Microsoft
MicrosoftWe are using commercial cloud and do not need to ever process ITAR or EAR. Based on this article it seems like it would be possible to achieve CMMC L2 using commercial cloud since we do not process any restrictive categories of CUI. Is this correct?
MicrosoftWills Ogus since M365 Commercial is not FedRAMP Moderate, you will want to consider GCC (not High).
MicrosoftMicrosoft Multi Tenant is in fact M365 GCC (Not High). It is not M365 Commercial. You should not store, process, nor transmit CUI in M365 Commercial as it is not FedRAMP. The authorization for GCC is at the Moderate impact level but has 'Equivalency' at the High impact level.
RichardWakeman Thanks so much for the reply. This is extremely helpful. I saw on the FedRAMP marketplace that Microsoft Multi Tenant is listed as FedRAMP Moderate. Is this still correct, or is this outdated? Or is this something different than Commercial Office 365?
https://marketplace.fedramp.gov/products/MSO365MT/
Also there seems to be Partner solutions out there to achieve CMMC compliance on commercial cloud. Would you agree a solution like PreVeil Office 365 commercial cloud works to meet CMMC?
https://www.preveil.com/preveil-vs-microsoft-gcc-high/
We currently use Information Protection, and E5 licenses to achieve these controls. Would a well put together solution using Microsoft technologies that meets all 110 controls pass CMMC, in your opinion?
Thanks again for clarifying!
