{"id":96012,"date":"2021-08-30T09:00:20","date_gmt":"2021-08-30T16:00:20","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=96012"},"modified":"2023-05-15T23:03:29","modified_gmt":"2023-05-16T06:03:29","slug":"prepare-for-cmmc-compliance-with-microsoft","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/","title":{"rendered":"How to prepare for CMMC compliance as a defense industrial base supplier using the Microsoft cloud"},"content":{"rendered":"<p>In 2020, the US Department of Defense (DoD) began the phased rollout of a new framework for protecting their supply chain, known as the defense industrial base (DIB). This new Cybersecurity Maturity Model Certification<sup>1<\/sup> (CMMC) system requires regular audits that will bolster the security of the DIB, which comprises approximately 350,000 commercial companies producing everything from Abrams tanks, satellites, and Reaper drones down to laptop computers, uniforms, food rations, medical supplies, and much more.<\/p>\n<p>It\u2019s no secret why the DoD would want to tighten security on its supply chain. According to DoD officials, organizations in the DIB are under constant attack both from nation-states and rogue actors seeking sensitive information (like weapon systems designs). Any breach of a DIB contractor not only poses a risk to national security but also results in a significant loss to US taxpayers. According to a 2021 report by CyberSecurity Ventures<sup>2<\/sup>, it\u2019s estimated that cybercrime will cost businesses worldwide $10.5 trillion annually by 2025. Coincidentally, 2025 is the year every business in the DIB will be required to show compliance with CMMC if they want to continue doing business with the Pentagon. Learn more about Microsoft&#8217;s <a href=\"http:\/\/aka.ms\/CMMCAccelerationProgramUpdate\" target=\"_blank\" rel=\"noopener\">CMMC Acceleration Program<\/a> and leverage these resources to get started on your compliance journey.<\/p>\n<h2>How does CMMC work?<\/h2>\n<p>While the CMMC Interim Rule allows companies to attest to their compliance with NIST 800-171, the ability to self-attest will eventually be retired. Starting in 2021, a phased-in approach will cause DoD contractors to need certification from an independent Certified Third-Party Assessor Organization (C3PAO). Certification provides the DoD with the assurance that a contractor (prime or sub) can be trusted to store Controlled Unclassified Information (CUI) and Federal Contract Information (FCI). The CMMC model is created and managed by the DoD and confers a cybersecurity \u201cmaturity\u201d\u2014the efficacy of process and automation of practices\u2014ranging from \u201cbasic\u201d to \u201cadvanced.\u201d<\/p>\n<p>Far from being a one-and-done checkbox, <strong>CMMC compliance is ongoing and must be re-assessed every three years.<\/strong><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-96027\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/5-levels-of-CMMC-1024x585.png\" alt=\"The five levels of CMMC.\" width=\"1024\" height=\"585\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/5-levels-of-CMMC-1024x585.png 1024w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/5-levels-of-CMMC-300x171.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/5-levels-of-CMMC-768x439.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/5-levels-of-CMMC-1536x877.png 1536w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/5-levels-of-CMMC-2048x1169.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p><em>Figure 1: The five levels of CMMC.<\/em><\/p>\n<ul>\n<li><strong>Level 1<\/strong> certification primarily involves people and processes and is required for any company that deals with FCI not intended for public release. Most DIB suppliers will land in this category. <strong>Level 1 aligns best with commercial clouds.<\/strong><\/li>\n<li><strong>Level 3<\/strong> is required for any company that handles CUI or is bound by <a href=\"https:\/\/www.pmddtc.state.gov\/ddtc_public?id=ddtc_kb_article_page&amp;sys_id=%2024d528fddbfc930044f9ff621f961987\" target=\"_blank\" rel=\"noopener\">International Trade in Arms Regulations (ITAR)<\/a>\u2014roughly 50,000 DIB contractors. However, market pressure may see some companies certify to Level 3 just for a competitive edge. <strong>Level 3 aligns best with government clouds.<\/strong><\/li>\n<li><strong>Level 5<\/strong> is required for only a small segment of DIB contractors that are most likely to be targeted by <a href=\"https:\/\/en.wikipedia.org\/wiki\/Advanced_persistent_threat\" target=\"_blank\" rel=\"noopener\">advanced persistent threats<\/a> (APT) and nation-state activity. <strong>Level 5 aligns best with government clouds.<\/strong><\/li>\n<\/ul>\n<p><em>Levels 2 and 4 are considered transitional; it\u2019s not expected that contracts will require them.<\/em><\/p>\n<p>In September 2021, the DoD will be overseeing 75 pilot contracts adhering to CMMC. By the same time in 2023, that number will reach 250, then up to 479 pilot contracts in 2024. <strong>By October 2025, every business in the DIB must be compliant with CMMC.