Microsoft Government CMMC AMA

Howdy Ken! Regarding the CMMC Assessment Templates in GCC and GCC High: The Compliance Manager is generally available in all Microsoft 365 cloud offerings, including GCC and GCC High. The Assessment Templates for CMMC are also generally available for your use today. We have made a licensing exception for the CMMC assessment templates in GCC and GCC High. While most other assessment templates require premium template licenses, the CMMC assessment templates do not require the premium template licenses in GCC nor GCC High. You will still need the proper Microsoft 365 SKU to get the rights for a user to access the Compliance Manager. Please see the most up-to-date licensing requirements here and here. At the time of this writing, the CMMC assessment templates are included by default (free of cost) for GCC and GCC High with the following SKUs: Microsoft 365 or Office 365 G5 Microsoft 365 G5/F5 Compliance Microsoft 365 G5/F5 eDiscovery and Audit Microsoft 365 G5/F5 Insider Risk Management Microsoft 365 G5/F5 Information Protection and Governance Please note the CMMC assessment templates do require premium template licenses in Commercial. The licensing exception only applies to GCC and GCC High. As of the time of this writing, there is a 90 day trial for up to 25 premium assessment templates, including CMMC and NIST SP 800-171 in any cloud offering (Commercial, GCC, and GCC High). Please see premium assessment trial for more information. The Secure Score feature is still in preview within Commercial and GCC. Secure Score will not release in GCC High until it becomes Generally Available. As a result, automated testing does not work in GCC High. GCC High customers will need to manually implement and test their improvement actions in the Compliance Manager. For more information, please see Settings for automated testing and user history. The CMMC 2.0 templates will be drifted into Compliance Manager this quarter however, the NIST 800-171 templates are currently available. If you are preparing for a CMMC assessment you should consider taking a look at the Azure Sentinel CMMC 2.0 workbook. Read more here: https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CybersecurityMaturityModelCertification(CMMC)2.0

GCC High customers now have access to CMMC 2.0 Levels 1 and 2 assessment templates. By mid-April WWMT, GCC and DoD customers also will have access to Compliance Manager’s updated CMMC Levels 1 and 2 assessments. Once CMMC 2.0 Level 3 regulation is published, the Compliance Manager engineering team will announce general availability for the updated CMMC Level 3 assessment templates.