CMMC Compliance in GCC High: 7 Requirements Your Business Systems Have to Meet

If you want to keep winning defence work, you have to show the government that your systems protect its information. That is what the Cybersecurity Maturity Model Certification (CMMC) checks: 110 requirements, and proof you meet each one.
Microsoft 365 in a government cloud covers a good share of the technical ones. The requirements that catch contractors out are quieter, and they are about records.
​
Can you show that everyone read the current security policy? That the person who left in March lost access the same week? That a supplier wiped the drive before taking a machine away for repair? Those answers sit in a spreadsheet, an inbox, or nobody’s head at all.

Which CMMC requirements do your business systems have to meet?

​Seven requirements put direct demands on the systems your teams use every day. Each one is covered in full below, with the rule it comes from, the reason it fails, and the evidence an assessor asks for.

The CMMC Requirement	The SP Answer
CUI ends up in a CRM outside your assessment boundary	SP CRM Core
No record that anyone read the current security policy	SP Policy Manager
Access survives after someone leaves or changes role	SP Employee Hub
No reliable timeline behind the 72-hour incident report	SP IT Helpdesk
Physical access and maintenance logged on paper, or not at all	SP Facilities Manager
Findings raised, then lost before anyone closes them	SP Safety
No proof that requirements were passed down to suppliers	SP Contract Tracker

​Every product listed runs inside your own Microsoft 365 tenant rather than on external infrastructure, so the records it produces sit inside the boundary you already protect. SP Marketplace has built these applications on SharePoint, Teams and the Power Platform across more than 1,500 deployments, including government and public sector organisations.

Does CMMC still matter after the 2026 suspension?

Yes. The suspension paused the checking, not the standard.
In July 2026 the Department of War (DoW) suspended Phase 2, which would have required third-party certification for contracts involving Controlled Unclassified Information (CUI) from November 2026. Phases 3 and 4 were frozen alongside it, and a reform task force is now reviewing the programme.

Phase 1 continues unchanged: self-assessments, DFARS 252.204-7012, NIST SP 800-171, your score in the Supplier Performance Risk System (SPRS) and your annual affirmation. The programme rule was never repealed.
Three things hold regardless of what the review concludes.

• The underlying standard. Every version of CMMC since 2019 has pointed at the same NIST requirements. Reform changes who verifies and how often, not what you need in place.
• Your primes. Flow-down clauses in signed subcontracts bind you now, and primes kept asking throughout the pause.
• The wider direction. A governmentwide CUI rule is moving through federal acquisition regulation separately, so contractors holding civilian work face similar obligations either way.

​
The records described below are what you need whichever shape the programme takes.

A padlock on laptop keyboard

1. How do you keep CUI inside your assessment boundary?

You keep it in systems you already own, and the CRM is where that argument is usually lost.
CUI rarely arrives on the day you win a contract. It turns up during the bid, attached to opportunities as statements of work, drawings and export-controlled specifications. Business development files them wherever the CRM tells them to.
​
If that CRM is a commercial SaaS platform, the data has left your tenant. The vendor behind it becomes an external service provider you have to assess, document and defend.

What evidence does an assessor ask for?

Your boundary diagram showing where CUI enters the organisation and where it comes to rest, plus your list of external service providers and the reasoning behind each one.
​
SP CRM Core keeps opportunities, contacts, correspondence and attachments in SharePoint inside your own tenant. In GCC High they inherit that tenant’s boundary, so the CRM never becomes a separate system you have to explain.

Maps to: NIST SP 800-171 Rev 2 §3.1.3; external service providers under 32 CFR 170.19

2. How do you prove staff read the current security policy?

With a timestamped acknowledgement against a named user and a specific version. Nothing less counts.

Writing the policy is the easy part. Proving that four hundred people read the version in force today, rather than the one from two years ago, is what fails.
​
New starters make it harder, and every mid-year revision resets the question.

What evidence does an assessor ask for?

The approved policy set with evidence of a review cycle, and acknowledgement records naming the user, the version they saw and the date.

SP Policy Manager runs drafting, review, approval, publication and version history in SharePoint, then records electronic acknowledgement against each named user. Power BI dashboards show who is still outstanding, so gaps surface before an assessor finds them.
​
One requirement to watch: your System Security Plan (SSP) sits in a small group that can never be deferred to a remediation plan. Without a current one, the assessment does not start.

Maps to: §3.2.1, §3.2.2, §3.12.4
​

3. How do you stop access surviving after someone leaves?

You put HR and IT on the same record, so nothing depends on one team remembering to tell the other.

Someone hands in their notice. HR processes the leaver and IT disables the account. In most organisations those are two separate lists kept by two separate teams, and the space between them is where access quietly survives.
​
Internal moves are worse, because nobody thinks to take anything away.

What evidence does an assessor ask for?

Leaver records showing when access was removed against the termination date, and evidence that screening happened before access was granted in the first place.
SP Employee Hub handles this as one tracked record per person. Task templates assign work across HR, IT and facilities, covering account setup, equipment and access passes, and the same structure runs for terminations and transfers. It tracks the tasks rather than deprovisioning accounts itself, so the audit trail sits alongside Microsoft Entra ID and whatever else does the technical work.