<\/strong><\/p>\n<h2>Microsoft knows compliance<\/h2>\n<p>Microsoft has been doing business with the DoD for four decades. Of the 350,000 companies in the DIB, 80 percent are <a href=\"https:\/\/www.microsoft.com\/en-us\/microsoft-365\/business\/small-business-solutions\/protect-your-business\" target=\"_blank\" rel=\"noopener\">small-to-medium-sized businesses<\/a> (SMB). So, whether you\u2019re a prime contractor working directly with the DoD, or a smaller subcontractor, <a href=\"https:\/\/www.microsoft.com\/en-us\/microsoft-365\/government#office-ContentAreaHeadingTemplate-57hz5qu\" target=\"_blank\" rel=\"noopener\">Microsoft Office 365 Government plans<\/a> can provide your business with all the features of Office 365 you expect\u2014but in a segmented government community cloud (GCC). Plus, Microsoft lightens the burden of compliance by encrypting your data and enforcing strict access controls for employees, vendors, and subcontractors.<\/p>\n<p><a href=\"https:\/\/docs.microsoft.com\/en-us\/office365\/servicedescriptions\/office-365-platform-service-description\/office-365-us-government\/gcc-high-and-dod\" target=\"_blank\" rel=\"noopener\">Microsoft Office 365 Government \u2013 GCC High<\/a> is a sovereign cloud platform located in the Contiguous US (CONUS) that complies with US government requirements for cloud services. Office 365 Government \u2013 GCC High is designed specifically for use by the DoD and DIB, requiring that organizations be validated before they can deploy to this cloud. Along with all the expected features and capabilities of Office 365, deploying to GCC High ensures:<\/p>\n<ul>\n<li>Your content is <strong>segregated from customer content<\/strong> in commercial Office 365 services.<\/li>\n<li>Your organization&#8217;s content is <strong>stored within the US<\/strong>.<\/li>\n<li>Access to DIB <strong>content is restricted<\/strong> to screened Microsoft personnel who have passed rigorous background checks.<\/li>\n<li>Your cloud deployment <strong>complies with certifications and accreditations<\/strong> that are required for US public sector customers.<\/li>\n<\/ul>\n<p><a href=\"https:\/\/azure.microsoft.com\/en-us\/global-infrastructure\/government\/\" target=\"_blank\" rel=\"noopener\">Microsoft Azure Government<\/a> is a sovereign CONUS cloud platform that also offers hybrid flexibility\u2014customers can maintain some data and functionality on-premises while enabling the broadest level of certifications of any cloud provider. Only US federal, state, local, and tribal governments and their partners have access to this dedicated instance, with operations controlled only by screened US citizens.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-96036 size-full\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/CMMC-2.png\" alt=\"Comparison chart of Microsoft Commercial, M365 GCC, and M365 GCC High.\" width=\"1990\" height=\"1232\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/CMMC-2.png 1990w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/CMMC-2-300x186.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/CMMC-2-1024x634.png 1024w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/CMMC-2-768x475.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/CMMC-2-1536x951.png 1536w\" sizes=\"(max-width: 1990px) 100vw, 1990px\" \/><\/p>\n<p><em>Figure 2: Microsoft 365 Government + Azure Government compliance.<\/em><\/p>\n<p>Though different cloud platforms may have a level of cybersecurity maturity in alignment with CMMC, Microsoft recommends the US Sovereign Cloud with Azure Government and Microsoft 365 Government &#8211; GCC High in alignment with CMMC Levels 3 through 5. <a href=\"https:\/\/www.microsoft.com\/en-us\/msservices?activetab=pivot1%3aprimaryr5\" target=\"_blank\" rel=\"noopener\">Microsoft Consulting Services<\/a> can help you decide on the right platform to enable CMMC compliance for your organization.<\/p>\n<h2>Microsoft CMMC Acceleration Program<\/h2>\n<p>To help speed your journey to CMMC compliance, our <a href=\"http:\/\/aka.ms\/CMMCAccelerationProgramUpdate\" target=\"_blank\" rel=\"noopener\">CMMC Acceleration Program<\/a> provides resources for partners and DIB companies alike. Our goal is to provide a baseline framework that can help close the gap for compliance of infrastructure, applications, and services hosted in <a href=\"https:\/\/azure.microsoft.com\/en-us\/\" target=\"_blank\" rel=\"noopener\">Microsoft Azure<\/a>, <a href=\"https:\/\/www.microsoft.com\/en-us\/microsoft-365\/business\" target=\"_blank\" rel=\"noopener\">Microsoft 365<\/a>, and <a href=\"https:\/\/dynamics.microsoft.com\/en-us\/\" target=\"_blank\" rel=\"noopener\">Microsoft Dynamics 365<\/a>. We work with partners and customers to help them mitigate risks and assist tenants with their shared customer responsibility, as well as provide solutions for assessment and certification.