CMMC
CMMC POA&M for Level 2, how to write it, how to age it, and what assessors flag (with a simple template)
CMMC POA&M for Level 2: How I Write It, Age It, and Avoid Assessor Flags (Template Included) If you’re heading into a CMMC Level 2 assessment, your CMMC POA&M can…
CMMC Level 2 User Provisioning And Deprovisioning Checklist In Entra ID
How many “temporary” accounts are still active in your tenant right now? If you handle CUI, that question isn’t academic. Under CMMC user provisioning expectations, every account needs a clear…
CMMC Level 2 SSP Template for Small Contractors (Microsoft 365 + Enclave), sections, screenshots, and what assessors actually check
If you’re a small defense contractor, your CMMC SSP template can’t read like a policy brochure. It has to read like a map. A map of where CUI lives, who…
CMMC Level 2 Enclave vs Separate Tenant in Microsoft 365, decision tree, costs, and evidence you’ll need
If you’re chasing CMMC Level 2, the fastest way to blow your schedule (and your budget) is to scope Microsoft 365 the wrong way. I see it all the time:…
CMMC Level 2 Intune Update Rings That Pass Audit Review
If I’m walking into a CMMC assessment, I don’t want my patching story to sound like “we try our best.” I want it to sound like a process with clear…
CMMC Level 2 eDiscovery And Legal Hold Setup In Purview
If you’re handling CUI in Microsoft 365, you don’t get to treat retention and holds like a “set it once” task. Under CMMC Level 2, I’ve found auditors and incident…
CMMC Level 2 Email Forwarding Controls In Exchange Online
Email forwarding looks harmless until it isn’t. One inbox rule can copy Controlled Unclassified Information (CUI) to a personal mailbox, a vendor, or a compromised account. In March 2026, I…
CMMC Level 2 Security Awareness Training Plan With Simple Tracker
If you handle CUI, your people can’t be the weak link. They’re also your best defense. A good CMMC Level 2 training plan turns everyday habits (how staff log in,…
CMMC Level 2 Secure Admin Workstations Using Intune And Defender
If you administer Microsoft 365 or servers for a defense contractor, you already know the weak spot: admin credentials. One phish, one token theft, one reused browser session, and an…
CMMC Level 2 O365: Microsoft Defender For Office 365 Baseline Setup
Email is still the easiest door into a contractor’s environment. One good phish can turn into stolen credentials, mailbox rules, and quiet data theft that nobody spots for weeks. When…
CMMC Level 2 Retention Policies In Microsoft Purview Setup Guide
If you handle CUI, retention can’t be a vague “we keep stuff for a while” promise. In a CMMC Level 2 assessment, I want to show what’s kept, for how…
CMMC Level 2 Change Management Process For Small IT Teams
If you support CUI with a small staff, change control can feel like a tax on your day. Patches pile up, users want “just one quick tweak”, and your team…