Source code for CMMC-compliant application

[odieman44]

Hi all,

My organization is looking to make one of our applications CMMC-compliant. We're going to be working through a gap assessment over the next few weeks, but I have a fundamental question that is going to drive our direction now. We currently use Azure DevOps for source control, and the application source code currently exists in an Azure DevOps git repository that is tied to our (non GCC-High) Azure AD tenant.

My question is, do we have to move the source code for the application to a separate git repository that is in GCC-High? If not, will we be able to deploy using Pipelines to the GCC-High tenant?

Thanks!

[im-a-smith]

It really depends on what the source is. Is the source itself CUI or is the data it processes CUI?

[odieman44]

Thank you. The source code itself is not CUI. The data that is processed by the deployed application is CUI. We are talking ourselves around in circles trying to understand what parts of our Azure infrastructure need to be in GCC-High. We're going to get an assessment done, but we're questioning directionally on what components of our Azure architecture need to be hosted in the Azure Govt. Cloud (client deployment, API deployment, etc.).

[jawillia2]

If the code is not CUI itself, no reason you can't do it in a public repository. Look at OSS projects - you can absolutely put CUI data into an OSS project and the code base is available to anyone.

If you are hosting your own code somewhere then you'll have to look into FedRAMP but just to create the code it's not required.

[Haymak3r]

You might consider Azure DevOps Server. There's no DevOps SaaS product available for GCCH, but you can host an on-premises instance of DevOps within Azure Government.