Cloud
CMMC System Use Notification Setup for Level 2
A missing login banner can leave an otherwise well-secured CUI environment exposed during an assessment. This notice is a small control with a large compliance footprint because it must appear…
CMMC Level 2 Business Continuity Plan Template
A ransomware event, failed cloud tenant, or unavailable key employee can stop a small defense contractor faster than a missed deadline. A CMMC Level 2 business continuity plan gives your…
CMMC Level 2 FedRAMP Cloud Verification Checklist
A cloud platform can have strong security features and still fail the test for handling Controlled Unclassified Information (CUI). For DoD Contractors, Cybersecurity Maturity Model Certification and CMMC Level 2…
How I Approve SaaS Tools for CUI Compliance
A SaaS tool can create a serious compliance gap long before anyone uploads a contract drawing or technical specification. A project manager may invite an outside collaborator, sync a folder…
Entra ID Password Protection for CMMC Level 2
Weak passwords still break strong environments. When I help a team prepare for Entra ID password protection in a CMMC Level 2 context, I start with one plain fact: Microsoft…
CMMC Level 2 Device Risk in Entra Conditional Access
A stolen password should not open the door to Controlled Unclassified Information. When I help teams build CMMC conditional access controls, I want identity, device health, and audit evidence to…
SSP Maintenance Calendar for Microsoft 365
Microsoft 365 rarely fails because a control was missing on paper. It fails because the control drifted, nobody checked it, or the evidence never got saved. I use an SSP…
DFARS 252.204-7012 for Microsoft 365 Contractors
Buying Microsoft 365 doesn’t settle DFARS 252.204-7012. I see many contractors assume the license, the cloud brand, or a secure-looking dashboard means the requirement is covered. It isn’t. The clause…
NIST 800-171 Evidence Tracking in Compliance Manager
When I walk into a NIST 800-171 review, the biggest problem usually isn’t a missing control. It’s missing evidence. Teams remember what they configured, but they can’t always prove when…
GCC High Licensing: Which Employees Need It?
No, not every employee needs GCC High. When I assess Microsoft 365 for regulated work, I usually place only the people who handle controlled data inside that boundary. Job titles…
Microsoft 365 Copilot and CUI in 2026
Yes, Microsoft 365 Copilot can touch CUI in 2026, but only in a narrow set of conditions. If you’re asking about Microsoft 365 Copilot CUI use, the brand name matters…
CMMC Level 2 Teams Shared Channels Checklist
One loose Teams setting can widen your CUI boundary in minutes. Shared channels are useful, but they also create a direct bridge to another tenant. When I review CMMC Level…