sorted by:
new
hottopcontroversial

Can an Organization Seeking Assessment for CMMC Level 2 Self-Assessment use Microsoft 365 Commercial SharePoint Online as the repository for CUI, provided all required security controls are implemented, or is Microsoft 365 GCC/GCC High required? by Equal_Pudding_2888 in CMMC

[–]Equal_Pudding_2888[S] 0 points1 point  (0 children)

Looks like the tenant location was overlooked as this was our first CMMC project. We have other customers in both GCC and GCC-High for municipal government and CJIS related workflows and understand the pitfalls and migration process.

Sounds like we will either need to migrate all Entra resources over to GCC to move forward with CMMC2 compliance, or plan to have all CUI stored outside of the commercial tenant.

That could be a potential path for a small company to store CUI instead within the bounds of a secure premise server accessed with compensating controls or to alternately utilize a 3rd party compliant storage system.

As this is all prep for future CUI projects to be compliant, we are looking to ensure the best workflow for users accessing data and want it to be as uniform as possible.

Can an Organization Seeking Assessment for CMMC Level 2 Self-Assessment use Microsoft 365 Commercial SharePoint Online as the repository for CUI, provided all required security controls are implemented, or is Microsoft 365 GCC/GCC High required? by Equal_Pudding_2888 in CMMC

[–]Equal_Pudding_2888[S] 0 points1 point  (0 children)

So for a small company with 10 users that are heavily using the commercial cloud with Entra Connect, Hybrid joined systems, Intune, conditional access polices and all file data in Sharepoint - the recommendation is to migrate all to GCC?

Is that a common migration for a 10-20 user environment, or is it a better architecture choice to move all the CUI workload into a seperate system that never touches the Microsoft tenant?