Tag: CUI

DFARS 252.204-7012 sets a 72-hour deadline to report a qualifying cyber incident through DIBNet, and the mechanics matter to meet the clause and support DoD follow-up.

Defender for Endpoint runs in GCC High with distinct portals, identity endpoints, and connectivity requirements, so your plan must align to those government-cloud boundaries from the start.

NIST SP 800-171 Rev 2 organizes 110 requirements into 14 families that drive CMMC Level 2 practice structure, and Microsoft 365 can shoulder a large share of the technical work in access, identity, logging, configuration, and data protection when paired with sound policy and scope control.

CUI status does not change how long you keep records; decontrol and sanitization handle markings and media while contracts and schedules drive retention.

32 CFR Part 2002 directs agencies and authorized holders to use CUI Registry markings, apply clear banners with required category and dissemination indicators, and end legacy labels that the rule does not permit.

Sensitivity label inheritance in Microsoft Purview can help files and emails keep CUI-equivalent markings, but contractors need clear NARA-aligned marking policy, targeted configuration, and testing to make the behavior hold across Office, Exchange, SharePoint, and OneDrive.