Microsoft Technical Reference Guide for CMMC L2 - Preview Sept 2024

Aug 30, 2026

The guide explains how the Cybersecurity Maturity Model Certification (CMMC) supports implementation of cybersecurity across the U.S. Defense Industrial Base, including the need to protect sensitive unclassified information across multi-tier supply chains. It introduces Microsoft’s approach for pursuing CMMC compliance using Microsoft cloud services, focusing on CMMC Level 2 and mapping all 110 controls from NIST SP 800-171. It also defines the intended audience and clarifies that compliance assessments and guidance are governed by CYBER AB.

LanguageEnglish

CategoryGeneral

FormatDOCX

Pages338

Reading Time1 h 58 min

AccessFree to download

Introduction

Notices

Microsoft CMMC Acceleration Program

Cybersecurity Maturity Model Certification (CMMC)

CMMC 2.0 Implementation Guidance

Overview of Implementation

CMMC 2.0 NIST Alignment

CMMC 2.0 Assessment Model

POA&M

CMMC Risk Assessment

Shared Responsibility in the Microsoft Cloud

Microsoft Services Implementation Guidance

Microsoft Primary and Secondary Services Definition

Azure Policy

Security Control Implementation Guidance

Access Control (AC)

Audit and Accountability (AU)

Awareness and Training (AT)

Configuration Management (CM)

Identification and Authentication (IA)

Incident Response (IR)

Maintenance (MA)

Media Protection (MP)

Personnel Security (PS)

Physical Protection (PE)

Risk Assessment (RA)

Security Assessment (CA)

Systems and Communications Protection (SC)

System and Information Integrity (SI)

CMMC Blogs

CMMC Resources

CMMC Tools

Microsoft Technical Reference Guide for CMMC Accelerate your journey to cmmc with the Microsoft cloud June 2024 TOC \o "1-3" \h \z \u HYPERLINK \l "_Toc118452961" Introduction PAGEREF _Toc118452961 \h 3 HYPERLINK \l "_Toc118452962" Notices PAGEREF _Toc118452962 \h 4 HYPERLINK \l "_Toc118452963" Microsoft CMMC Acceleration Program PAGEREF _Toc118452963 \h 5 HYPERLINK \l "_Toc118452964" Cybersecurity Maturity Model Certification (CMMC) PAGEREF _Toc118452964 \h 6 HYPERLINK \l "_Toc118452965" CMMC 2.0 Implementation Guidance PAGEREF _Toc118452965 \h 6 HYPERLINK \l "_Toc118452966" Overview of Implementation PAGEREF _Toc118452966 \h 6 HYPERLINK \l "_Toc118452967" CMMC 2.0 NIST Alignment PAGEREF _Toc118452967 \h 7 HYPERLINK \l "_Toc118452968" CMMC 2.0 Assessment Model PAGEREF _Toc118452968 \h 8 HYPERLINK \l "_Toc118452969" POA&M PAGEREF _Toc118452969 \h 10 HYPERLINK \l "_Toc118452970" CMMC Risk Assessment PAGEREF _Toc118452970 \h 10 HYPERLINK \l "_Toc118452971" Shared Responsibility in the Microsoft Cloud PAGEREF _Toc118452971 \h 10 HYPERLINK \l "_Toc118452972" Customer Eligibility for Azure Commercial and Azure Government PAGEREF _Toc118452972 \h 12 HYPERLINK \l "_Toc118452973" Microsoft Services Implementation Guidance PAGEREF _Toc118452973 \h 12 HYPERLINK \l "_Toc118452974" Microsoft Primary and Secondary Services Definition PAGEREF _Toc118452974 \h 12 HYPERLINK \l "_Toc118452975" Azure Policy PAGEREF _Toc118452975 \h 12 HYPERLINK \l "_Toc118452976" Microsoft Service Implementation Guidance PAGEREF _Toc118452976 \h 14 HYPERLINK \l "_Toc118452977" Access Control (AC) PAGEREF _Toc118452977 \h 14 HYPERLINK \l "_Toc118452978" Audit and Accountability (AU) PAGEREF _Toc118452978 \h 67 HYPERLINK \l "_Toc118452979" Awareness and Training (AT) PAGEREF _Toc118452979 \h 87 HYPERLINK \l "_Toc118452980" Configuration Management (CM) PAGEREF _Toc118452980 \h 91 HYPERLINK \l "_Toc118452981" Identification and Authentication (IA) PAGEREF _Toc118452981 \h 118 HYPERLINK \l "_Toc118452982" Incident Response (IR) PAGEREF _Toc118452982 \h 136 HYPERLINK \l "_Toc118452983" Maintenance (MA) PAGEREF _Toc118452983 \h 144 HYPERLINK \l "_Toc118452984" Media Protection (MP) PAGEREF _Toc118452984 \h 157 HYPERLINK \l "_Toc118452985" Personnel Security (PS) PAGEREF _Toc118452985 \h 183 HYPERLINK \l "_Toc118452986" Physical Protection (PE) PAGEREF _Toc118452986 \h 188 HYPERLINK \l "_Toc118452987" Risk Assessment (RA) PAGEREF _Toc118452987 \h 192 HYPERLINK \l "_Toc118452988" Security Assessment (CA) PAGEREF _Toc118452988 \h 202 HYPERLINK \l "_Toc118452989" Systems and Communications Protection (SC) PAGEREF _Toc118452989 \h 213 HYPERLINK \l "_Toc118452990" System and Information Integrity (SI) PAGEREF _Toc118452990 \h 259 HYPERLINK \l "_Toc118452991" CMMC Blogs PAGEREF _Toc118452991 \h 280 HYPERLINK \l "_Toc118452992" CMMC Resources PAGEREF _Toc118452992 \h 280 HYPERLINK \l "_Toc118452993" CMMC Tools PAGEREF _Toc118452993 \h 280 Introduction The Cybersecurity Maturity Model Certification (CMMC) is a unifying standard for the implementation of cybersecurity across the United States Defense Industrial Base (DIB). The DIB encompasses the commercial organizations that produce or provide products and services to the United States Department of Defense (DoD). CMMC includes a comprehensive and scalable certification element to verify the implementation of controls associated with the achievement of a cybersecurity maturity level. CMMC is designed to provide increased assurance to the DoD that a DIB company can adequately protect sensitive unclassified information, accounting for information flow down to subcontractors in a multi-tier supply chain. The Microsoft Technical Reference Guide for CMMC inc

FAQs

What is CMMC and what problem does it address for the Defense Industrial Base?

CMMC is a unifying certification standard for implementing cybersecurity across the U.S. Defense Industrial Base. It verifies that DIB organizations protect sensitive unclassified information with controls aligned to maturity levels and considers information flow down to subcontractors.

Which CMMC level and control set does the Microsoft Technical Reference Guide focus on?

The guide focuses on CMMC Level 2 (L2). CMMC L2 includes all 110 controls from NIST SP 800-171.

Do Microsoft products and this guide cover all security controls required for CMMC?

No. The guide provides a resource to pursue CMMC compliance using Microsoft products and services, and it explicitly does not address security controls occurring outside of Microsoft products and services.

Aug 30, 2026

Upload by Chloe Bennett