Microsoft Teams can feel like a conference room, a file cabinet, and a phone system all in one. That’s great for speed, but it’s also how Controlled Unclassified Information (CUI)…
How many “temporary” accounts are still active in your tenant right now? If you handle CUI, that question isn’t academic. Under CMMC user provisioning expectations, every account needs a clear…
If you’re a small defense contractor, your CMMC SSP template can’t read like a policy brochure. It has to read like a map. A map of where CUI lives, who…
If you’re chasing CMMC Level 2, the fastest way to blow your schedule (and your budget) is to scope Microsoft 365 the wrong way. I see it all the time:…
If you’re handling CUI in Microsoft 365, you don’t get to treat retention and holds like a “set it once” task. Under CMMC Level 2, I’ve found auditors and incident…
Email forwarding looks harmless until it isn’t. One inbox rule can copy Controlled Unclassified Information (CUI) to a personal mailbox, a vendor, or a compromised account. In March 2026, I…
If you’ve ever had a new hire ask, “What’s the POS login?” and three people answer with the same PIN, you already know why a restaurant onboarding checklist matters. Shared…
If you administer Microsoft 365 or servers for a defense contractor, you already know the weak spot: admin credentials. One phish, one token theft, one reused browser session, and an…
Email is still the easiest door into a contractor’s environment. One good phish can turn into stolen credentials, mailbox rules, and quiet data theft that nobody spots for weeks. When…
If you handle CUI, retention can’t be a vague “we keep stuff for a while” promise. In a CMMC Level 2 assessment, I want to show what’s kept, for how…