<\/p>\n<p>Recent updates to Microsoft CMMC Acceleration Program include:<\/p>\n<ul>\n<li><strong>Microsoft Product Placemat for CMMC:<\/strong> an interactive view representing how Microsoft cloud products and services satisfy requirements for CMMC practices.<\/li>\n<li><strong>Azure Sentinel CMMC Workbook:<\/strong> provides a mechanism for viewing <a href=\"https:\/\/azure.microsoft.com\/en-us\/services\/azure-sentinel\/\" target=\"_blank\" rel=\"noopener\">Microsoft Azure Sentinel<\/a> log queries from across your Azure environment\u2014Office 365, Teams, Intune, Windows Virtual Desktop, and more\u2014helping you gain better visibility into your cloud architecture while reinforcing CMMC principles across all five maturity levels.<\/li>\n<li><strong>Compliance Manager available in commercial and government cloud environments:<\/strong>\u00a0helps organizations manage CMMC compliance requirements with greater ease and convenience, from taking inventory of data protection risks to managing the complexities of implementing controls, staying current with regulations and certifications, and reporting to auditors.<\/li>\n<li><strong>Azure Policy and blueprint sample for CMMC Level 3:<\/strong> <a href=\"https:\/\/azure.microsoft.com\/en-us\/services\/azure-policy\/\" target=\"_blank\" rel=\"noopener\">Azure Policy<\/a> and <a href=\"https:\/\/azure.microsoft.com\/en-us\/services\/blueprints\/\" target=\"_blank\" rel=\"noopener\">Azure Blueprints<\/a> allow organizations to easily establish compliant environments via a centrally managed policy initiative. This helps avoid misconfigurations while practicing consistent resource governance.<\/li>\n<li><strong>Quickly deploy DoD STIG-compliant images and visualize compliance using Azure:<\/strong> Security Technical Implementation Guides (STIGs) are secure configuration standards for installation and maintenance of DoD Information Assurance (IA)-enabled devices and systems. The Azure team has created sample solutions using first-party Azure tooling to deliver STIG automation and compliance reporting. Use these <a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/cloud-adoption-framework\/reference\/tools-templates#secure\" target=\"_blank\" rel=\"noopener\">quickstart resources<\/a>.<\/li>\n<li><strong>Azure Blueprint for Azure Security Benchmark Foundation:<\/strong> enables developers and security administrators to create hardened environments for their application workloads, helping to implement <a href=\"https:\/\/azure.microsoft.com\/en-us\/blog\/automating-cybersecurity-guardrails-with-new-zero-trust-blueprint-and-azure-integrations\/\" target=\"_blank\" rel=\"noopener\">Zero Trust<\/a> controls across identities, devices, applications, data, infrastructure, and networks.<\/li>\n<\/ul>\n<p>No provider can guarantee a positive adjudication, but Microsoft\u2019s CMMC Acceleration Program can help improve your CMMC posture going into a formal review in accordance with CMMC Accreditation Body (AB) standards.<\/p>\n<h2>Zero Trust is key to CMMC<\/h2>\n<p>Microsoft is experienced in facilitating <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/business\/zero-trust\" target=\"_blank\" rel=\"noopener\">Zero Trust<\/a> architectures in federal frameworks, a concept that\u2019s critical to preventing attackers from elevating access within your environment. Zero Trust is built around three basic principles: <strong>verify<\/strong>, based on all available data points;<strong> use<\/strong> <strong>least-privileged access<\/strong> with just-in-time and just-enough-access (JIT\/JEA); and <strong>assume breach<\/strong> to minimize blast radius and prevent lateral movement. Microsoft employs several references for implementing Zero Trust in federal information systems, including the <a href=\"https:\/\/csrc.nist.gov\/publications\/detail\/sp\/800-207\/final\" target=\"_blank\" rel=\"noopener\">National Institute of Standards and Technology (NIST) SP 800-207<\/a>, <a href=\"https:\/\/www.cisa.gov\/trusted-internet-connections\" target=\"_blank\" rel=\"noopener\">Trusted Internet Connections (TIC) 3.0<\/a>, and <a href=\"https:\/\/www.cisa.gov\/cdm\" target=\"_blank\" rel=\"noopener\">Continuous Diagnostics and Mitigation<\/a> (CDM). We view these principles as technology-agnostic and apply them across endpoints, on-premises systems, cloud platforms, and operational technology (OT).<\/p>\n<p>The <a href=\"https:\/\/techcommunity.microsoft.com\/t5\/public-sector-blog\/announcing-the-azure-sentinel-zero-trust-tic3-0-workbook\/ba-p\/2313761\" target=\"_blank\" rel=\"noopener\">Azure Sentinel: Zero Trust (TIC 3.0) Workbook<\/a> provides an overlay of Microsoft security offerings onto Zero Trust models, enabling security analysts and managed security service providers (MSSPs) to gain awareness of their cloud security posture. This workbook features more than 76 control cards aligned to TIC 3.0 security capabilities and can augment security operations center (SOC) efforts through automation, AI, machine learning, query\/alerting, visualizations, tailored recommendations, and documentation references. Each panel aligns to a specific control, providing an actionable path to help cover gaps and improve alerting, even incorporating third-party security solutions.