Microsoft Compliance Manager Templates for CMMC and NIST 800-171

Compliance Manager templates help your team organize NIST SP 800-171 and CMMC work inside Microsoft 365. You still need end-to-end implementation across the CUI environment and objective evidence that maps to the practices.

Purview Compliance Manager in the CMMC and NIST 800-171 program

Microsoft offers Compliance Manager in the Microsoft Purview portal to help organizations understand posture and reduce risk through assessments, actions, and evidence tracking. Microsoft’s NIST SP 800-171 offering confirms a dedicated NIST SP 800-171 assessment template inside Compliance Manager, and the regulations list shows NIST 800-171 as a selectable framework. Administrators can create assessments, assign actions to owners, and upload evidence to support audit readiness.

CMMC Level 2 draws from the 110 requirements in NIST SP 800-171 Rev. 2. NIST SP 800-171A provides assessment procedures for each requirement. Treat Compliance Manager as the project system for work that touches Microsoft 365 and adjacent cloud services. The DoD CIO and The Cyber AB describe an evidence-based method that assessors follow, and that method evaluates implementation of practices and processes, not the presence of a dashboard.

Templates you can select today

Your tenant includes a NIST SP 800-171 template that you can instantiate as one or more assessments. Microsoft Learn documents that template and places it in the Compliance Manager regulations list. Many organizations also see CMMC-aligned templates in the tenant template gallery. Names and coverage can vary by cloud and date, so confirm availability in your own portal.

Microsoft’s public sector CMMC guidance explains how Microsoft 365 Commercial, GCC, and GCC High support CMMC-related obligations when configured to meet requirements. Microsoft also publishes a Product Placemat for CMMC as a Preview workbook. The Placemat offers an informational mapping of Microsoft services to practices for planning and design. It does not serve as an authorization or an assessment rulebook.

Actions, evidence, and scoring inside an assessment

Each Compliance Manager assessment organizes work into improvement actions, tests, and evidence. Teams assign actions, set due dates, and attach proof such as configuration exports, policy documents, screenshots, and change tickets. The assessment also produces a score that reflects completion of those actions.

Treat the Compliance Manager score as an internal tracking aid. DoD uses the NIST SP 800-171 DoD Assessment Methodology for SPRS scoring, and CMMC uses pass or fail against the practices. Those methods do not draw from Compliance Manager’s score. If you need a refresher on SPRS, start here: SPRS scoring for NIST 800-171.

Evidence quality drives CMMC outcomes. The DoD Level 2 Assessment Guide calls for exam, interview, and test at the practice level. The Cyber AB CAP describes how assessors gather objective evidence and score practices. Compliance Manager can host artifacts and show ownership, which helps you keep materials current and discoverable during pre-assessment reviews.

Tenant choice and CUI scope

Cloud selection affects control inheritance, available capabilities, and data residency. Microsoft’s CMMC public sector page distinguishes Commercial, GCC, and GCC High. Teams handling CUI in line with DFARS clauses often select GCC High to align with FedRAMP High baselines and DoD SRG IL4 requirements. Microsoft’s Public Sector Blog explains differences across Microsoft clouds so you can pick the tenant that matches contract obligations and risk appetite.

Compliance Manager assessments only cover services inside the boundary you define. A CUI enclave often includes Microsoft 365, Azure services, identity providers, device management, and on-premises systems. Keep the scoping record tight. Map each practice to system components, then decide where Compliance Manager helps track progress. For help on scope, review CMMC scoping and the CUI boundary.

Limits and the assessment method

CMMC assessments evaluate implementation of practices and processes drawn from NIST SP 800-171. Assessors follow the CAP and the DoD Assessment Guide, collect objective evidence, and score each practice. That process does not depend on any commercial tool.

Plan for documents that sit outside Microsoft 365. Assessors expect a current System Security Plan with system descriptions, roles, interconnections, and control implementation narratives. They also expect plans, policies, and procedures that match the practices and actual operation. Use Compliance Manager to keep links to these artifacts, then store the canonical versions in your document management system. For SSP structure and content, see System Security Plan for NIST 800-171.