Maps to: §3.9.1, §3.9.2, §3.1.1, §3.1.2

4. How do you report a cyber incident within 72 hours?

​You start the clock at the helpdesk ticket, because that is where the first sign always appears.
​
Nobody reports a security incident. They report that a file looks wrong, or that a login prompt appeared twice. That ticket is your timeline, whether you planned it that way or not.
​
The clock runs 72 hours from discovery to reporting through DIBNet, so you have to show when discovery happened and that the report moved quickly afterwards. A timeline reconstructed weeks later is exactly what an assessor pushes back on.

What evidence does an assessor ask for?

Incident records with detection and response times, the escalation path that was followed, and evidence of how the reporting decision was reached.

SP IT Helpdesk gives staff one obvious place to raise something and routes it automatically, so a report reaches the right person instead of sitting in an inbox. Priority handling puts an owner and a deadline against it, and every step is timestamped inside your tenant.

It is not your detection stack, which sits in Microsoft Defender and Purview. It is where the human report lands and where the clock becomes auditable.


Maps to: §3.6.1, §3.6.2; DFARS 252.204-7012(c)

5. How do you log physical access and maintenance?

​Against the asset itself, so any single machine can produce its own history on demand.
Contractors handling CUI on a shop floor fail here for unglamorous reasons. Server room access is recorded on a clipboard. A vendor took a machine away for repair and nobody wrote down whether the drive was wiped first.

What evidence does an assessor ask for?

Physical access logs, maintenance records tied to named assets and named people, and evidence that media was sanitised before equipment left the site.

SP Facilities Manager holds work orders, asset history, preventative maintenance schedules and contractor activity in your tenant. Each asset carries its own record, so the history for one machine can be produced on request instead of reconstructed from memory.

Maps to: §3.10.1 to §3.10.4; maintenance requirements at §3.7

6. How do you track security findings through to closure?

The same way your safety team already does it: an owner, a date, and proof the fix landed.
Something gets flagged in an inspection, someone owns it, there is a deadline, and there is a record showing it was actually fixed. Run that badly and a safety programme falls apart.
​
CMMC asks for the same discipline pointed at security. Where you fall short of a requirement, you write down what you will do about it, who is doing it and by when, then prove it was done. Being straight about it: the standard contains no safety controls, so this is not a mapping exercise. It is the same management loop applied to a different subject.

What evidence does an assessor ask for?

Every open item with a named owner, a target date and evidence of closure, alongside the assessments that produced them.
SP Safety already runs that loop: finding, owner, due date, corrective action, documented closure, with inspection scheduling and audit-ready reporting on top. SP configures the module to your specification during installation, so the same structure carries security findings alongside safety ones.

One distinction to hold onto. A remediation plan under the standard is an operational document you manage on your own schedule. A conditional-status plan under CMMC comes with eligibility limits and a 180-day deadline. You will need both.

Maps to: §3.12.1, §3.12.2, §3.12.3; 32 CFR 170.21

7. How do you prove requirements were passed down to suppliers?

With a contract record that names the supplier, the clause and the date, available the moment a prime asks.
Signing a defence contract means taking on obligations, and some of them you pass to your own suppliers. You also keep your assessment score current and confirm it once a year.
​
None of this is difficult. It has to be provable on the day someone asks, and it usually lives in a spreadsheet maintained by one person who already has another job.

What evidence does an assessor ask for?

Subcontract records showing the clause was passed down, your current score with its assessment date, and the date of your most recent annual affirmation.

SP Contract Tracker holds contract records with clause tracking, obligations, renewal dates and automated alerts, visible to everyone who needs them. When a prime asks for evidence on a named supplier, the record is already there.

Maps to: DFARS 252.204-7012(m), 252.204-7019, 252.204-7020, 252.204-7021

Where does software stop and your programme start?

At the point where evidence has to exist in the first place. Three limits worth stating plainly.

Government clouds are not commercial Microsoft 365. Power Platform connector and feature availability differs between them, and it shifts over time. Check availability against your own configuration before designing a workflow around it. Our breakdown of GCC and GCC High compatibility covers which applications qualify and why.

No application makes you compliant. The seven above close record-keeping gaps. Encryption, multi-factor authentication, boundary protection and logging sit in the platform and in how you configure it.
​
Scoping deserves a second pair of eyes. It is the decision everything else rests on. SP configures each deployment to the compliance specification you set, and works alongside whoever advises you on assessment, so the two do not pull in different directions.

See where your evidence actually sits.

Every requirement above comes down to producing the record on the day someone asks for it.
​
SP Marketplace applications run inside your own Microsoft 365 tenant, in GCC or GCC High, configured to your compliance specification during installation. Book a demo to see how they fit your environment.

FAQ's

Is CMMC cancelled?

No. Phase 2 and the phases after it are suspended while the programme is reviewed, but Phase 1 remains in force. Self-assessments, SPRS scores, annual affirmations and DFARS 252.204-7012 obligations all apply today, and the underlying rule was never repealed.

Do I need GCC High, or is GCC enough?

It depends on what you handle. GCC High runs on Azure Government with US-person-only operational access, which is what contractors handling CUI under DFARS 252.204-7012 or ITAR-controlled data need. Government Community Cloud (GCC) meets a lower bar and suits many state, local and civilian agency scenarios. Our GCC and GCC High page sets out how SP applications run in each.

Do SP applications count as an external service provider?

SP applications run inside your tenant rather than on SP infrastructure, and they are configured to your compliance specification during installation. External service provider status turns on the specifics of your environment and contracts, so confirm the determination with your assessor rather than assuming it.