<\/p>\n<p>If your organization is interested in pursuing contracts with the DoD or its suppliers, it\u2019s in your interest to be proactive about cybersecurity maturity. To learn more about how Microsoft can help your organization improve your compliance standing, visit our new <a href=\"https:\/\/www.microsoft.com\/en-us\/federal\/cmmc.aspx\" target=\"_blank\" rel=\"noopener\">CMMC homepage<\/a>.<\/p>\n<p>To learn more about Microsoft Security solutions,\u00a0<a href=\"https:\/\/www.microsoft.com\/en-us\/security\/business\/solutions\" target=\"_blank\" rel=\"noopener\">visit our\u00a0website<\/a>.\u00a0Bookmark the\u00a0<a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\" target=\"_blank\" rel=\"noopener\">Security blog<\/a>\u00a0to keep up with our expert coverage on security matters. Also, follow us at\u00a0<a href=\"https:\/\/twitter.com\/@MSFTSecurity\" target=\"_blank\" rel=\"noopener\">@MSFTSecurity<\/a>\u00a0for the latest news and updates on cybersecurity.<\/p>\n<p>&nbsp;<\/p>\n<hr \/>\n<p><sup>1<\/sup><a href=\"https:\/\/cmmcab.org\/cmmc-standard\/\" target=\"_blank\" rel=\"noopener\">Cybersecurity Maturity Model Certification<\/a>, CMMC Accreditation Body.<\/p>\n<p><sup>2<\/sup><a href=\"https:\/\/1c7fab3im83f5gqiow2qqs2k-wpengine.netdna-ssl.com\/wp-content\/uploads\/2021\/01\/Cyberwarfare-2021-Report.pdf\" target=\"_blank\" rel=\"noopener\">2021 Report: Cyberwarfare in the C-Suite<\/a>, Cybersecurity Ventures, 21 January 2021.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>DoD and DIB suppliers\u2014see how Microsoft can give your business a competitive edge toward CMMC compliance.<\/p>\n","protected":false},"author":106,"featured_media":96102,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[3659],"topic":[3668,3669,3686],"products":[],"threat-intelligence":[],"tags":[3772,3822],"coauthors":[1896,2703],"class_list":["post-96012","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","content-type-best-practices","topic-compliance","topic-data-protection","topic-small-and-medium-business","tag-government","tag-microsoft-security-insights"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>How to prepare for CMMC compliance as a defense industrial base supplier using the Microsoft cloud | Microsoft Security Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to prepare for CMMC compliance as a defense industrial base supplier using the Microsoft cloud | Microsoft Security Blog\" \/>\n<meta property=\"og:description\" content=\"DoD and DIB suppliers\u2014see how Microsoft can give your business a competitive edge toward CMMC compliance.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2021-08-30T16:00:20+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-05-16T06:03:29+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/MSC17_ranTech_034.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"800\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Joram Borenstein, Marion Rousseau\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/MSC17_ranTech_034.jpg\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Joram Borenstein, Marion Rousseau\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/\"},\"author\":[{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/joram-borenstein\/\",\"@type\":\"Person\",\"@name\":\"Joram Borenstein\"},{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/marion-rousseau\/\",\"@type\":\"Person\",\"@name\":\"Marion Rousseau\"}],\"headline\":\"How to prepare for CMMC compliance as a defense industrial base supplier using the Microsoft cloud\",\"datePublished\":\"2021-08-30T16:00:20+00:00\",\"dateModified\":\"2023-05-16T06:03:29+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/\"},\"wordCount\":1489,\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/MSC17_ranTech_034.jpg\",\"keywords\":[\"Government\",\"Microsoft Security Insights\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/\",\"name\":\"How to prepare for CMMC compliance as a defense industrial base supplier using the Microsoft cloud | Microsoft Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/MSC17_ranTech_034.jpg\",\"datePublished\":\"2021-08-30T16:00:20+00:00\",\"dateModified\":\"2023-05-16T06:03:29+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/#primaryimage\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/MSC17_ranTech_034.jpg\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/MSC17_ranTech_034.jpg\",\"width\":1200,\"height\":800,\"caption\":\"Aerospace engineering company produces high-tolerance, precision machined components and assemblies, for leading manufacturers of aircraft, aero structures, and defense platforms.