Blog
Raven Riley
July 22, 2026
The DIB compliance landscape moves fast. CMMC compliance deadlines, GCC High licensing, FedRAMP authorization, Azure Government migrations, and Microsoft 365 for defense contractors (it’s a lot to track). CMMC Now keeps you current.
CMMC Compliance
Everything defense contractors need to know about CMMC Level 1 and Level 2 certification. Self-attestation requirements, C3PAO assessments, NIST 800-171 controls, and what the November 2026 deadline means for your contracts.
GCC High
Guides and analysis on Microsoft 365 GCC High licensing, configuration, and compliance. Who needs it, how to get it, and what to build inside it.
Azure Government
Coverage of Azure Government architecture, migrations, and compliance requirements for defense contractors. Environment design, identity configuration, and what separates authorized from compliant.
FedRAMP
Practical guidance on FedRAMP authorization pathways, readiness requirements, and continuous monitoring obligations for cloud service providers serving federal agencies.
Microsoft 365
How Microsoft 365 operate inside regulated environments. Teams, SharePoint, OneDrive, and Purview in GCC High and GCC configurations for DIB contractors.
Licensing
Microsoft licensing strategy for defense contractors. GCC High vs. GCC, license tier decisions, AOS-G partner requirements, and how to avoid overspending on seats you don’t need.
Migrations
Step-by-step guidance on moving from commercial Microsoft environments into GCC High, Azure Government, and other regulated platforms without disrupting business continuity.
Announcements
Updates from Agile IT on new services, partnerships, and compliance news affecting the defense industrial base.
Practical guidance on CMMC, GCC High, FedRAMP, and Azure Government for defense contractors.
Agile IT brings Microsoft-certified expertise to every GCC High licensing engagement and migration, applying proven methodologies to deliver compliant and secure outcomes.
Most CUI scope decisions get made in one meeting, by whoever is in the room, and documented afterward to match. That boundary holds until a C3PAO asks who justified it. The designating agency decides what qualifies. Data flow decides what’s in scope. The Microsoft environment follows both, not the reverse.
Assessment failures rarely start with missing controls. They start with decisions no one wrote down. CMMC Level 2 assessments that stall inside a Microsoft environment tend to start from the same baseline, not a shortage of controls. Conditional access is enforced, audit logging is active, and identity governance is running
Phase II certification is paused. DFARS 252.204-7012, 7019, and 7020 are not. Self-assessments, SPRS scores, and 72-hour incident reporting remain contractually binding, and with no assessor in the room, the accuracy of your score matters more, not less.
CMMC Level 1 and Level 2 don’t follow the same logic, and treating them as steps on the same ladder is where scoping goes wrong. This guide breaks down what triggers each level, how the assessments differ, and the decisions defense contractors need to make before either one gets scheduled.
Learn how defense contractors can perform secure tenant-to-tenant migrations while protecting CUI and meeting DFARS and CMMC requirements.
Learn the essential steps to plan and execute a successful Microsoft 365 GCC High migration—ensuring compliance, security, and operational continuity.
Most CUI scope decisions get made in one meeting, by whoever is in the room, and documented afterward to match. That boundary holds until a C3PAO asks who justified it. The designating agency decides what qualifies. Data flow decides what’s in scope. The Microsoft environment follows both, not the reverse.
Assessment failures rarely start with missing controls. They start with decisions no one wrote down. CMMC Level 2 assessments that stall inside a Microsoft environment tend to start from the same baseline, not a shortage of controls. Conditional access is enforced, audit logging is active, and identity governance is running
Phase II certification is paused. DFARS 252.204-7012, 7019, and 7020 are not. Self-assessments, SPRS scores, and 72-hour incident reporting remain contractually binding, and with no assessor in the room, the accuracy of your score matters more, not less.
CMMC Level 1 and Level 2 don’t follow the same logic, and treating them as steps on the same ladder is where scoping goes wrong. This guide breaks down what triggers each level, how the assessments differ, and the decisions defense contractors need to make before either one gets scheduled.
Learn how defense contractors can perform secure tenant-to-tenant migrations while protecting CUI and meeting DFARS and CMMC requirements.
Learn the essential steps to plan and execute a successful Microsoft 365 GCC High migration—ensuring compliance, security, and operational continuity.
The strategy session is where that work begins.
