Selected teams
Create a defined environment for the people and systems handling Controlled Unclassified Information (CUI). Set access and data paths around that work.
CMMC for manufacturers
Your defense operations. One platform.
SecureEnclave™ brings supported business and engineering applications, AI resources, manufacturing systems, CMMC/NIST security controls & technical evidence, and automated snapshot/recovery into one customer-controlled environment.
Configure it for selected teams, subcontractor enclaves, or your entire defense organization across IT and OT.
- Scope that fits
- Local operation
- Integrated safeguards
Deployment scope
Right-sized for your defense business.
A solution for every size. An enclave for a sub-set of users from one to many, multi-enclave subcontractor environments, or the whole company.
Subcontractor enclaves
Configure separate subcontractor environments with defined access, information exchange, and operating responsibilities for each organization.
The entire organization
Bring a defense-focused company's supported IT and operational technology (OT) into one platform, with internal boundaries designed around the business.
Each deployment qualifies the applications, equipment, segmentation, capacity, and responsibilities for its chosen scope.
Engineering, office, and production
Retain control of your factory and business.
SecureEnclave™ creates a brand new network, seamlessly integrating your existing business operations, engineering and manufacturing equipment, and the services they need for you to operate under the CMMC program.
Their identities, data paths, safeguards, evidence gathering, and recovery dependencies are maintained as part of the same environment.
Business and engineering
Run approved engineering, email, file collaboration, and business applications within your defined boundary.
Production and inspection
Integrate supported manufacturing systems, connected devices, and inspection or test equipment. Qualify the interfaces and operating constraints for the work.
Shared services and safeguards
Connect those systems with identity, access controls, storage, logging, and security services as part of the same operating design.
Local infrastructure
Keep operations under your control.
Run supported workloads at your facility without a required internet connection.
Define approved paths for data exchange, updates, administration, and support. Validate application dependencies and procedures for connected, intermittent, or disconnected use.
Compare complete environments and costsSet the access rules.
Define who can administer systems, handle data, authorize connections, and provide support. Customer control is made concrete through those permissions and responsibilities.
Manage the environment together.
SecureEnclave™ deploys and maintains supported applications and their required services from a shared environment definition. Identity, storage, and safeguards remain connected to the systems that depend on them.
Operating model
See how it fits together.
Applications and production systems share a defined environment. Approved connections and human responsibilities remain explicit.
Approved connections
Transfer, administration, and supportPaths defined for the deployment.
SecureEnclave™
Customer-controlled boundaryBusiness and engineering applications
Approved collaboration, design, and work instructions.
Supported production systems
Selected manufacturing, inspection, and test systems.
Shared services
- Identity and access
- Security services
- Storage and data paths
Operational evidence
Configured telemetry and technical checks tied to managed state.
Scoped recovery
Coordinated snapshots and known-state restoration for supported components.
Read the SecureEnclave™ architecture
The managed definition connects each selected application or system to its required services and dependencies. Approved changes carry that definition forward, while configured technical evidence remains tied to managed-system state.
The design separately identifies the assessment scope and any external systems. A connection in this example does not establish support for a particular application, machine, or interface.
Configuration and responsibilities
Review the deployment details.
Explore how SecureEnclave™ supports daily operations and assessment preparation, and what the selected deployment needs to establish.
Safeguards and validated cryptography
A selected configuration can include boundary firewalls, MFA, SIEM, centralized logging, identity, certificate and trust services, monitoring, backup, recovery, and mapped operating procedures.
Supported configurations can incorporate specific FIPS 140-2 or FIPS 140-3 validated cryptographic modules in their approved modes and operational environments. FIPS validation applies to the named module, approved mode, and operational environment.
Technical evidence tied to operations
See the configuration behind the evidence. SecureEnclave™ maintains desired and observed state for managed infrastructure, identities, certificates, applications, and configurations. Configured security and operational telemetry flows to its SIEM for analysis and audit support.
- Connect technical checks and artifacts to the environment being reviewed
- Keep evidence sources, timestamps, configuration context, and exceptions reviewable
- Preserve the requested and observed state as supported changes follow approval rules
Recovery scope and validation
SecureEnclave™ can capture coordinated snapshots and restore supported components to a selected known state. The deployment defines what is captured, how consistency is handled, how keys and credentials are protected, what restores first, and how recovery is tested.
- Validate restoration against the selected data and business-service requirements
- Test identity, networking, security services, applications, storage, and workflow dependencies
- Set and validate recovery objectives, approvals, and operator responsibilities
Connectivity, access, and system fit
The design identifies supported applications, equipment, interfaces, capacity, and the physical, logical, identity, and administrative boundaries. It defines which transfer, update, support, and management paths may be enabled, restricted, monitored, or physically disconnected.
For subcontractor enclaves, define permitted exchanges and each organization's responsibilities. Assessment scope and obligations are established for each organization.
Validate application dependencies and transfer, update, reconnection, and support procedures for the chosen operating mode.
Policies, procedures, and assessment
A SecureEnclave™ engagement can include mapped operational and managerial policies and procedures intended to support applicable CMMC Level 2 and NIST SP 800-171 Revision 2 implementation requirements.
Accountability stays human. People authorize access and change, approve policy, handle exceptions and incidents, manage personnel and physical security, accept risk, and make truthful affirmations. Technical evidence supports examination and testing; the applicable assessor determines the assessment result.
Read the CMMC requirements contextOptional private AI
Storm AI Factory™ can run inside the managed boundary when an AI workload belongs in CMMC assessment scope. Otherwise, SecureEnclave™ can connect to AI Factory on another NetThunder platform through an explicitly approved integration path.
The selected configuration qualifies models, capacity, data paths, connectivity, tools, permissions, and operating responsibilities. Define which actions require approval and how model provenance, evaluation, and rollback are governed.
Explore AI Factory deployment optionsManufacturing project context
MxD project 23-11-03
Cybersecure Enclave Infrastructure as Code
MxD named NetThunder as the project team for work focused on simplifying secure-environment provisioning, deployment, and maintenance for small and midsized manufacturers supporting DoD production.
- Project team
- NetThunder
- Manufacturing focus
- Small and midsized manufacturers supporting DoD production
- Project objective
- Simplify secure-environment provisioning, deployment, and maintenance
Architecture review
Bring your operating requirements.
Start with the people, applications, and production systems that handle your defense work. Together, we can define the scope, qualify system fit, and identify the deployment and support responsibilities.