CMMC Level 2 Microsoft Sentinel Setup for Small Contractors
If I’m building a Microsoft Sentinel CMMC monitoring plan for a small federal contractor, I start with one hard truth: Sentinel can support a CMMC Level 2 program, but it…
CMMC Level 2 Microsoft Purview DLP Setup Guide for CUI
Protecting Microsoft Purview DLP for CMMC Level 2 sounds easy until the first policy floods the help desk with noise. I treat DLP like a gate guard. It won’t make…
A Practical CMMC Purview DLP Policy for CUI in Microsoft 365
A DLP policy is like a gate, not the whole fence. When I build CMMC Purview DLP controls for Controlled Unclassified Information in Microsoft 365, I treat them as one…
CMMC Level 2 SPRS Score Guide For Microsoft 365 Shops
If you run Microsoft 365 for a small or mid-size defense contractor, your CMMC SPRS score can feel like a math test you never studied for. The good news is…
CMMC Level 2 CUI Data Flow Diagram Template for Microsoft 365
If a CUI flow diagram feels fuzzy, the whole compliance story feels fuzzy. In Microsoft 365, I want a diagram that shows where Controlled Unclassified Information enters, where it moves,…
CMMC Level 2 Password and Lockout Policy in Microsoft 365, exact settings, common fails, and evidence screenshots
Passwords are still the front door key for most Microsoft 365 tenants. In a CMMC Level 2 assessment, that key has to be strong, monitored, and backed by proof. I…
CMMC Level 2 System Boundary Diagram Template (Microsoft 365, endpoints, and any on-prem), with an example you can copy
If you’re preparing for CMMC Level 2, your CMMC system boundary diagram is one of the fastest ways to show assessors you control where CUI lives, how it moves, and…
CMMC Level 2 Break Glass Accounts Setup in Microsoft Entra ID
If you’re pursuing CMMC Level 2, getting locked out of Entra ID during a security change is the kind of “one bad click” story you don’t want to tell an…
CMMC Level 2 Break-Glass Accounts for Microsoft 365, a 2-account setup, storage rules, and evidence to capture
If you’ve ever locked yourself out of a Microsoft 365 tenant, you already understand the problem. When Conditional Access, MFA, or identity providers misbehave, you need a way back in.…
CMMC Level 2 Incident Response Runbook For Microsoft 365
When an alert hits your Microsoft 365 tenant, you don’t need a “plan.” You need a CMMC incident response runbook you can follow under stress. I built the runbook below…