Microsoft Government CMMC AMA

David, we plan on achieving CMMC V2 L2 as soon as the DoD releases final guidance. We have prepared and ensured our systems, security plans, and control procedures meet or exceed the existing guidance. GCCH currently has US Cit access restrictions in place and MSFT operates our Federal tenant on GCCH using US Cit admins, operating on US soil, only. This additional constraint is NOT a CMMC control but rather derived from existing arrangements with the USGov.

In addition to being a Cloud Service Provider and System Integrator, Microsoft is also a Defense Contractor. As such, we too are undergoing our journey to meet CMMC compliance for federal business. All services released in the US Sovereign Cloud are contained within an accreditation boundary supporting US Export Controls requiring screened US persons and data sovereignty in the Continental United States (CONUS). Microsoft does not bar customers from deciding within their own tenant users who can/cannot have access nor do we screen your users for this. This is the responsibility of the customer.