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to prepare for CMMC compliance as a defense industrial base supplier using the Microsoft cloud\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"name\":\"Microsoft Security Blog\",\"description\":\"Expert coverage of cybersecurity topics\",\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\",\"name\":\"Microsoft Security Blog\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"width\":512,\"height\":512,\"caption\":\"Microsoft Security Blog\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to prepare for CMMC compliance as a defense industrial base supplier using the Microsoft cloud | Microsoft Security Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/","og_locale":"en_US","og_type":"article","og_title":"How to prepare for CMMC compliance as a defense industrial base supplier using the Microsoft cloud | Microsoft Security Blog","og_description":"DoD and DIB suppliers\u2014see how Microsoft can give your business a competitive edge toward CMMC compliance.","og_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/","og_site_name":"Microsoft Security Blog","article_published_time":"2021-08-30T16:00:20+00:00","article_modified_time":"2023-05-16T06:03:29+00:00","og_image":[{"width":1200,"height":800,"url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/MSC17_ranTech_034.jpg","type":"image\/jpeg"}],"author":"Joram Borenstein, Marion Rousseau","twitter_card":"summary_large_image","twitter_image":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/MSC17_ranTech_034.jpg","twitter_misc":{"Written by":"Joram Borenstein, Marion Rousseau","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/#article","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/"},"author":[{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/joram-borenstein\/","@type":"Person","@name":"Joram Borenstein"},{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/marion-rousseau\/","@type":"Person","@name":"Marion Rousseau"}],"headline":"How to prepare for CMMC compliance as a defense industrial base supplier using the Microsoft cloud","datePublished":"2021-08-30T16:00:20+00:00","dateModified":"2023-05-16T06:03:29+00:00","mainEntityOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/"},"wordCount":1489,"publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/MSC17_ranTech_034.jpg","keywords":["Government","Microsoft Security Insights"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/","name":"How to prepare for CMMC compliance as a defense industrial base supplier using the Microsoft cloud | Microsoft Security Blog","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/#primaryimage"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/MSC17_ranTech_034.jpg","datePublished":"2021-08-30T16:00:20+00:00","dateModified":"2023-05-16T06:03:29+00:00","breadcrumb":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/#primaryimage","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/MSC17_ranTech_034.jpg","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2021\/08\/MSC17_ranTech_034.jpg","width":1200,"height":800,"caption":"Aerospace engineering company produces high-tolerance, precision machined components and assemblies, for leading manufacturers of aircraft, aero structures, and defense platforms."},{"@type":"BreadcrumbList","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/30\/prepare-for-cmmc-compliance-with-microsoft\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/"},{"@type":"ListItem","position":2,"name":"How to prepare for CMMC compliance as a defense industrial base supplier using the Microsoft cloud"}]},{"@type":"WebSite","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","name":"Microsoft Security Blog","description":"Expert coverage of cybersecurity topics","publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization","name":"Microsoft Security Blog","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","width":512,"height":512,"caption":"Microsoft Security Blog"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/"}}]}},"msxcm_display_generated_audio":false,"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"Microsoft Security Blog","distributor_original_site_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog","push-errors":false,"_links":{"self":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/96012"}],"collection":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/users\/106"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/comments?post=96012"}],"version-history":[{"count":0,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/96012\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media\/96102"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media?parent=96012"}],"wp:term":[{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/content-type?post=96012"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/topic?post=96012"},{"taxonomy":"products","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/products?post=96012"},{"taxonomy":"threat-intelligence","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/threat-intelligence?post=96012"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/tags?post=96012"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/coauthors?post=96012"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}