On July 13, 2026 the Department of War suspended the November 2026 CMMC Phase 2 transition, restricted new procurements to Level 1 and Level 2 self-assessments, and launched a 60-day review of the certification program. DFARS 252.204-7012 remains in effect.
Microsoft offers Microsoft 365 Copilot in GCC High within the sovereign tenant boundary, but feature gaps, web grounding choices, and CUI governance needs define where you can use it.
CMMC Level 2 expects you to create and retain audit logs long enough to support investigations, and Microsoft 365 can meet that need when you configure Purview Audit retention to match your policy, scope, and licensing.
DoD set two CMMC final rules on different clocks, the 32 CFR program rule took effect in 2024, and the DFARS acquisition rule on November 10, 2025 started a four-phase contract rollout that runs through November 10, 2028.
Small DIB contractors can contain cost and risk by drawing a tight CMMC boundary around the systems and people that handle FCI and CUI, then documenting that boundary with clear data-flow and access control decisions.
Microsoft Purview Compliance Manager offers NIST SP 800-171 and CMMC-aligned assessment templates that organize actions and evidence in Microsoft 365, useful for gap analysis and documentation across a CUI environment.