Office 365
CUI Spillage Response in Microsoft 365
One misplaced email can turn a normal workday into a contract problem. When CUI lands in the wrong Microsoft 365 location, speed matters, but random action makes things worse. I…
CMMC Level 2 Entra Terms of Use Setup Guide
A Terms of Use prompt looks small, yet it closes a gap that auditors notice fast. If users can reach Microsoft 365 resources tied to CUI without accepting the rules,…
CMMC Retention Labels for CUI in Purview
A lot of CMMC work breaks down at the same point: teams can identify Controlled Unclassified Information, but they still don’t know how long to keep it or how to…
CMMC Level 2 Authentication for CUI SharePoint Sites
Most SharePoint sites can live with a baseline sign-in policy. A site that stores CUI can’t. When I protect Controlled Unclassified Information in Microsoft 365, I want one extra checkpoint…
Exchange Online Transport Rules for CUI in CMMC Level 2
One bad auto-complete can send CUI outside your boundary in seconds. That is why I treat email controls as a front-line issue in CMMC Level 2, not a side setting…
Entra Administrative Units for CMMC Level 2
Most CMMC trouble starts with a simple identity mistake, too many admins with tenant-wide reach. In Microsoft 365, that creates more access than the job requires, and it makes audits…
Microsoft 365 DMARC for CMMC Level 2
A spoofed message can undo months of security work in one click. That is why I treat Microsoft 365 DMARC setup as a core security task, not a mail admin…
CMMC Entra ID KQL for Level 2 Evidence
An assessor won’t accept “we monitor Entra ID” on faith. I need records that show who signed in, what changed, when it happened, and whether the control worked. That is…
How I Remediate Intune Policy Drift for CMMC Level 2
A CMMC gap often starts as a small mismatch. The policy says one thing, the endpoint does another, and the reporting still looks fine until someone checks the real device…
CMMC Tenant Restrictions v2 for Level 2 Admin Workstations
One bad sign-in can punch a hole through an otherwise well-managed admin workstation. In a CMMC Level 2 environment, that matters because privileged devices sit close to your identity plane,…
My CMMC Internal Audit Checklist for Microsoft 365 Controls
A weak internal audit shows up late, usually when a contract is on the line and the evidence binder is thin. When I build a CMMC internal audit checklist for…
Purview Auto-Labeling for CUI in a CMMC Level 2 Program
Miss one CUI file, and your boundary story can fall apart fast. That is why so many defense contractors and subcontractors look at Purview auto-labeling for CUI before they face…