Blog
Maggie McGrath
July 22, 2026
- 619-292-0800
- [email protected]
- San Diego, CA
The DIB compliance landscape moves fast. CMMC compliance deadlines, GCC High licensing, FedRAMP authorization, Azure Government migrations, and Microsoft 365 for defense contractors (it’s a lot to track). CMMC Now keeps you current.
CMMC Compliance
Everything defense contractors need to know about CMMC Level 1 and Level 2 certification. Self-attestation requirements, C3PAO assessments, NIST 800-171 controls, and what the November 2026 deadline means for your contracts.
GCC High
Guides and analysis on Microsoft 365 GCC High licensing, configuration, and compliance. Who needs it, how to get it, and what to build inside it.
Azure Government
Coverage of Azure Government architecture, migrations, and compliance requirements for defense contractors. Environment design, identity configuration, and what separates authorized from compliant.
FedRAMP
Practical guidance on FedRAMP authorization pathways, readiness requirements, and continuous monitoring obligations for cloud service providers serving federal agencies.
Microsoft 365
How Microsoft 365 operate inside regulated environments. Teams, SharePoint, OneDrive, and Purview in GCC High and GCC configurations for DIB contractors.
Licensing
Microsoft licensing strategy for defense contractors. GCC High vs. GCC, license tier decisions, AOS-G partner requirements, and how to avoid overspending on seats you don’t need.
Migrations
Step-by-step guidance on moving from commercial Microsoft environments into GCC High, Azure Government, and other regulated platforms without disrupting business continuity.
Announcements
Updates from Agile IT on new services, partnerships, and compliance news affecting the defense industrial base.
Practical guidance on CMMC, GCC High, FedRAMP, and Azure Government for defense contractors.
Agile IT brings Microsoft-certified expertise to every GCC High licensing engagement and migration, applying proven methodologies to deliver compliant and secure outcomes.
Scope is the one CMMC decision you pay for twice when it is wrong. You pay once to build the boundary, and again to move it after assessment prep, a prime’s questionnaire, or your own Affirming Official finds CUI on the wrong side of it. Every other part of a
A CMMC enclave doesn’t lower your obligation. It lowers how much of your environment has to prove it. CMMC Level 2 applies to the systems that store, process, or transmit CUI, not to every system an organization runs. An enclave draws a hard boundary around those specific systems, so the
Microsoft built Business Premium for GCC High because most smaller contractors don’t need everything a G5 license includes. They need the specific controls CMMC Level 2 requires, and G5 is one way to get there, not the only one. What Business Premium for GCC High Actually Covers Microsoft announced Business
CMMC doesn’t ask whether your backups restore. Most organizations read that as good news. It isn’t relief. It’s a gap in the checklist, not a gap in the risk. What CMMC Actually Checks, and What It Doesn’t NIST SP 800-171 requires protecting the confidentiality of backup CUI at storage locations,
A CMMC assessment confirms an environment on one day. The attestation that follows requires it to still be true eleven months later, backed by the weight of the False Claims Act. Documentation says one thing. The environment does another, not because anyone lied, but because systems change faster than the
Every organization we migrate into GCC High already has backups running before we touch the tenant. Almost none of them have confirmed where those backups land. That gap isn’t hypothetical. DFARS 252.204-7012 requires covered contractor information systems to implement NIST SP 800-171. Control 3.8.9 states it plainly: protect the confidentiality
Scope is the one CMMC decision you pay for twice when it is wrong. You pay once to build the boundary, and again to move it after assessment prep, a prime’s questionnaire, or your own Affirming Official finds CUI on the wrong side of it. Every other part of a
A CMMC enclave doesn’t lower your obligation. It lowers how much of your environment has to prove it. CMMC Level 2 applies to the systems that store, process, or transmit CUI, not to every system an organization runs. An enclave draws a hard boundary around those specific systems, so the
Microsoft built Business Premium for GCC High because most smaller contractors don’t need everything a G5 license includes. They need the specific controls CMMC Level 2 requires, and G5 is one way to get there, not the only one. What Business Premium for GCC High Actually Covers Microsoft announced Business
CMMC doesn’t ask whether your backups restore. Most organizations read that as good news. It isn’t relief. It’s a gap in the checklist, not a gap in the risk. What CMMC Actually Checks, and What It Doesn’t NIST SP 800-171 requires protecting the confidentiality of backup CUI at storage locations,
A CMMC assessment confirms an environment on one day. The attestation that follows requires it to still be true eleven months later, backed by the weight of the False Claims Act. Documentation says one thing. The environment does another, not because anyone lied, but because systems change faster than the
Every organization we migrate into GCC High already has backups running before we touch the tenant. Almost none of them have confirmed where those backups land. That gap isn’t hypothetical. DFARS 252.204-7012 requires covered contractor information systems to implement NIST SP 800-171. Control 3.8.9 states it plainly: protect the confidentiality
The strategy session is where that work begins.
