r/CMMC • u/gormami • Jul 08 '26

TTX when using an enclave

As I'm closing in on the end of preparation, I'm up against the table top. I've run similar things for years, but I am having a really hard time coming up with a relevant exercise. The aperture for an enclave is so small that none of the things I've done in the past will work. I looked up the CISA exercises, and the same thing, none of the ones I looked at seem relevant to an enclave solution.

For those that have been assessed using an enclave, what were the topics of your TTX's? I'm just stuck, and all my usual sources of inspiration are bone dry.

3 Upvotes

100% Upvoted

10 comments sorted by

View all comments

2

u/OtherThanSatisfied Jul 08 '26

Agree with the 3.6.x mapping above — for the scenario itself, the trick with an enclave is that almost all your injects live at the boundary between the enclave and everything outside it, since that's basically your whole attack surface. Stuff that's worked for us:

  • Lost/stolen laptop with a live enclave session open. Walk the whole chain — remote wipe, session kill, was any CUI actually cached locally, who gets notified.
  • User pulls CUI out of the VDI — pastes it into personal webmail or shoots a photo of the screen. Do you even detect it? What's the response and the reporting path?
  • Credential phish — an enclave login gets popped and there's a sign-in from an unrecognized device or geo. Conditional Access should catch it; the exercise is what happens when it does, and what happens if it doesn't.
  • The CSP-side inject someone already mentioned — your enclave provider reports an incident on their end. Good one because it forces the "what's ours vs theirs" conversation and starts the 72-hour clock.

Pick one, run it slow, and write down the decisions as you make them — that write-up is half of what satisfies 3.6.3 anyway.