Tunnell Government Services

Tunnell Government Service’s primary business model centers on identifying, vetting, and placing qualified consultants into government positions. These consultants typically work on-site at government facilities or remotely using government furnished equipment, meaning Tunnell’s own systems handle CUI on a limited basis.

The Company initially pursued enterprise-wide Cybersecurity Maturation Model Certification compliance, which would have required migrating all users and systems to meet cybersecurity requirements. That approach would have imposed unnecessary licensing costs and operational burden on the broader organization, given that only a small
fraction of its workforce needed access to CUI-related systems.

CyberSheath worked with Tunnell’s leadership team to shift from an enterprise model to a targeted enclave strategy.

The collaborative process included:

•  Scope assessment and cost optimization — Determining that only 20 of Tunnell’s 242 resources required access to the compliant environment, dramatically reducing licensing and infrastructure costs compared to the original enterprise approach.
• Enclave design — Building an Azure Virtual Desktop (AVD) environment in Microsoft’s Government Community Cloud (GCC), providing a secure workspace for CUI without changes to the company’s existing commercial systems.
• Forward-looking data protection — Developing a secure staging area using a FedRAMP-authorized file-sharing platform to handle personnel screening and vetting information. While the government does not currently classify this data as CUI, Tunnell’s leadership recognized it could be designated as such in the future. CyberSheath configured the platform per the provider’s customer responsibility matrix and integrated its logs for monitoring.
• Documentation development — Preparing all compliance materials through CyberSheath’s AIM (Assess, Implement, Manage) methodology, with Tunnell’s leadership actively reviewing and refining documents to ensure accuracy.

CyberSheath delivered an AVD enclave hosted in GCC, limiting the compliance scope to the 20 users who needed CUI access. Employees outside that group continued working in Tunnell’s commercial environment with no disruption or additional licensing costs. The secure staging area addressed a challenge specific to personnel-focused contractors: collecting sensitive screening documents from prospective hires — who may submit from personal email accounts or outside domains — without introducing that data directly into the enclave. The staging area served as a controlled intake point for documents, where they were received, vetted, and moved into the CUI environment as needed.