Macs can operate in GCC High with Intune and Defender for Endpoint, but teams need to plan around feature gaps, scope Macs into the CUI boundary, and produce clear evidence against NIST SP 800-171 controls.
NIST SP 800-171 Rev 2 organizes 110 requirements into 14 families that drive CMMC Level 2 practice structure, and Microsoft 365 can shoulder a large share of the technical work in access, identity, logging, configuration, and data protection when paired with sound policy and scope control.
The CMMC 2.0 final rule in 32 CFR Part 170 ties defense contract assessments to NIST SP 800-171 and DFARS 252.204-7012, and DoD has suspended Phase II third-party certifications while those obligations remain in force.
CUI status does not change how long you keep records; decontrol and sanitization handle markings and media while contracts and schedules drive retention.
CMMC Level 2 expects you to protect backup CUI and prove that you can restore systems, so design backup and recovery with FIPS-validated protection, tested restores, and clear scope across primary and backup locations.
32 CFR Part 2002 directs agencies and authorized holders to use CUI Registry markings, apply clear banners with required category and dissemination indicators, and end legacy labels that the rule does not permit.