There is an update to this article found at:
https://aka.ms/MSGovCompliance
Updated Sep 23, 2024
Version 18.0
RichardWakeman
Microsoft
MicrosoftBlog Post
1 MIN READ
Understanding Compliance Between Commercial, Government and DoD Offerings - September 2023 Update
RichardWakemanMicrosoft
Microsoft
Why couldn't Azure Commercial be used for CUI and ITARs, if the following compensating controls are place:
- All Azure workloads (VM, AKS, Log Analytics) use Azure Disks and Storage Accounts which are encrypted with Customer Managed Keys, using Azure Key Vault (FIPS 140-2 Level 2 certified).
- All Azure workloads in US based Availability Zones.
- All Endpoint data flows to Azure Workloads leverage FIPS 140-2 modules.
- Endpoint authorization is gated with AAD Conditional Access (Compliant, MFA, Terms of Use).
Because Microsoft employ's non-US Citizens inside the Commercial Data Centers, that have ACCESS to your VM hosts and storage cabinets and disks. Along with "Follow the Sun" support may have your trouble ticket being responded to by non-US citizens from around the globe that have access to your systems and log files. A common practice for support to research your problem in advance of responding to you. Possible ACCESS is the key.
