Guide to Technology
CMMC Level 2 Device Risk in Entra Conditional Access
A stolen password should not open the door to Controlled Unclassified Information. When I help teams build CMMC conditional access controls, I want identity, device health, and audit evidence to…
Purview Endpoint DLP for CUI and CMMC Level 2
Most CUI doesn’t leak through a dramatic breach. It leaves through ordinary user actions on an endpoint, a USB copy, a browser upload, a print job, or a quick paste…
CMMC L2 Secure Boot and TPM Evidence in Intune
A device can look healthy in Intune and still leave you short on audit evidence. I see that gap often with Intune Secure Boot and TPM evidence, because admins trust…
CMMC Teams Recording Policy for CUI in Microsoft 365
One Teams recording can turn a normal project call into a CUI handling event. I see that happen most often when a meeting starts as routine collaboration and ends with…
SSP Maintenance Calendar for Microsoft 365
Microsoft 365 rarely fails because a control was missing on paper. It fails because the control drifted, nobody checked it, or the evidence never got saved. I use an SSP…
DFARS 252.204-7012 for Microsoft 365 Contractors
Buying Microsoft 365 doesn’t settle DFARS 252.204-7012. I see many contractors assume the license, the cloud brand, or a secure-looking dashboard means the requirement is covered. It isn’t. The clause…
Microsoft Forms Governance for Teams Handling CUI
A form looks harmless until it collects CUI. Once that happens, convenience stops mattering and control takes over. When I set Microsoft Forms governance for teams that handle controlled unclassified…
NIST 800-171 Evidence Tracking in Compliance Manager
When I walk into a NIST 800-171 review, the biggest problem usually isn’t a missing control. It’s missing evidence. Teams remember what they configured, but they can’t always prove when…
GCC High Licensing: Which Employees Need It?
No, not every employee needs GCC High. When I assess Microsoft 365 for regulated work, I usually place only the people who handle controlled data inside that boundary. Job titles…
Microsoft 365 Copilot and CUI in 2026
Yes, Microsoft 365 Copilot can touch CUI in 2026, but only in a narrow set of conditions. If you’re asking about Microsoft 365 Copilot CUI use, the brand name matters…
CMMC RMM Hardening Checklist for Small Contractors
An exposed RMM tool can give an attacker a fast path to every endpoint you own. For a small contractor, that single gap can hurt operations, expose CUI, and create…
Credential Guard in Intune for CMMC Level 2
A stolen cached credential can turn one Windows 11 laptop into a pivot point. That’s why I treat Credential Guard as a serious hardening step when I build a CMMC-minded…