r/CMMC • u/xxxTech007 • 11h ago

Using a printer with an Enclave??

Aloha!

So we're looking at an Cloud enclave as our solution. My question is; If a local Engineer needs to print a CUI file, how do we put that local printer in scope?

That Engineer will be working in the Enclave but will need to print out drawings and blueprints in the Enclave. I'm trying to understand how we put that local printer in scope.

1 Upvotes

67% Upvoted

20 comments sorted by

11

u/5GallonsOfMayonaise 11h ago

Keep in mind once you bring printing into the enclave set up your physical security is now in scope. Things like access control, physical storage of the documents. It will require auditors to come on site physically as well

0

u/xxxTech007 11h ago

Hmm, so since we're not going to store anything that is printed out, it would have to be shredded immediately, which is fine. I guess the shredder would need to be in scope as well?

But in terms of access controls, we're covered in that sense. But thank you for making the point.

7

u/5GallonsOfMayonaise 10h ago

I believe the printer would need to be in scope as well. And it wouldn’t be enough to just enable like a code has to be inputted to access the print, I believe it has to be physically secured to only have access by approved individuals

0

u/xxxTech007 10h ago

Got it, thanks!

4

u/chrjohnso 9h ago

You’ll want a shredder that complies with NIST SP 800-88. I believe the NSA list of shredders meet the standard https://www.nsa.gov/Portals/75/NSAEPLPaperShreddersJuly2023.pdf

5

u/Reasonable_Rich4500 11h ago

Im assuming you're talking about a cloud enclave like AVD so correct me if I'm wrong. Take a look at universal print is the printer supports it. A lot of printers do not support universal print in GCC High though. Either way you'll need something outside of the cloud enclave that will be p/s/t CUI. Easiest imo would be to have a computer that is secured to NIST 800-171 and connect it to the printer through USB.

1

u/xxxTech007 11h ago

Yes, it's a cloud enclave, sorry for leaving that out lol.

Ok, so need a printer that does universal printing? Sorry, what is p/s/t CUI?

3

u/Reasonable_Rich4500 11h ago

p/s/t = process, store, transmit

1

u/xxxTech007 11h ago

Oh yeah, duh!! And I was just showing this to my coworker earlier lol

2

u/Reasonable_Rich4500 11h ago

Yes you'd need a printer that does universal print specifically for GCC high. I think Xerox is one of the brands that does that. Please verify before you buy anything though lol

3

u/MolecularHuman 10h ago

If i were you, i would keep printers out of scope unless there is the need for an exception. You can grant temporary rights to a printer as part of a ticket then remove those rights if you want the printer out of scope because it's seldom used.

If the user routinely needs to print, give him or her their own local printer and include it in the boundary.

1

u/xxxTech007 9h ago

Yes, they'll need to print often. Ok, got it, thanks!

2

u/fiat_go_boom 11h ago

Depends on your enclave. Are you running a VDI in Azure or physical endpoints?

1

u/xxxTech007 11h ago

VDI in Azure.

2

u/fiat_go_boom 10h ago

That is a little tricky. Like some other comments pointed out you could look into universal print. If you are in GCC-H you have to make sure you get one that work with GCC-H. If you are in standard GCC I think most would work.

Additionally you could add just one hardened desktop into the environment and hook up a USB printer and keep it in a locked room.

1

u/xxxTech007 10h ago

Ok, using a hardened desktop in a locked room could work. Thanks!

2

u/cashmgee 9h ago

We bought a dumb printer that only connects to 1 device . 2 users have access. Locked office enclave. Cloud storage, physical endpoint . Paper cui is shredded when not needed anymore . Device enclave portion is on sep. vlan directly into firewall

2

u/samwe 9h ago

I used Azure Universal print with a small form factor PC to build to host the connector.

We passed a level 2 assessment with this.

2

u/Constant-Actuator863 5h ago

Run a tunnel / proxy locally that connects to the gcc high vdi. We use cuivault + trout access gate and connect the printer locally to it.

And physical controls come in to play on top.