, service dependencies, identity changes, automated policies, or administrator actions. You may not control every change affecting your CUI boundary.
CPE answer: CPE Level 2 starts with a controlled, clean-slate architecture. The boundary is deliberately designed, documented, and maintained rather than assembled from dozens of changing cloud services.
5. What Is the Blast Radius?
In a multi-tenant platform, isolation is a technical claim you must understand and trust. A vulnerability, outage, or control failure affecting a shared service can create consequences beyond your direct systems.
CPE answer: Deny-by-default segmentation reduces unnecessary exposure. CUI services are separated from general business activity, creating a smaller and more defensible cyber attack surface.
6. How Much Will Consumption Pricing Really Cost?
Cloud usage can expand through storage, bandwidth, backups, security tools, data egress, users, workloads, and retention. The result is cost creep precisely when your organization is scaling operations or responding to cyber threats.
CPE answer: A defined enclave creates predictable scope. CPE Level 2 is designed to cover the required environment, managed security, monitoring, and compliance operations without forcing your CUI program into endless consumption decisions.
Zero Cloud Risk and Zero Public-Cloud Latency
“Zero cloud risk” means your CUI does not depend on public-cloud custody or public-cloud availability to operate.
A local or co-located enclave provides native file transfer performance rather than sending files through repeated cloud round-trips. Large engineering files, drawings, technical data, and controlled documents move inside the protected environment at network speed.
It also means your CUI contract does not automatically pause when a provider, region, ISP, or internet route experiences an outage. Your cyber defense should not disappear because someone else’s service is unavailable.
The architecture is straightforward:
- Keep CUI inside the enclave.
- Place encryption keys inside the enclave.
- Segment the environment with deny-by-default boundaries.
- Provide governed access to authorized users.
- Monitor continuously without exposing client data to generic AI systems.
AI Monitoring Without Giving Big Tech Your CUI
Generic AI tools cannot be trusted with client data simply because they are convenient. Sending CUI, intellectual property, financial information, or personal data into a broad commercial AI workflow can create unacceptable uncertainty around retention, training, sharing, and access.
Yoo-Jin AI takes a different approach. Its monitoring workflows use AI-obfuscated data, allowing world-class security analysis without exposing the underlying client data to the AI engine.
Yoo-Jin AI supports continuous monitoring, threat intelligence, hardening validation, and security operations across the enclave. It helps identify ransomware indicators, phishing infrastructure, malicious activity, and emerging cyber threats while maintaining the custody principle.
The AI works for the enclave. The enclave does not surrender client data to the AI.
Learn more about Yoo-Jin AI.
Common Objections, Answered Directly
“Cloud is cheaper.”
It may appear cheaper at the infrastructure line item. But the total cost includes compliance engineering, evidence collection, data transfer, identity controls, specialized monitoring, provider dependencies, and unpredictable consumption. The least expensive platform is not the least expensive compliance strategy.
“Cloud is more secure.”
A major cloud provider may have excellent security capabilities. That does not mean its default architecture provides your required custody model. Security capability and custody control are different questions.
“We already have Azure.”
Azure may remain useful for general business systems. The question is whether your CUI belongs in a dedicated protected boundary instead of a mixed enterprise tenancy. Use the right environment for the right data.
“Our staff work remotely.”
Remote personnel can access controlled enclave services through governed connectivity and approved devices. The objective is not to place CUI on every endpoint. The objective is to keep the authoritative CUI environment inside the enclave.
“We do not want to manage hardware.”
You do not have to operate the enclave alone. Planet Security provides managed operations, maintenance, security services, monitoring, and compliance support for the protected environment.
“We need to scale.”
A dedicated architecture can scale through planned capacity, users, and connected services without surrendering custody to a public-cloud tenancy. Scale should expand your controlled boundary, not your uncertainty.
Deployment, Scope, and Monthly Coverage
Planet Security can deploy CPE Level 2 in as little as 4 weeks, with an extended 8-week deployment option when your schedule benefits from a slower rollout.
The standard price is $1,299 per month for up to 20 users. That includes the protected infrastructure, managed operations, security maintenance, monitoring, compliance support, segmentation, and CUI-focused services. Choosing an 8-week deployment instead of 4 weeks reduces the monthly price by $100 per month.
The value is not the price. The value is control, continuity, evidence, and peace of mind.
Frequently Asked Questions
What is the main advantage of on-premises or co-located CUI protection?
Custody. You control where the CUI lives, how the boundary is designed, how access is governed, and how the environment is maintained.
Does CPE Level 2 eliminate every cyber threat?
No environment can honestly promise that. However, CPE Level 2 delivers a purpose-built cyber defense architecture with 900+ hardening steps, deny-by-default segmentation, continuous monitoring, and managed security operations.
Does CPE Level 2 cover the full CMMC 2.0 Level 2 scope?
It is designed for 100% coverage of all 110 CMMC requirements and 320 assessment objectives, with more than 900 implementation and hardening steps supporting the environment.
Can CUI remain available if a cloud provider has an outage?
The enclave is designed to resist dependence on public-cloud uptime and provider availability. Your contract does not have to pause because someone else’s cloud service is down.
How does Planet Security use AI safely?
Yoo-Jin AI uses AI-obfuscated data for monitoring and analysis. Generic Big-Tech AI tools cannot be trusted with CUI by default; Yoo-Jin is designed specifically to avoid exposing client data to the AI system.
Control Is the Product
Your CUI is not just another workload. It is contract-sensitive information tied to operational continuity, national security, customer trust, and your organization’s future.
Access is not custody. A cloud tenancy is not control. Convenience is not cyber defense.
Choose an environment where your CUI remains inside a dedicated protected boundary, keys stay inside the enclave, transfers remain fast, and your security posture does not depend on a public provider’s uptime or administrative model.
We welcome a discussion on how we may assist in your CMMC success story!
| planetsecurity.net | 702.634.7233 |  |
|---|