CUI in Commercial Microsoft 365: What to Do Now

Somebody worked out that you have CUI in commercial Microsoft 365, sitting alongside the payroll spreadsheets and the shop calendar. It is the most common finding in the small defense supply base, and it happens for an entirely rational reason: you bought business software to run a business, and controlled information arrived later without anyone renegotiating where it would live.

The instinct at this point is to call Microsoft and ask to move everything. Resist that for a week. The expensive version of this project moves your whole company. The sensible version moves the data. Which one you end up with is decided in the next few days, not in the migration. This article sits under Something Just Happened and You Need CMMC: A Triage Guide.

What the clause actually demands of a cloud service

DFARS 252.204-7012 says that if you use an external cloud service provider to store, process or transmit covered defense information, that provider must meet security requirements equivalent to the FedRAMP Moderate baseline, and must satisfy the incident reporting, media preservation, malicious software submission, forensic access and damage assessment obligations in paragraphs (c) through (g) of the clause.

The clause in full is covered in What DFARS 252.204-7012 Requires, in Plain English. Read that second half again, because it is the part that gets skipped. Equivalency to a security baseline is a technical claim. The obligations in (c) through (g) are contractual commitments, and they mean the provider has to preserve images and media for at least 90 days after an incident and provide the government access for forensic analysis. Those are commitments a provider either makes to you in writing or does not.

Two other requirements sit alongside it. NIST SP 800-171 requires FIPS validated cryptography to protect controlled information, and FIPS 140-2 certificates move to historical status on September 21, 2026, so a certificate number you were quoted two years ago deserves rechecking. And if any of your data is export controlled under ITAR or EAR, access is restricted to United States persons, which is a personnel and data residency question rather than an encryption question.

Find the CUI in commercial Microsoft 365 before you choose a destination

Nobody can scope a migration they have not measured. Spend two days on this and the rest of the project gets smaller.

• Mail. Search for the customer domains that send you technical packages, and for the marking text itself. Attachments in mailboxes are where most of it lives, and mailboxes are the hardest place to clean up later.
• Files. SharePoint, OneDrive and any mapped file server. Look for drawing numbers, specification numbers and the folder that engineering actually uses rather than the one on the network diagram.
• Chat. Teams messages and channel files. People paste drawings into chat and nobody remembers doing it.
• Endpoints. Engineering laptops and the machine that drives the CMM. Local copies are common and they are inside your boundary whether you like it or not.
• Elsewhere. Personal cloud accounts, USB drives, the ERP system, printed drawings on the floor, and the quoting mailbox that three people share.

Write down what you find and who put it there. That inventory becomes the first section of your System Security Plan, so the work is not wasted even if the migration decision changes. If a delivery date is already committed, 90 days to get compliant covers what fits around a migration.

Four honest paths out, and what each one costs

The differences between the two government environments are laid out in Microsoft 365 GCC vs GCC High for CMMC, and the choice between them is worth making before you sign anything.

Two notes that save arguments later. The government community environments are not interchangeable with each other, and the one appropriate for export controlled data is not the same as the general government offering. Confirm which one your data requires before you sign, in writing, from Microsoft or your licensing partner. And be aware that some smaller providers advertise government tenants they resell without the corresponding contractual commitments, so read the actual terms.

Sequence the work so you are not exposed in the middle

The riskiest period in this project is the six weeks when data exists in both places and nobody is sure which copy is authoritative. Reduce that window deliberately.

1. Stop the inflow first. Tell your customer, in writing, the address or portal you want controlled information sent to going forward. This costs nothing and it stops the pile growing.
2. Stand up the destination and prove it works with two or three users before anyone else moves.
3. Move the identified data, then verify it arrived before you touch the source copies.
4. Remove the source copies deliberately and with a record. Mailboxes need the same attention as file shares, and retention policies can quietly keep copies you believe you deleted.
5. Write the boundary down in the System Security Plan and tell your people plainly where controlled work happens now. A boundary nobody has been told about is not a boundary.

One thing not to do

Do not mass delete controlled information from the commercial tenant to make the problem disappear. If your customer sent you data you should not have received, or sent it through a channel that was not appropriate, deletion destroys the record of what happened and complicates any notification obligation. Contain it, document it, notify the sender, then remediate. The full sequence is in CUI-marked drawings you weren’t expecting.