Forum Widgets
Latest Discussions
CMMC Compliance without GCC High
Hello MS team, As a government contractor we regularly access CUI and are required to be CMMC level 3 compliant. Currently we run Office 365 on our systems and do not intend on upgrading to GCC High. What configurations, settings or group policies should a contractor put into place in order the be level 3 compliant w/out GCC High. I am looking for guidance in AU, CM, MP, SC & SI domains. Thank you in advance
That's a wrap: Microsoft Teams Government AMA
Thank you for joining us and voicing your questions and feedback during this fun and action-packed hour. Please note that you won't be able to ask new questions in this space until our next live event. We will be disabling posting and further comments in this AMA space but encourage you to post any new questions or follow up in our Public Sector, Local/State Government Space. We will put together a summary document of what was covered during and share it in this group. See you next time!Extending the Shared Responsibility Model into CMMC
A quick review of Compliance Manager (or the Office 365 MT FedRAMP system security plan) shows that Microsoft has documented the areas where customer orgs need to implement their own controls (policies, procedures, tenant configurations) in order to fully satisfy a FedRAMP control requirement. I know that CMMC is different. We aren't focusing on just the cloud system, but rather the entire organization, its people, information, technology and facilities. That distinction aside: how much do we think Microsoft's security capabilities can be "inherited" by subscriber organizations for use in a CMMC assessment? How much still needs to be documented, performed, and managed by the organization itself? More than FedRAMP? Less? 42?
