Office 365
A Practical CMMC Purview DLP Policy for CUI in Microsoft 365
A DLP policy is like a gate, not the whole fence. When I build CMMC Purview DLP controls for Controlled Unclassified Information in Microsoft 365, I treat them as one…
CMMC Level 2 SPRS Score Guide For Microsoft 365 Shops
If you run Microsoft 365 for a small or mid-size defense contractor, your CMMC SPRS score can feel like a math test you never studied for. The good news is…
CMMC Level 2 CUI Data Flow Diagram Template for Microsoft 365
If a CUI flow diagram feels fuzzy, the whole compliance story feels fuzzy. In Microsoft 365, I want a diagram that shows where Controlled Unclassified Information enters, where it moves,…
CMMC Level 2 Password and Lockout Policy in Microsoft 365, exact settings, common fails, and evidence screenshots
Passwords are still the front door key for most Microsoft 365 tenants. In a CMMC Level 2 assessment, that key has to be strong, monitored, and backed by proof. I…
CMMC Level 2 System Boundary Diagram Template (Microsoft 365, endpoints, and any on-prem), with an example you can copy
If you’re preparing for CMMC Level 2, your CMMC system boundary diagram is one of the fastest ways to show assessors you control where CUI lives, how it moves, and…
CMMC Level 2 Break Glass Accounts Setup in Microsoft Entra ID
If you’re pursuing CMMC Level 2, getting locked out of Entra ID during a security change is the kind of “one bad click” story you don’t want to tell an…
CMMC Level 2 Break-Glass Accounts for Microsoft 365, a 2-account setup, storage rules, and evidence to capture
If you’ve ever locked yourself out of a Microsoft 365 tenant, you already understand the problem. When Conditional Access, MFA, or identity providers misbehave, you need a way back in.…
CMMC Level 2 Asset Inventory for Small Contractors (template, what counts as an asset, and how to keep it current)
If you’re a small DoD contractor, your CMMC asset inventory can feel like one more spreadsheet to babysit. But for Level 2, it’s not “nice to have.” It’s a basic…
CMMC Level 2 Incident Response Runbook For Microsoft 365
When an alert hits your Microsoft 365 tenant, you don’t need a “plan.” You need a CMMC incident response runbook you can follow under stress. I built the runbook below…
CMMC Level 2 Incident Response Plan Template for Small Contractors (Microsoft 365 + endpoints, with a 30-day test schedule)
If you handle CUI, an incident isn’t just “an IT problem.” It’s a contract risk, a trust risk, and a timeline risk. The good news is a CMMC incident response…
CMMC Level 2 Entra PIM Setup For Admin Roles 2026 Guide
Standing admin access is like leaving the master keys on the front counter. Most days nothing happens. Then one bad password reset, one phish, or one stolen session cookie turns…
CMMC Level 2 Entra ID PIM Setup Guide With Audit Evidence Screenshots
If you support a DoD supplier, you already know the hardest part of compliance isn’t buying tools. It’s proving you used them the right way, every time. For CMMC Level…