Cloud and vendors
Compare Microsoft, Google Workspace, VDI, and the commitments behind a service.
Find your next step
RSS feed10 guides · Page 1 of 2
- Cloud and vendors
What belongs in my Microsoft 365 CUI boundary?
Follow one CUI drawing through your tenant. Every place it lands, and every admin who can reach it, is in your boundary. Two SharePoint settings close most of the leaks.
Andrew Erne - Cloud and vendors
Can I use Google Workspace for CMMC Level 2?
Yes. Keep CUI in Workspace Enterprise Plus with Assured Controls Plus, or keep it out of Workspace entirely. What to buy, what Google does and doesn't commit to, and the Chromebook test that catches the leaks.
Kyle Fahey - Cloud and vendors
Do I need Microsoft 365 Commercial, GCC, or GCC High?
FCI only: stay on Commercial. Technical drawings or ITAR data: GCC High. Other CUI: GCC, which Microsoft backs for DFARS 7012. How to tell from your own drawings, and what buying and moving really take.
Andrew Erne - Cloud and vendors
What does FedRAMP Moderate or equivalent mean for my CUI cloud?
The product itself needs a FedRAMP Moderate listing, or a 3PAO assessment showing 100% of the baseline. "Hosted on GovCloud" is neither. The email to send the vendor.
Andrew Erne - Cloud and vendors
Does a CMMC-ready marketplace app belong in my approved boundary?
Not on the label. Read the consent screen first: Files.Read.All reaches every file in your tenant, Sites.Selected reaches one site. Then ask where your data goes.
Kyle Fahey - Cloud and vendors
How many CMMC controls does CrowdStrike Falcon cover?
Falcon helps with 71 of the 110 CMMC Level 2 requirements, and you inherit none of them. It's a security tool, not a cloud that holds your CUI, so every one of the 71 is still yours to set up and prove.
Kyle Fahey - Cloud and vendors
How many CMMC controls does Google Workspace cover?
Google's CMMC guide says Workspace fully handles 42 of the 110 CMMC Level 2 requirements. You share 58 and own 9 outright, and 15 of the "shared" ones have nothing in Workspace to share.
Andrew Erne - Cloud and vendors
How many CMMC controls does Microsoft 365 GCC High cover (vs GCC and Commercial)?
Microsoft's own placemat says GCC High fully covers 52 of the 110 CMMC Level 2 requirements, shares 57, and leaves you 1. It publishes no count for GCC or Commercial. What the 52 really buy you.
Andrew Erne - Cloud and vendors
How many CMMC controls does PreVeil cover?
PreVeil's matrix says it handles 37 of the 110 CMMC Level 2 requirements. You share 65 and own 8. Its "102 of 110" is the first two numbers added together.
Kyle Fahey