A practical way to use the templates

Start by instantiating a NIST SP 800-171 assessment in the Purview portal. Assign ownership by control family to named administrators and security leaders. Align the assessment scope to the CUI boundary that you intend to defend during an assessment.

Next, review the improvement actions that point to Microsoft 365 configurations. Map each action to one or more practices in your SSP and to responsible systems such as Entra ID, Exchange Online, SharePoint Online, Intune, or Microsoft Defender. Build a small set of evidence types that you will reuse: configuration exports, screenshots with version and timestamp, policy PDFs with owners and revision dates, and change records that show approvals.

Then run short working sessions with the owners. Close low-effort actions inside Microsoft 365, capture before-and-after records, and update your narratives. Create a Plan of Action and Milestones in your GRC system for gaps that require budget, integration work, or procurement. Compliance Manager actions can feed that POA&M management process. For POA&M mechanics, compare with POA&M management for CMMC.

Finally, reconcile your internal view of control status with official scoring methods. Use the DoD Assessment Methodology and your SSP to calculate an SPRS score. Keep Compliance Manager’s score separate so you do not blend two different metrics.

Evidence ideas tied to high-value practices

Teams often struggle to connect Microsoft 365 settings to NIST SP 800-171 practices in a repeatable way. The list below offers ideas that you can adapt. Do not treat these items as an authoritative mapping. Tie each item to your system design, your SSP, and the NIST SP 800-171A assessment procedures.

AC.L2-3.1.1 and AC.L2-3.1.2, system access control:
- Entra ID Conditional Access policies, user and device groups, and role assignments with approval records.
AU.L2-3.3.1, audit logs:
- Microsoft Purview Audit configuration, retention settings, and sample queries that show log fields for key events.
CM.L2-3.4.1, baseline configurations and inventories:
- Intune compliance policies, configuration profiles, security baselines, and device inventory exports that match the enclave scope.
MP.L2-3.8.9, confidentiality of CUI at rest:
- SharePoint Online and OneDrive encryption settings, service documentation for platform encryption, and BitLocker enforcement records for synced endpoints.

For each item, attach evidence in Compliance Manager and in your document repository, tie it to the practice text in 800-171, and note the test method that 800-171A calls for. Build the interview script that matches your implementation so system owners can answer consistently.

Using GCC and GCC High tenants with Compliance Manager

Microsoft documents how GCC and GCC High support CMMC-related obligations when configured to meet requirements. Organizations that select GCC High often do so to align with DFARS 252.204-7012 flowdown expectations and data handling needs that fit FedRAMP High and DoD SRG IL4. Compliance Manager runs in those environments and can host assessments aligned to NIST SP 800-171.

Service availability and template catalogs can change by cloud. Confirm current template names and action sets in your tenant. If you need to weigh a move to GCC High, review your contract mix, enclave design, data residency constraints, and identity strategy. A broader treatment sits here: GCC High migration decision framework.

Planning aids beyond the templates

Compliance Manager works well with other Microsoft references. The Microsoft NIST SP 800-171 offering page outlines inherited controls and shared responsibilities. The Microsoft Product Placemat for CMMC, published as a Preview workbook, provides an informational view of how Microsoft cloud services can support practices. Use the Placemat for design discussions with your architects and control owners. Keep final mappings in your SSP and in your control matrix, and point assessors to official criteria in NIST SP 800-171 and 800-171A.

If you need a crosswalk between NIST SP 800-171 and CMMC Level 2, see our overview here: NIST 800-171 to CMMC Level 2 mapping.

Bottom line for program leads

Compliance Manager brings order to Microsoft 365 controls, owners, and evidence. It cuts project friction inside the tenant and keeps artifacts close to the systems that produce them. DoD and Cyber AB materials set the bar for what counts during a CMMC assessment. Use the templates to drive work and to collect proof, then anchor every claim in your SSP, your technical configuration, and the practice text.