How many “temporary” accounts are still active in your tenant right now? If you handle CUI, that question isn’t academic. Under CMMC user provisioning expectations, every account needs a clear…
If you’re a small defense contractor, your CMMC SSP template can’t read like a policy brochure. It has to read like a map. A map of where CUI lives, who…
If you’re chasing CMMC Level 2, the fastest way to blow your schedule (and your budget) is to scope Microsoft 365 the wrong way. I see it all the time:…
If I’m walking into a CMMC assessment, I don’t want my patching story to sound like “we try our best.” I want it to sound like a process with clear…
If you’re handling CUI in Microsoft 365, you don’t get to treat retention and holds like a “set it once” task. Under CMMC Level 2, I’ve found auditors and incident…
Email forwarding looks harmless until it isn’t. One inbox rule can copy Controlled Unclassified Information (CUI) to a personal mailbox, a vendor, or a compromised account. In March 2026, I…
If you administer Microsoft 365 or servers for a defense contractor, you already know the weak spot: admin credentials. One phish, one token theft, one reused browser session, and an…
Email is still the easiest door into a contractor’s environment. One good phish can turn into stolen credentials, mailbox rules, and quiet data theft that nobody spots for weeks. When…
If you handle CUI, retention can’t be a vague “we keep stuff for a while” promise. In a CMMC Level 2 assessment, I want to show what’s kept, for how…
If you’re a small team, security can feel like trying to lock every door in a busy building while still letting customers in. The good news is that Microsoft Defender…
