Home CUIckStart How it works

CUIckStartAN inDirectIT PRODUCT
CUIckStart · How it works

Four stations. One operated boundary.

CUIckStart runs the same path every time: draw the flow, build the boundary, name the users, hold the evidence. Standard is ready in 60 days; Express is ready in 14. Ready means ready for an assessment or a self-attestation.

The four stations

The path, one station at a time.

01STATION

Draw the flow

Before anything is built, we map where CUI is created, where it is received, where it is stored, and where it is sent. The flow decides what the boundary has to hold, and who needs to be inside it.

CreatedReceivedStoredSent
02STATION

Build the boundary

The enclave is built on Microsoft 365 GCC High. Identity, mail, files, and logging are designed for the box from the start, rather than retrofitted from the rest of the business.

GCC HighIdentityMailFilesLogging
03STATION

Name the users

Only the people who handle CUI are onboarded, each with a named identity and access. You decide who is allowed to handle CUI; we build and operate their access inside the boundary.

Named identitiesAccessSeats
04STATION

Hold the evidence

The SSP and the remaining customer work are kept current, so the boundary stays ready for an assessment or a self-attestation instead of drifting after go-live.

SSPRemaining customer workKept current
The boundary

One box. Named people inside. One managed edge.

Everything that touches CUI sits inside one enclave on GCC High. Everything else stays where it is, out of the assessment scope. The edge of the box is the part inDirectIT operates.

The CUIckStart boundary An enclave box on Microsoft 365 GCC High holds the four workloads and the named users who handle CUI. The corporate network, your MSP or IT, the shop floor, and systems that never see CUI sit outside the box. One managed edge, highlighted in cyan, is operated by inDirectIT. YOUR BUSINESS Corporate networkEmail, files, and apps thatnever see CUI Your MSP or ITKeeps running the corporatenetwork, as today Shop floorStays outside theboundary OUTSIDE THE BOUNDARY OUT OF ASSESSMENT SCOPE CUIckStart ENCLAVE Microsoft 365 GCC High Teams Exchange SharePoint OneDrive NAMED USERS · CUI HANDLERS ONLY Contracts Engineering Program Quality Named identities and access · encrypted mail and files Retention · logging and backup by design THE MANAGED EDGE Operated by inDirectIT One boundary, run as a service, kept current Never sees CUISystems that stay outof the enclave Policy & physicalSecurity and policiesoutside the enclave The CUIckStart boundary The enclave on Microsoft 365 GCC High holds the four workloads and the named users who handle CUI; one managed edge is operated by inDirectIT. The corporate network, your MSP or IT, the shop floor, and systems that never see CUI stay outside. THE MANAGED EDGE Operated by inDirectIT CUIckStart ENCLAVE Microsoft 365 GCC High Teams Exchange SharePoint OneDrive NAMED USERS ONLY Contracts Engineering Program Quality Named identities · encrypted mail and files · retention Logging and backup by design OUTSIDE · OUT OF SCOPE Corporatenetwork Your MSPor IT Shop floor Never seesCUI
The managed edge, operated by inDirectITThe enclave boundaryOutside the boundary, still yoursUser roles are illustrative; you decide who handles CUI.
Who owns what

Inside the boundary, and outside it.

The line is simple on purpose: if it touches CUI, it belongs inside the enclave; if it never sees CUI, it stays yours and stays out of scope.

AreaInside CUIckStartOutside · still yours
CloudGCC High for the CUI workloadSystems that never see CUI
PeopleNamed identities and accessThe decision of who is allowed to handle CUI
Mail and filesEncrypted mail and files, with retentionAnything that is not CUI stays where it is
OperationsLogging and backup designed with the boundaryYour MSP or internal IT for the corporate network
ProgramSSP and the remaining customer work, kept currentPhysical security and policies outside the enclave
Timelines

Standard or Express. Same four stations.

Standard

READY IN 60 DAYS
  1. Draw the flow
  2. Build the boundary
  3. Name the users
  4. Hold the evidence

Ready for an assessment or a self-attestation.

$22,500 setup

Express

READY IN 14 DAYS
  1. Draw the flow
  2. Build the boundary
  3. Name the users
  4. Hold the evidence

Ready for an assessment or a self-attestation.

$50,000 setup

Stations are listed in sequence, not to scale. Both bars share one 60-day scale. Delivery durations start only once Microsoft Azure procurement is complete and your GCC High tenant is provisioned. The 60-day and 14-day clocks do not run before then. See pricing for the full table.

What it does not replace

An enclave, not a takeover.

NOT REPLACED

Your MSP or internal IT

They keep the corporate network. CUIckStart is the boundary around CUI.

NOT REPLACED

Your policies

Policy outside the enclave stays yours to own and maintain.

NOT REPLACED

Physical security

Physical security outside the enclave remains yours.

NOT REPLACED

Who handles CUI

You decide who is allowed to handle CUI. We onboard the people you name.

Also not included in the price: Microsoft licensing, billed by Microsoft, and the C3PAO assessment fee.

Questions we get about it

Is CUIckStart a new application?

No. Work happens in Teams, Exchange, SharePoint, and OneDrive on Microsoft 365 GCC High, licensed as Business Premium (GCC High) plus the Defender and Purview add-on.

Does the whole company move into GCC High?

No. Only the people who handle CUI are onboarded as named users. Assessment scope is confirmed from CUI flows, assets and security dependencies during the boundary review.

Does CUIckStart replace our MSP or internal IT?

No. Your MSP or internal IT keeps running the corporate network. CUIckStart is the boundary around CUI, built and operated by inDirectIT.

How long until the enclave is ready?

Standard is ready in 60 days. Express is ready in 14 days. Ready means ready for an assessment or a self-attestation. Delivery durations start only once Microsoft Azure procurement is complete and your GCC High tenant is provisioned. The 60-day and 14-day clocks do not run before then.

Is the assessment included?

No. The C3PAO assessment fee is not included, and Microsoft licensing is billed separately by Microsoft.

Where do we see progress?

In the inDirectIT client portal. Its Enclave module, which is in build, shows the build stage, named users and seats, license counts, the boundary inventory, the four workloads, and change requests.

CUIckStart overview Enclave console AI tiers Pricing GCC High Migration GCC High vs. Commercial cuickstart.com ↗
Talk to the operator

Draw your flow with us.

Station one starts with a conversation about where CUI enters, lives, and leaves your business. Tell us a little and we will set it up.

Or call 240-331-6256, or email rj@indirectit.com.

Book a boundary review → Choose your enclave plan →

Or email rj@indirectit.com. Share high-level requirements only; do not send CUI or sensitive files.